Abstract
An APT group is using Hajj-themed phishing lures to target and steal WhatsApp data from government and diplomatic officials. Our team has gathered fragmented intelligence from public cybersecurity vendor reports, blog posts, and internal security alerts. Your task is to build a comprehensive profile of the threat actor responsible. You must connect the dots between different reports to answer questions about their identity, tools, and motives.
Below are the sites we have compiled, use these to answer the following questions. (If any of the sites become unavailable please check on wayback machine as they all have been saved).
- Evidence 1: https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/
- Evidence 2: https://medium.com/@knownsec404team/apt-k-47-mysterious-elephant-a-new-apt-organization-in-south-asia-5c66f954477
- Evidence 3: https://medium.com/@knownsec404team/unveiling-the-past-and-present-of-apt-k-47-weapon-asyncshell-5a98f75c2d68
The evidence for this sherlock is provided in the scenario and consists out of 3 blog posts.
Question 1
What is the primary name of the APT group described in the SecureList report?
The answer to this question is right in the title of the blog post.
Mysterious Elephant
Question 2
According to the Knownsec 404 team's analysis(Evidence -3), since which year has this group's attack activity been dated back to?
2022
Question 3
The group uses a custom backdoor that communicates via Office Remote Procedure Call (ORPCBackdoor). According to the Knownsec 404 team's analysis(Evidence -2), what is the name of the first malicious exported entry function?
Under 3.1 they show a list of all exported function names and the following paragraphs reference two malicious entries, GetFileVersionInfoBy- HandleEx(void) (with a typo) and DllEntryPoint.
GetFileVersionInfoByHandleEx(void)
Question 4
The previously mentioned backdoor checks for a file before creating persistence. What is the name of the file?
Figure 13 shows the relevant code snippet with the filename as comment.
ts.dat
Question 5
The use of the backdoor links the APT to another well-known South Asian APT group. What is the name of this other group?
Looking up ORPCBackdoor shows blog posts by the same authors attributing the backdoor to another group called Bitter.1 This name is also referenced in the evidence 2.
Bitter
Question 6
The APT group we are currently investigating has consistently used and updated another backdoor since 2023, with its C2 communication evolving from TCP to HTTPS. What is the name of this tool?
Evidence 3 shows the evolution of the backdoor Asyncshell in table 1. V1 relied on TCP while V2 moved to HTTPS.
Asyncshell-v2
Question 7
To evade sandbox analysis, the MemLoader HidenDesk tool checks the number of active processes before running. What is the minimum number of processes required for it to proceed?
Evidence 1 explains the operations performed by HidenDesk. It first checks if fewer than 40 processes are running and terminates itself when that’s the case.
40
Question 8
The MemLoader HidenDesk tool creates a covert environment for its activities by creating and switching to a specific environment. What is the name of this hidden desktop?
Step 3 from the previous question has the answer.
MalwareTech_Hidden
Question 9
The MemLoader HidenDesk tool achieves persistence by placing a shortcut in the autostart folder to ensure it runs after a system reboot. What is the MITRE ATT&CK ID for the 'Registry Run Keys / Startup Folder' technique?
MITRE tracks this as T1547.001 in tactic Persistence.
T1547.001
Question 10
The actor uses several custom exfiltration tools targeting WhatsApp. What is the name of the tool that recursively searches specific directories, including the “Desktop” and “Downloads” folders?
Also contained in evidence 1. The blog posts lists the WhatsApp-specific exfiltration tools.
Stom Exfiltrator
Question 11
Kaspersky's analysis highlights the actor's heavy use of scripts for execution and deploying payloads. What is the MITRE ATT&CK ID for the 'PowerShell' technique?
PowerShell is a sub-technique of Command and Scripting Interpreter in tactic Execution.
T1059.001
Question 12
In their early attack chains, Mysterious Elephant used a downloader that was previously associated with the Origami Elephant group. What was the name of this downloader?
Kaspersky links the usage of Vtyrei to the attack groups Origami Elephant and Mysterious Elephant.
Vtyrei
Question 13
In a January 2024 campaign delivering an Asyncshell payload, which CVE was exploited in the malicious archive file?
The third evidence names the vulnerability in 4.1.
CVE-2023-38831
Question 14
What is the MD5 hash of the ChromeStealer Exfiltrator sample named WhatsAppOB.exe?
At the end of Kaspersky’s blog post there’s a section with indicators of compromise.
9e50adb6107067ff0bab73307f5499b6
Question 15
The intelligence describes multiple custom tools designed to upload stolen data to the actor's servers. According to the MITRE ATT&CK framework, what is the ID for the 'Exfiltration Over C2 Channel' technique?
In the Exfiltration tactic I can find T1041.
T1041