THREAT OPS › Threat News › Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain
Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain
<h2>Executive summary</h2><p style="direction: ltr;"><span style="font-size: undefined;">Rapid7 researchers have identified a sophisticated malware campaign attributed to the threat actor "Dropping Elephant," characterized by the use of a China-themed decoy document to deliver a heavily reworked, in-memory remote access trojan (RAT). This campaign demonstrates advanced evasion techniques, includin
Attributed threat actors
- PatchworkG0040
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- Screen CaptureT1113
- Standard EncodingT1132.001
- Match Legitimate Resource Name or LocationT1036.005
- Malicious FileT1204.002
- Symmetric CryptographyT1573.001
- System ChecksT1497.001
- Spearphishing AttachmentT1566.001
- System Information DiscoveryT1082
- Application Layer ProtocolT1071
- Scheduled Task/JobT1053
- Data from Local SystemT1005
- MasqueradingT1036
- Reflective Code LoadingT1620
- System Network Configuration DiscoveryT1016
- Command and Scripting InterpreterT1059
- File and Directory DiscoveryT1083
- Virtualization/Sandbox EvasionT1497
- Spearphishing AttachmentT1598.002
- Process DiscoveryT1057
- Exfiltration Over C2 ChannelT1041
- PowerShellT1059.001
- Hijack Execution FlowT1574
- Obfuscated Files or InformationT1027
- Encrypted ChannelT1573
- System Location DiscoveryT1614
- Data EncodingT1132
- Windows Command ShellT1059.003
- Web ProtocolsT1071.001
- Ingress Tool TransferT1105
- Dynamic API ResolutionT1027.007
- Data from Local SystemAML.T0037
- Command and Scripting InterpreterAML.T0050
- MasqueradingAML.T0074
- Process DiscoveryAML.T0089
- Virtualization/Sandbox EvasionAML.T0097
Indicators of compromise
- 56d656d684077e7b3231393f5464447cdc8eea81b6415c5f010bc52f0c8cb317sha256
- b58351ead08db413ca499cfeb1b1091ed8bfd68f4089605e452fa01ed46f42b1sha256
- 914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6sha256
- a5e448af73b0ff6b6fcfe6ef7808120e1fd7e5c4c9b4edd68e1c980e5ea3406bsha256
- 1f1e1d1c1b1a101108090a0b0c0d0e0f00020405040102031011121415181611sha256
- 7099c33933716c00c1f4bdb0281c230b981c76b23d7d1c83abc6f58968267d54sha256
- 8b6acc087e403b913254dd7d99f09136dc54fa45cf3029a8566151120d34d1c2sha256
- a8ecbd9c049044ca4990a0e5960d19ce782a3b42d7763e9693d7c91ead24a0b7sha256
- 718812adb0d669eea9606432202371e358c7de6cdeafeddad222c36ae0d3f263sha256
- 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94sha256
- ecab0e747bff16a1163bbd9bb494e68dd4d7ca655ac7279bd4dd73221f7df57csha256
- 000803030902060708090a0b0c0d0e0fmd5
- https://chinagreenenergy.org/doc/35566/SXxlsurl
- https://chinagreenenergy.org/doc/list/load-list/dfe87bbc-53e0-489f-a9e6-ab8f4be47cb9url
- https://chinagreenenergy.org/doc/list/load-list/8daaa3e4-c85e-40c1-a2a2-94679e94c417url
- https://chinagreenenergy.org/doc/list/load-list/ecdc6b92-62b5-4acd-99f2-af09902938e1url
- https://chinagreenenergy.org/doc/list/load-list/e7477b17-45f0-420b-b2b1-811d4c1556eaurl
- https://chinagreenenergy.org/doc/list/load-list/000bd4a8-814d-414c-8be8-f0c77a9c7e1eurl
- 123.0.0.0ipv4
- images.contentstack.iodomain
- gcl-power.orgdomain
- api.ipify.orgdomain
- ip2c.orgdomain