Exploit / PoCcritical
Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-26855+3 related CVEs | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 group max | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | d.hwqloan.com | r four newly observed Lemon Duck domains: t[.]hwqloan[.]com d[.]hwqloan[.]com t[.]ouler[.]cc ps2[.]jusanrihua[.]com This spike, which |
| domain | hwqloan.com | hxxp[:]//d[.]hwqloan[.]com, a newly observed subdomain for hwqloan[.]com. This payload was a Python executable file and likely rel |
| domain | ps2.jusanrihua.com | domains: t[.]hwqloan[.]com d[.]hwqloan[.]com t[.]ouler[.]cc ps2[.]jusanrihua[.]com This spike, which occured on April 9, 2021, coincided w |
| domain | t.bb3u9.com | eported Lemon Duck domains, such as t[.]netcatkit[.]com and t[.]bb3u9[.]com. These files contain PowerShell instructions that are e |
| domain | t.hwqloan.com | ries being made for four newly observed Lemon Duck domains: t[.]hwqloan[.]com d[.]hwqloan[.]com t[.]ouler[.]cc ps2[.]jusanrihua[.]com |
| domain | t.netcatkit.com | ciated with previously reported Lemon Duck domains, such as t[.]netcatkit[.]com and t[.]bb3u9[.]com. These files contain PowerShell ins |
| domain | t.ouler.cc | ved Lemon Duck domains: t[.]hwqloan[.]com d[.]hwqloan[.]com t[.]ouler[.]cc ps2[.]jusanrihua[.]com This spike, which occured on Apr |
| sha256 | 6be5847c5b80be8858e1ff0ece401851886428b1f22444212250133d49b5ee30 | gathering, a base64-encoded Portable Executable (PE) file (6be5847c5b80be8858e1ff0ece401851886428b1f22444212250133d49b5ee30) was retrieved from the following URL: hxxp[:]//t[.]hwqloan |
| url | http://d.hwqloan.com | xecuted an additional malware payload, "syspstem.dat", from hxxp[:]//d[.]hwqloan[.]com, a newly observed subdomain for hwqloan[.]com. This p |
| url | http://ps2.jusanrihua.com/dns | hxxp[:]//t[.]hwqloan[.]com/dns hxxp[:]//t[.]ouler[.]cc/dns hxxp[:]//ps2[.]jusanrihua[.]com/dns Most notably, the URL hxxp[:]//ps2[.]jusanrihua[.]com |
| url | http://ps2.jusanrihua.com/ps | akes an HTTP GET request to download a remote resource from hxxp[:]//ps2[.]jusanrihua[.]com/ps, which, at the time of analysis, appeared to be down |
| url | http://t.hwqloan.com | which are retrieved from an attacker-controlled web server (hxxp[:]//t[.]hwqloan[.]com), and saved as "dn.ps1" and "c.ps1," respectively. Th |
| url | http://t.hwqloan.com/dns | execute content retrieved from each of the following URLs: hxxp[:]//t[.]hwqloan[.]com/dns hxxp[:]//t[.]ouler[.]cc/dns hxxp[:]//ps2[.]jusanrihua |
| url | http://t.hwqloan.com/t.txt | 44212250133d49b5ee30) was retrieved from the following URL: hxxp[:]//t[.]hwqloan[.]com/t.txt Once decoded, the PE executed multiple commands using |
| url | http://t.ouler.cc/dns | each of the following URLs: hxxp[:]//t[.]hwqloan[.]com/dns hxxp[:]//t[.]ouler[.]cc/dns hxxp[:]//ps2[.]jusanrihua[.]com/dns Most notably, the |
From the original article
12 min read at blog.talosintelligence.com
By Caitlin Huey and Andrew Windsor with contributions from Edmund Brumaghin . Lemon Duck continues to refine and improve upon their tactics, techniques and procedures as they attempt to maximize the effectiveness of their campaigns.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.