New Memory Malware

A memory based malware has been observed targeting banks and government organisations and is believed to be hard to detect. Countries including the UK have been as identified as targets.

Threat ID:: CC-1176
Category:
Threat Severity:: Medium
Threat Vector:
Published:: 16 February 2017 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A memory based malware has been observed targeting banks and government organisations and is believed to be hard to detect. Countries including the UK have been as identified as targets.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

All Windows versions

Threat details

The un-named malware resides entirely in memory, making forensic analysis very difficult. If the affected system is rebooted, all traces of the malware are lost and nothing is written to disk. The malware uses common penetration testing tools such as Metasploit and Mimikatz to perform various tasks but also uses some Microsoft utilities which make it hard for anti-virus vendors to defend against.

In the observed instance, the NETSH utility was used to communicate with Command and Control (C2) servers which resided on a number of domains using .GA, .ML, and .CF Top Level Domains (TLD). These TLDs are often free and rarely provide WHOIS information after domain expiration making them attractive to attackers.

Remediation steps

Type	Step
	Monitor for suspicious code or network activity coming from the Domain Controller. Never open attachments or links in emails received from untrusted sources. Monitor for Mimikatz activity, attributable to certain Dynamic Link Libraries (DLLs).

Last edited: 17 February 2020 11:36 am