Securelist MuddyWater Oct 2018

MuddyWater has used malware to collect the victim’s IP address and domain name.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

MuddyWater has used malware that can collect the victim’s username.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

MuddyWater has used malware to obtain a list of running processes on the system.

MuddyWater has used PowerShell for execution.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

MuddyWater has used malware that can collect the victim’s OS version and machine name.

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.

MuddyWater has used malware that can capture screenshots of the victim’s machine.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

MuddyWater has used malware that can execute PowerShell scripts via DDE.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.