Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент SUGARDUMP
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
SUGARDUMP
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

SUGARDUMP

SUGARDUMP is a proprietary browser credential harvesting tool that was used by UNC3890 during the C0010 campaign. The first known SUGARDUMP version was used since at least early 2021, a second SMTP C2 version was used from late 2021-early 2022, and a third HTTP C2 variant was used since at least April 2022.(Citation: Mandiant UNC3890 Aug 2022)
ID: S1042
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 21 Sep 2022
Last Modified: 04 Oct 2022

Techniques Used
Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

A SUGARDUMP variant has used HTTP for C2.(Citation: Mandiant UNC3890 Aug 2022)
.003 Application Layer Protocol: Mail Protocols

A SUGARDUMP variant used SMTP for C2.(Citation: Mandiant UNC3890 Aug 2022)

Enterprise T1560 .003 Archive Collected Data: Archive via Custom Method

SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.(Citation: Mandiant UNC3890 Aug 2022)
Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.(Citation: Mandiant UNC3890 Aug 2022)
Enterprise T1074 .001 Data Staged: Local Data Staging

SUGARDUMP has stored collected data under `%%\\CrashLog.txt`.(Citation: Mandiant UNC3890 Aug 2022)
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.(Citation: Mandiant UNC3890 Aug 2022)

.005 Masquerading: Match Legitimate Name or Location

SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.(Citation: Mandiant UNC3890 Aug 2022)

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.(Citation: Mandiant UNC3890 Aug 2022)
Enterprise T1204 .002 User Execution: Malicious File

Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.(Citation: Mandiant UNC3890 Aug 2022)

References

  1. Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.