Ursnif Banking Trojan

Name:
Ursnif Banking Trojan

TTP:
T1564.001 Hide Artifacts: Hidden Files and Directories, T1027.002 Obfuscated Files or Information: Software Packing, T1055.001 Process Injection: Dynamic-link Library Injection, T1055.012 Process Injection: Process Hollowing, T1620 Reflective Code Loading

Hypothesis:

The Ursnif banking trojan may be present in the environment, utilizing memory injection techniques to evade detection and maintain persistence.

Campaign Type:
TTP Driven

Data Sources:

• Endpoint process logs (Sysmon, EDR)
• Memory forensics data
• Network traffic logs (firewall, proxy)
• File system activity logs

Tools:

• Need tools according to report

Scenario:

Initial Access: Phishing email with malicious attachment or link.

Execution:

• User opens the attachment or clicks the link, triggering the download and execution of the Ursnif payload.
• The payload employs obfuscation and packing techniques to evade static analysis.
• Ursnif injects malicious code into legitimate processes using process hollowing or DLL injection.
• Reflective code loading is used to execute the injected code directly from memory.

Persistence:

• Ursnif creates hidden files and directories to store its components and maintain persistence.
• The malware may modify registry keys or scheduled tasks to ensure its execution upon system startup.

Defense Evasion:

• Memory injection techniques are used to avoid detection by traditional security tools that focus on file-based analysis.
• Ursnif may employ anti-analysis techniques to hinder dynamic analysis and reverse engineering efforts.

Credential Access:

• Ursnif steals sensitive information such as login credentials, banking details, and personal data.
• Keylogging, form grabbing, and browser manipulation techniques may be employed.

Lateral Movement:

• Ursnif may spread to other systems within the network using various techniques such as exploiting vulnerabilities or leveraging stolen credentials.

Exfiltration:

• Stolen data is exfiltrated to a command-and-control server controlled by the attacker.

Impact:

• Financial loss
• Data breach
• Reputational damage

Hunting Strategy:

1. Analyze process logs: Look for suspicious process creations, parent-child relationships, and command-line arguments. Pay close attention to processes associated with web browsers, email clients, and system utilities.
2. Investigate memory activity: Analyze memory dumps and process memory for signs of injected code, reflective loading, or suspicious memory regions.
3. Correlate network traffic: Identify any communication with known Ursnif command-and-control servers or suspicious domains. Analyze network traffic for patterns associated with data exfiltration.
4. Examine file system activity: Search for hidden files and directories, especially in user profiles and system folders. Analyze file metadata and timestamps for anomalies.
5. Leverage threat intelligence: Utilize YARA rules, SIGMA rules, or other detection signatures to identify known Ursnif indicators of compromise.

False Positive Consideration:

• Legitimate applications may use process injection or code injection techniques for various purposes.
• False positives may arise from automated scripts, system updates, or software installations.

Recommendations:

• Implement robust email security controls to prevent phishing attacks.
• Deploy endpoint detection and response (EDR) solutions to monitor for malicious activity and provide real-time threat detection.
• Utilize memory analysis tools and techniques to detect memory-based threats.
• Regularly update security software and operating systems to patch vulnerabilities.
• Conduct security awareness training to educate users about phishing and other social engineering tactics.

Step-by-Step Guide to Emulate a Threat Hunt:

1. Prepare the Environment:
   • Set up a test environment with security monitoring tools (Sysmon, EDR) installed.
   • Enable relevant auditing policies for the operating system.
   • Configure a centralized log management system (SIEM).
2. Emulate the Attack Techniques:
   • Utilize a controlled environment to execute Ursnif samples or mimic its behavior using tools like Metasploit or Cobalt Strike.
   • Employ obfuscation and packing techniques to evade detection.
   • Simulate process injection and reflective code loading.
3. Emulate Post-Compromise Activities:
   • Create hidden files and directories.
   • Modify registry keys or scheduled tasks.
   • Simulate data exfiltration.
4. Collect and Analyze Logs:
   • Collect logs from the SIEM and endpoint agents.
   • Analyze process logs, memory forensics data, and network traffic logs.
5. Refine Detections:
   • Identify patterns and refine detection rules (YARA, SIGMA).
   • Document findings and improve future threat hunting efforts.

D3 Diagram: