Dyre
Associated Software Descriptions
Name | Description |
---|---|
Dyzap | |
Dyreza |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
Dyre registers itself as a service by adding several Registry keys.[1] |
Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Dyre has the ability to create files in a TEMP folder to act as a database to store information.[2] |
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
Dyre decrypts resources needed for targeting the victim.[1][2] |
|
Enterprise | T1041 | Exfiltration Over C2 Channel |
Dyre has the ability to send information staged on a compromised host externally to C2.[2] |
|
Enterprise | T1105 | Ingress Tool Transfer |
Dyre has a command to download and executes additional files.[1] |
|
Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
Dyre has been delivered with encrypted resources and must be unpacked for execution.[2] |
Enterprise | T1055 | Process Injection |
Dyre has the ability to directly inject its code into the web browser process.[2] |
|
.001 | Dynamic-link Library Injection | |||
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.[2] |
Enterprise | T1518 | Software Discovery |
Dyre has the ability to identify installed programs on a compromised host.[2] |
|
Enterprise | T1082 | System Information Discovery |
Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.[2] |
|
Enterprise | T1016 | System Network Configuration Discovery |
Dyre has the ability to identify network settings on a compromised host.[2] |
|
Enterprise | T1033 | System Owner/User Discovery |
Dyre has the ability to identify the users on a compromised host.[2] |
|
Enterprise | T1007 | System Service Discovery |
Dyre has the ability to identify running services on a compromised host.[2] |
|
Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.[1][2] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0102 | Wizard Spider |
References
- Symantec Security Response. (2015, June 23). Dyre: Emerging threat on financial fraud landscape. Retrieved August 23, 2018.
- hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.
- Ducklin, P. (2015, April 20). Notes from SophosLabs: Dyreza, the malware that discriminates against old computers. Retrieved June 16, 2020.
- Brewster, T. (2017, May 4). https://www.forbes.com/sites/thomasbrewster/2017/05/04/dyre-hackers-stealing-millions-from-american-coporates/#601c77842a0a. Retrieved June 15, 2020.
- Feeley, B. and Stone-Gross, B. (2019, March 20). New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration. Retrieved June 15, 2020.
- Umawing, J. (2019, September 3). TrickBot adds new trick to its arsenal: tampering with trusted texts. Retrieved June 15, 2020.