{"id":2281,"date":"2024-09-25T14:43:13","date_gmt":"2024-09-25T14:43:13","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2281"},"modified":"2025-07-29T03:32:49","modified_gmt":"2025-07-29T03:32:49","slug":"promethium-strongpity-apt-c-41-an-element-no-match-for-lmntrix","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/promethium-strongpity-apt-c-41-an-element-no-match-for-lmntrix\/","title":{"rendered":"PROMETHIUM (StrongPity\/APT C-41) an element no match for LMNTRIX"},"content":{"rendered":"
\n
\"PROMETHIUM
PROMETHIUM an element no match for LMNTRIX<\/figcaption><\/figure>\n<\/div>\n\n\n

In this research, we have primarily focused on the Turkish APT group APT-C-41 (aka StrongPity and Promethium). The modus operandi of this group has been to install a backdoor on its victims machine to perform Cyber espionage operations. The main targets of this APT group have been Financial organisations, Industrial plants and Educational institutes. LMNTRIX<\/a> threat research team brings together some of the payloads used by APT-C-41 (aka StrongPity and Promethium) in different campaigns across Europe in last quarter of the year 2020 by this threat actor group.<\/p>\n\n\n\n

Payload details:<\/strong><\/p>\n\n\n\n

Payload Hash<\/strong><\/td>Command & Control Domains<\/strong><\/td><\/tr>
d7aae4694291a7811c18ccc0af9d4b53<\/td>mentiononecommon[.]com<\/td><\/tr>
06752c080a5c00baf971243be65a49b8<\/td>ms21-app3-upload[.]com<\/td><\/tr>
52a895199380705c514dd0a23ba52414<\/td>mailtransfersagents[.]com<\/td><\/tr>
c930f328b5b3894feced92d04908b256<\/td>applicationrepo[.]com<\/td><\/tr>
469c0460e4c1fefd01db4ae9f79c53c7<\/td>uppertrainingtool[.]com<\/td><\/tr>
d7c62bc2a06d5abd872152ec87c64c8b   07ee8219801ec09951b8609142639480 c009b0bcf1c02503fff0d0e511188b68 a57e5f2011d04117c28982a68db28e23 ff9b1e2d7ad8b022f3fd3d9395382cf5<\/td>hostoperationsystems[.]com<\/td><\/tr>
989af6e0bb7fa4d62815f4fdc4696b85<\/td>Protectapplication[.]com<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Sample Analysis<\/strong><\/p>\n\n\n\n

LMNTRIX Threat research team performed a binary analysis of one of the collected to understand different functions used by APT-C-41 (aka StrongPity and Promethium) in their payload.<\/p>\n\n\n\n

Hash (MD5): 52a895199380705c514dd0a23ba52414<\/p>\n\n\n\n

File size: 117 KB<\/p>\n\n\n\n

The collected specimen is an exe file (32 bit) and while checking the entry point, we confirmed that the file was compiled using VC++.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

The above disassembled code is the entry point (call function followed by Jmp instruction) known for VC++ compiled file. We confirmed the compiler detail again with the help of other static analysis tool.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We further dissected the sample in the controlled environment to study the tactic used by the malware. We see the techniques like the discovery of file and directories, defence evasion mechanisms like VM aware, file obfuscation found in the sample. The sample has an anti-debugging function as:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Further, we found the function to detect the presence of the virtual environment (VM aware functionality), it executes the anti-VM instructions.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After bypassing these functions, we found the command and control domain embedded into the code. The snapshot shows the communication happens to the malicious domain which we highlighted below [mailtransfersagents(dot)com]:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
\"\"<\/figure>\n\n\n\n


This communication was initialized by using WINHTTP libraries to add the header requests, WinHttpSetOption, WinHttpSendRequest-WriteData and finally performed the receive response.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

