Open Hunting - Threat Library

Openhunting Threat Library

IXESHE

(Type: Reconnaissance, Backdoor, Info stealer, Exfiltration)

(Trend Micro) The IXESHE malware binary allowed the attackers to easily take over and maintain complete control of victims’ systems to do the following: • List all services, processes, and drives • Terminate processes and services • Download and upload files • Start processes and services • Get victims’ user names • Get a machine’s name and domain name • Download and execute arbitrary files • Cause a system to pause or sleep for a specified number of minutes • Spawn a remote shell • List all current files and directories

[News Analysis] Trends:

Total Trend: 0

Trend Per Year

Trend Per Month

[News Analysis] News Mention Another Threat Name:

[TTP Analysis] Technique Performance:

reconnaissance

0/43

resource development

0/45

initial access

0/19

execution

1/36

persistence

1/113

privilege escalation

1/96

defense evasion

3/184

credential access

0/63

discovery

6/44

lateral movement

0/22

collection

1/37

command and control

3/39

exfiltration

0/18

impact

0/26

[TTP Analysis] Mitre Attack Matrix:

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
			T1059.003 Command And Scripting Interpreter : Windows Command Shell	T1547.001 Boot Or Logon Autostart Execution : Registry Run Keys / Startup Folder	T1547.001 Boot Or Logon Autostart Execution : Registry Run Keys / Startup Folder	T1564.001 Hide Artifacts : Hidden Files And Directories T1070.004 Indicator Removal : File Deletion T1036.005 Masquerading : Match Legitimate Name Or Location		T1083 File And Directory Discovery T1057 Process Discovery T1082 System Information Discovery T1016 System Network Configuration Discovery T1033 System Owner/user Discovery T1007 System Service Discovery		T1005 Data From Local System	T1071.001 Application Layer Protocol : Web Protocols T1132.001 Data Encoding : Standard Encoding T1105 Ingress Tool Transfer

[Infrastructure Analysis] Based on Related IOC:

IP:Port	Timestamp

Domain	Timestamp

URL	Timestamp

[Target Analysis] Region/Sector:

No information

References:

News Basic Information Indicator of Compromise Mitre Attack

Basic Information (Credit @etda.or.th)

Tool: IXESHE

Names: IXESHE

Description: (Trend Micro) The IXESHE malware binary allowed the attackers to easily take over and maintain complete control of victims’ systems to do the following: • List all services, processes, and drives • Terminate processes and services • Download and upload files • Start processes and services • Get victims’ user names • Get a machine’s name and domain name • Download and execute arbitrary files • Cause a system to pause or sleep for a specified number of minutes • Spawn a remote shell • List all current files and directories

Category: Malware

Type: Reconnaissance, Backdoor, Info stealer, Exfiltration

Information: https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf

Mitre-attack: https://attack.mitre.org/software/S0015/

Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:IXESHE

Last-card-change: 2020-04-22

Source: https://apt.etda.or.th/cgi-bin/listtools.cgi

TTP Info (Credit @Mitre)

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
			T1059.003 COMMAND AND SCRIPTING INTERPRETER : WINDOWS COMMAND SHELL ixeshe is capable of executing commands via cmd.	T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER ixeshe can achieve persistence by adding itself to the hkcu\software\microsoft\windows\currentversion\run registry key.	T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER ixeshe can achieve persistence by adding itself to the hkcu\software\microsoft\windows\currentversion\run registry key.	T1564.001 HIDE ARTIFACTS : HIDDEN FILES AND DIRECTORIES ixeshe sets its own executable file's attributes to hidden. T1070.004 INDICATOR REMOVAL : FILE DELETION ixeshe has a command to delete a file from the machine. T1036.005 MASQUERADING : MATCH LEGITIMATE NAME OR LOCATION ixeshe has used registry values and file names associated with adobe software, such as acrord32.exe.		T1083 FILE AND DIRECTORY DISCOVERY ixeshe can list file and directory information. T1057 PROCESS DISCOVERY ixeshe can list running processes. T1082 SYSTEM INFORMATION DISCOVERY ixeshe collects the computer name of the victim's system during the initial infection. T1016 SYSTEM NETWORK CONFIGURATION DISCOVERY ixeshe enumerates the ip address, network proxy settings, and domain name from a victim's system. T1033 SYSTEM OWNER/USER DISCOVERY ixeshe collects the username from the victim’s machine. T1007 SYSTEM SERVICE DISCOVERY ixeshe can list running services.		T1005 DATA FROM LOCAL SYSTEM ixeshe can collect data from a local system.	T1071.001 APPLICATION LAYER PROTOCOL : WEB PROTOCOLS ixeshe uses http for command and control. T1132.001 DATA ENCODING : STANDARD ENCODING ixeshe uses custom base64 encoding schemes to obfuscate command and control traffic in the message body of http requests. T1105 INGRESS TOOL TRANSFER ixeshe can download and execute additional files.