ESET PipeMon May 2020

PipeMon can switch to an alternate C2 domain when a particular date has been reached.

PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.

PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.

PipeMon modules are stored encrypted on disk.

PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.

PipeMon can inject its modules into various processes using reflective DLL loading.

PipeMon can iterate over the running processes to find a suitable injection target.

PipeMon can collect and send OS version and computer name as a part of its C2 beacon.

The PipeMon communication module can use a custom protocol based on TLS over TCP.

PipeMon can install additional modules via C2 commands.

PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.

PipeMon has modified the Registry to store its encrypted payload.

PipeMon can send time zone information from a compromised host to C2.

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.

PipeMon can attempt to gain administrative privileges using token impersonation.

PipeMon can use parent PID spoofing to elevate privileges.

PipeMon can decrypt password-protected executables.

PipeMon can check for the presence of ESET and Kaspersky security software.

PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.

The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.

PipeMon installer can use UAC bypass techniques to install the payload.

PipeMon, its installer, and tools are signed with stolen code-signing certificates.

PipeMon communications are RC4 encrypted.