Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore and PhantomGraph

Domains/URLs

penzadogshelter.site

trendy-market.site

bright-deals.site

nova-stream.site

rinomobile.ink

urbanpixel.store

flexish.shop

media-hub.today

cosmetic-deals.store

vks.gossopka.forum

IP Address

81.177.32.12

194.87.239.71

194.87.93.153

38.244.205.244

31.59.102.61

Hash

4d27b4eb1c5dbb3d8160f29b8119523e

748c9f8cb1065000616204935f96207f

c5a460e4e68a088f6e51b2c6474642ec

129462164a7d52e9ea8560b60f0412c5

ec0bf4a2186a88874e9f26f07cfeb532

b348642146ea34771e5785c5857950f5

c915cb6c2aeb863ee8479238e1644217

0e79996d9483d1e44fea32b0a48c2c19

2bb75c20e778eb5c416965bd4d4259b1

b3a6fee3307f1c26841fd5c603e2b013

8fcc3e4ccbf1725d9989fb464abf3561

489f43be558b2679284ceabed7adc4f3

dd1fd2b459b97b7d59375cb8383cd19a

0e4541c3153ec5ed01497f19cf4f63d0

12d4e8f5295f2ef7e0f9bfc0f4830939

7f267006cac10f341c356b62fe493527

ee2861d5965e8730708cd1da8a93fa4c

c3a2abe8756910f42582b04a44ea3514

43f435c3c437bc879a2d7d4634f43494

aee9642b45b099cb7f3053b9b680b425

0ed9306deabddaa587ad75d0775f7e63b27857a13adcc870dc9f8c92a9ddc6da

e66bbb6c651b5ab839434b8e62f502169f35894e28dbe9f3275911582eccd250

b9e4052b310f9451eca9784a4a33bf5282d1bd07e3359eba9648be625e2e40dd

72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336

ceea2f175eaa02919e8b5161c2ecf585de3e8b6d586bca8046eee2e3f4efa386

0fce4b732ce10c72093587e82ca9747a885430e366934ddc27e437443ff0cc0e

File Path

C:\Windows\System32\inetsrv\SysExcSvc.dll

C:\Windows\System32\inetsrv\SysReadSvc.dll

C:\Windows\System32\inetsrv\graphi-refresh.dat

C:\Windows\System32\inetsrv\share\input_*.txt

C:\Windows\System32\inetsrv\share\output_*.txt

%TEMP%\cmd_cmd_*.bat

%LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll

/etc/systemd/system/omicluster.service

/etc/systemd/system/schedul2-bin.service

/opt/acronis/bin/schedul2-bin

/omi/bin/omicluster

/usr/lib64/libzvbi-tchain.so.2

/var/tmp/cx2

Registry keys

HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32

Windows service names

SysExcSvc

SysReadSvc

Detection Query 1 :

domainname like "vks.gossopka.forum" or url like "vks.gossopka.forum" or siteurl like "vks.gossopka.forum" or domainname like "flexish.shop" or url like "flexish.shop" or siteurl like "flexish.shop" or domainname like "cosmetic-deals.store" or url like "cosmetic-deals.store" or siteurl like "cosmetic-deals.store" or domainname like "penzadogshelter.site" or url like "penzadogshelter.site" or siteurl like "penzadogshelter.site" or domainname like "nova-stream.site" or url like "nova-stream.site" or siteurl like "nova-stream.site" or domainname like "media-hub.today" or url like "media-hub.today" or siteurl like "media-hub.today" or domainname like "trendy-market.site" or url like "trendy-market.site" or siteurl like "trendy-market.site" or domainname like "urbanpixel.store" or url like "urbanpixel.store" or siteurl like "urbanpixel.store" or domainname like "bright-deals.site" or url like "bright-deals.site" or siteurl like "bright-deals.site" or domainname like "rinomobile.ink" or url like "rinomobile.ink" or siteurl like "rinomobile.ink"

Detection Query 2 :

dstipaddress IN ("31.59.102.61","38.244.205.244","194.87.239.71","194.87.93.153","81.177.32.12") or srcipaddress IN ("31.59.102.61","38.244.205.244","194.87.239.71","194.87.93.153","81.177.32.12")