The functions highlighted above in the disassembled code was used for data exfiltration. The below code further shows the ping command and directory remove command used by the malware sample as well.
This clearly states that the sample has the functionality of deleting the directory trees in the victim machine and perform it in quiet mode. These actions are done with the help of command \u201crmdir\u201d and parameters (\/q and \/s). This deletion with quiet mode didn\u2019t ask for any confirmation to the user.<\/p>\n\n\n\n

MITRE ATTACK ID Mapping<\/strong><\/p>\n\n\n\n

Techniques ID<\/td>Name<\/td><\/tr>
T1547<\/td>Boot or Logon Autostart Execution: Registry Run Keys \/ Startup Folder<\/td><\/tr>
T1543<\/td>Create or Modify System Process: Windows Service<\/td><\/tr>
T1578<\/td>Develop Capabilities: Digital Certificates, Code Signing Certificates<\/td><\/tr>
T1189<\/td>Drive-by Compromise<\/td><\/tr>
T1036<\/td>Masquerading: Match Legitimate Name or Location, task or service<\/td><\/tr>
T1553<\/td>Subvert Trust controls; Code Signing<\/td><\/tr>
T1205<\/td>Traffic Signaling: Port Knocking<\/td><\/tr>
T1204<\/td>User Execution: Malicious File<\/td><\/tr>
T1078<\/td>Valid Accounts: Local Accounts<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Mitigations:<\/strong><\/p>\n\n\n\n

The following is the Yara Detection Rule for APT-C-41 :<\/p>\n\n\n\n

rule win_strongpity_auto {<\/p>\n\n\n\n

meta:<\/p>\n\n\n\n

date = “2020-12-22”<\/p>\n\n\n\n

version = “1”<\/p>\n\n\n\n

tool = “yara-signator v0.6.0”<\/p>\n\n\n\n

signator_config = “callsandjumps;datarefs;binvalue”<\/p>\n\n\n\n

malpedia_rule_date = “20201222”<\/p>\n\n\n\n

malpedia_hash = “52a895199380705c514dd0a23ba52414”<\/p>\n\n\n\n

malpedia_version = “20201023”<\/p>\n\n\n\n

malpedia_license = “CC BY-SA 4.0”<\/p>\n\n\n\n

malpedia_sharing = “TLP:WHITE”<\/p>\n\n\n\n

strings:<\/p>\n\n\n\n

$sequence_0 = { 56 8b7508 f7d1 85f6 }<\/p>\n\n\n\n

\/\/ n = 4, score = 500<\/p>\n\n\n\n

\/\/   56                   | push                esi<\/p>\n\n\n\n

\/\/   8b7508               | mov                 esi, dword ptr [ebp + 8]\n\n\n\n

\/\/   f7d1                 | not                 ecx<\/p>\n\n\n\n

\/\/   85f6                 | test                esi, esi<\/p>\n\n\n\n

$sequence_1 = { a1???????? 33c4 89442450 8b03 55 8ba828010000 8b4d00 }<\/p>\n\n\n\n

\/\/ n = 7, score = 300<\/p>\n\n\n\n

\/\/   a1????????           |<\/p>\n\n\n\n

\/\/   33c4                 | xor                 eax, esp<\/p>\n\n\n\n

\/\/   89442450             | mov                 dword ptr [esp + 0x50], eax<\/p>\n\n\n\n

\/\/   8b03                 | mov                 eax, dword ptr [ebx]\n\n\n\n

\/\/   55                   | push                ebp<\/p>\n\n\n\n

\/\/   8ba828010000         | mov                 ebp, dword ptr [eax + 0x128]\n\n\n\n

