• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-7724 – Node.js tiny-conf code execution
September 3, 2020
Rewterz Threat Alert – Nanocore RAT- IOC’s
September 3, 2020

Rewterz Threat Alert – TA413 Targets Tibet and Europe with Sepulcher Malware

September 3, 2020

Severity

High

Analysis Summary

Researchers have published their analysis of recent activity being carried out by TA413. The first campaign they report on targeted European diplomatic and legislative bodies, non-profit policy research organizations, and global organizations dealing with economic affairs, which is not the usual target of this group. However, infrastructure and TTP overlaps allow for attribution to the APT. These targets received COVID-19 themed phishing emails with weaponsized RTF documents. An RTF exploit is used to drop a WMF file, which, in turn, drops and installs the Sepulcher malware. The WMF file is also responsible for setting up persistence via a scheduled task. The second campaign was aimed towards the group’s more common target, the Tibetan community. Once again, infrastructure and TTPs from older TA413 campaigns were leveraged in this campaign. The initial attachment, however, was a malicious PPTX attachment that downloads the Sepulcher malware from a remote server and executes it. Upon execution, the Sepulcher malware reaches out to its C2 server, which is defined in a configuration saved to the Registry. After initial communication is established, Sepulcher provides basic RAT functionality to the operator. This includes capabilities such as file operations, reconnaissance, spawning a shell, and interacting with services and processes.

APT_1

Impact

  • Interrupting file operations 
  • Reconnaissance
  • Exposure of sensitive data 

Indicators of Compromise

Domain Name

  • Dalailamatrustindia[.]ddns[.]net

From Email

  • mediabureauin@gmail[.]com
  • tseringkanyaq@yahoo[.]com

IP

  • 107[.]151[.]194[.]197
  • 118[.]99[.]13[.]4
  • 115[.]126[.]6[.]16

SHA-256

  • 4a4a959aef64ea48e2b831468119180d0af4b5b685c35170f5db3f001b9cc319
  • f6f9224c389ee46b28fe04847de4afb1e33ca03763c9e5c41bc61a29eab7f669
  • ff301b3295959a3ac5f3d0a5ea0d9f0aedcd8da7c4207b18f4bbb6ddaa0cdf22
  • e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4

URL

  • hxxp[:]//118[.]99[.]13[.]4[:]1234/qqqzqa
  • hxxp[:]//118[.]99[.]13[.]4[:]8099/file[.]dll

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.