Detection Query 3 :

md5hash IN ("c5a460e4e68a088f6e51b2c6474642ec","748c9f8cb1065000616204935f96207f","8fcc3e4ccbf1725d9989fb464abf3561","4d27b4eb1c5dbb3d8160f29b8119523e","7f267006cac10f341c356b62fe493527","129462164a7d52e9ea8560b60f0412c5","ec0bf4a2186a88874e9f26f07cfeb532","b348642146ea34771e5785c5857950f5","c915cb6c2aeb863ee8479238e1644217","0e79996d9483d1e44fea32b0a48c2c19","2bb75c20e778eb5c416965bd4d4259b1","b3a6fee3307f1c26841fd5c603e2b013","489f43be558b2679284ceabed7adc4f3","dd1fd2b459b97b7d59375cb8383cd19a","0e4541c3153ec5ed01497f19cf4f63d0","12d4e8f5295f2ef7e0f9bfc0f4830939","ee2861d5965e8730708cd1da8a93fa4c","c3a2abe8756910f42582b04a44ea3514","43f435c3c437bc879a2d7d4634f43494","aee9642b45b099cb7f3053b9b680b425")

Detection Query 4 :

sha256hash IN ("0ed9306deabddaa587ad75d0775f7e63b27857a13adcc870dc9f8c92a9ddc6da","e66bbb6c651b5ab839434b8e62f502169f35894e28dbe9f3275911582eccd250","b9e4052b310f9451eca9784a4a33bf5282d1bd07e3359eba9648be625e2e40dd","72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336","ceea2f175eaa02919e8b5161c2ecf585de3e8b6d586bca8046eee2e3f4efa386","0fce4b732ce10c72093587e82ca9747a885430e366934ddc27e437443ff0cc0e")

Detection Query 5 :

resourcename = "Windows Security" and eventtype = "4697" and destinationservicename IN ("SysExcSvc","SysReadSvc")

Detection Query 6 :

technologygroup = "EDR" and destinationservicename IN ("SysExcSvc","SysReadSvc")

Detection Query 7 :

resourcename = "Windows Security" and eventtype = "4663" and (objectname like "C:\Windows\System32\inetsrv\SysExcSvc.dll" or objectname like "C:\Windows\System32\inetsrv\SysReadSvc.dll" or objectname like "C:\Windows\System32\inetsrv\graphi-refresh.dat" or objectname like "C:\Windows\System32\inetsrv\share\input_*.txt" or objectname like "C:\Windows\System32\inetsrv\share\output_*.txt" or objectname like "%TEMP%\cmd_cmd_*.bat

%LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll" or objectname like "/etc/systemd/system/omicluster.service" or objectname like "/etc/systemd/system/schedul2-bin.service" or objectname like "/opt/acronis/bin/schedul2-bin" or objectname like "/omi/bin/omicluster" or objectname like "/usr/lib64/libzvbi-tchain.so.2","/var/tmp/cx2")

Detection Query 8 :

technologygroup = "EDR" and (objectname like "C:\Windows\System32\inetsrv\SysExcSvc.dll" or objectname like "C:\Windows\System32\inetsrv\SysReadSvc.dll" or objectname like "C:\Windows\System32\inetsrv\graphi-refresh.dat" or objectname like "C:\Windows\System32\inetsrv\share\input_*.txt" or objectname like "C:\Windows\System32\inetsrv\share\output_*.txt" or objectname like "%TEMP%\cmd_cmd_*.bat

%LOCALAPPDATA%\TrueConf\Client\api-ms-win-crt-time-l1-1-0-2.dll" or objectname like "/etc/systemd/system/omicluster.service" or objectname like "/etc/systemd/system/schedul2-bin.service" or objectname like "/opt/acronis/bin/schedul2-bin" or objectname like "/omi/bin/omicluster" or objectname like "/usr/lib64/libzvbi-tchain.so.2","/var/tmp/cx2")

Detection Query 9 :

resourcename = "Windows Security" and eventtype = "4657" and objectname like "HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32"

Detection Query 10 :

technologygroup = "EDR" and objectname like "HKEY_CURRENT_USER\Software\Classes\CLSID\{0340F119-A598-4ed9-B0AC-6F6A12D3E755}\InprocServer32"