Incident Score: Analysis & Impact (SOUSOU1778164084)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with moderate to high confidence (80%), supported by evidence indicating attack vector such as Phishing and Supply Chain Compromise: Compromise Software Dependencies and Development Tools (T1195.002) with moderate confidence (50%), supported by evidence indicating dLL side-loading to deploy malware. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (70%), supported by evidence indicating custom malware (NetDraft, CloudSorcerer v3) deployed and Command and Scripting Interpreter: PowerShell (T1059.001) with moderate confidence (60%), supported by evidence indicating open-source tools (gogo, naabu, httpx) used. Under the Persistence tactic, the analysis identified Create or Modify System Process: Windows Service (T1543.003) with moderate to high confidence (70%), supported by evidence indicating malware alters behavior based on host process (spoolsv.exe), Hijack Execution Flow: DLL Side-Loading (T1574.002) with high confidence (90%), supported by evidence indicating dLL side-loading to deploy malware while avoiding detection, and External Remote Services (T1133) with moderate to high confidence (80%), supported by evidence indicating proxy tunneling (Stowaway, SoftEther VPN) for persistent access. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate confidence (60%), supported by evidence indicating credential harvesting via adconnectdump.py, SharpGetUserLoginRDP and Hijack Execution Flow: DLL Side-Loading (T1574.002) with moderate to high confidence (80%), supported by evidence indicating dLL side-loading to deploy malware. Under the Defense Evasion tactic, the analysis identified Masquerading: Match Legitimate Name or Location (T1036.005) with high confidence (90%), supported by evidence indicating malware alters behavior based on host process (dnapimg.exe, spoolsv.exe), Hijack Execution Flow: DLL Side-Loading (T1574.002) with high confidence (90%), supported by evidence indicating dLL side-loading to avoid detection, Valid Accounts (T1078) with moderate to high confidence (80%), supported by evidence indicating credential harvesting via adconnectdump.py, SharpGetUserLoginRDP, and Hide Artifacts: Email Hiding Rules (T1564.008) with moderate confidence (50%), supported by evidence indicating legitimate cloud services (OneDrive, GitHub) abused. Under the Credential Access tactic, the analysis identified OS Credential Dumping: LSASS Memory (T1003.001) with moderate to high confidence (80%), supported by evidence indicating credential harvesting via adconnectdump.py, Credentials from Password Stores (T1555) with moderate to high confidence (70%), supported by evidence indicating sharpGetUserLoginRDP tool used for credential harvesting, and Brute Force: Password Guessing (T1110.001) with moderate confidence (60%), supported by evidence indicating deep reconnaissance before lateral movement. Under the Discovery tactic, the analysis identified Account Discovery: Domain Account (T1087.002) with moderate to high confidence (80%), supported by evidence indicating deep reconnaissance of compromised endpoints, Network Service Discovery (T1046) with high confidence (90%), supported by evidence indicating open-source tools (naabu, httpx, PortQry) used for reconnaissance, and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating system profiling via dnapimg.exe. Under the Lateral Movement tactic, the analysis identified Remote Services: Remote Desktop Protocol (T1021.001) with moderate to high confidence (70%), supported by evidence indicating sharpGetUserLoginRDP tool used for credential harvesting and Lateral Tool Transfer (T1570) with moderate to high confidence (80%), supported by evidence indicating deep reconnaissance before lateral movement. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating government intelligence, sensitive communications compromised and Automated Collection (T1119) with moderate to high confidence (80%), supported by evidence indicating custom malware (NetDraft, CloudSorcerer v3) for data exfiltration. Under the Command and Control tactic, the analysis identified Web Service: Bidirectional Communication (T1102.002) with high confidence (90%), supported by evidence indicating oneDrive, GitHub used for C2 communication, Proxy: Multi-hop Proxy (T1090.003) with moderate to high confidence (80%), supported by evidence indicating proxy tunneling (Stowaway, SoftEther VPN) for persistent access, and Encrypted Channel: Symmetric Cryptography (T1573.001) with moderate to high confidence (70%), supported by evidence indicating malware uses legitimate cloud services to blend traffic. Under the Exfiltration tactic, the analysis identified Exfiltration Over C2 Channel (T1041) with high confidence (90%), supported by evidence indicating data exfiltration via OneDrive, GitHub and Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with high confidence (90%), supported by evidence indicating oneDrive used for C2 and exfiltration. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.