\/\/   8b4d00               | mov                 ecx, dword ptr [ebp]\n\n\n\n

$sequence_2 = { e8???????? 8bd8 83c408 85db 0f85f5020000 8b442420 }<\/p>\n\n\n\n

\/\/ n = 6, score = 300<\/p>\n\n\n\n

\/\/   e8????????           |<\/p>\n\n\n\n

\/\/   8bd8                 | mov                 ebx, eax<\/p>\n\n\n\n

\/\/   83c408               | add                 esp, 8<\/p>\n\n\n\n

\/\/   85db                 | test                ebx, ebx<\/p>\n\n\n\n

\/\/   0f85f5020000         | jne                 0x2fb<\/p>\n\n\n\n

\/\/   8b442420             | mov                 eax, dword ptr [esp + 0x20]\n\n\n\n

$sequence_3 = { 52 ff15???????? 83c404 837c241000 750a 837d0400 0f852e020000 }<\/p>\n\n\n\n

\/\/ n = 7, score = 300<\/p>\n\n\n\n

\/\/   52                   | push                edx<\/p>\n\n\n\n

\/\/   ff15????????         |<\/p>\n\n\n\n

\/\/   83c404               | add                 esp, 4<\/p>\n\n\n\n

\/\/   837c241000           | cmp                 dword ptr [esp + 0x10], 0<\/p>\n\n\n\n

\/\/   750a                 | jne                 0xc<\/p>\n\n\n\n

\/\/   837d0400             | cmp                 dword ptr [ebp + 4], 0<\/p>\n\n\n\n

\/\/   0f852e020000         | jne                 0x234<\/p>\n\n\n\n

$sequence_4 = { 83c408 83f8ff 0f845d050000 ff442410 85f6 7fe0 }<\/p>\n\n\n\n

\/\/ n = 6, score = 300<\/p>\n\n\n\n

\/\/   83c408               | add                 esp, 8<\/p>\n\n\n\n

\/\/   83f8ff               | cmp                 eax, -1<\/p>\n\n\n\n

\/\/   0f845d050000         | je                  0x563<\/p>\n\n\n\n

\/\/   ff442410             | inc                 dword ptr [esp + 0x10]\n\n\n\n

\/\/   85f6                 | test                esi, esi<\/p>\n\n\n\n

\/\/   7fe0                 | jg                  0xffffffe2<\/p>\n\n\n\n

$sequence_5 = { 57 50 8944246c 89442450 }<\/p>\n\n\n\n

\/\/ n = 4, score = 300<\/p>\n\n\n\n

\/\/   57                   | push                edi<\/p>\n\n\n\n

\/\/   50                   | push                eax<\/p>\n\n\n\n

\/\/   8944246c             | mov                 dword ptr [esp + 0x6c], eax<\/p>\n\n\n\n

\/\/   89442450             | mov                 dword ptr [esp + 0x50], eax<\/p>\n\n\n\n

$sequence_6 = { 397704 0f8493000000 eb6b 8b54241c 6a04 }<\/p>\n\n\n\n

\/\/ n = 5, score = 300<\/p>\n\n\n\n

\/\/   397704               | cmp                 dword ptr [edi + 4], esi<\/p>\n\n\n\n

\/\/   0f8493000000         | je                  0x99<\/p>\n\n\n\n

\/\/   eb6b                 | jmp                 0x6d<\/p>\n\n\n\n

\/\/   8b54241c             | mov                 edx, dword ptr [esp + 0x1c]\n\n\n\n

\/\/   6a04                 | push                4<\/p>\n\n\n\n

$sequence_7 = { c3 837c240800 56 57 8b7c240c 8db710050000 7534 }<\/p>\n\n\n\n

\/\/ n = 7, score = 300<\/p>\n\n\n\n

\/\/   c3                   | ret<\/p>\n\n\n\n

\/\/   837c240800           | cmp                 dword ptr [esp + 8], 0<\/p>\n\n\n\n

\/\/   56                   | push                esi<\/p>\n\n\n\n

\/\/   57                   | push                edi<\/p>\n\n\n\n

\/\/   8b7c240c             | mov                 edi, dword ptr [esp + 0xc]\n\n\n\n

\/\/   8db710050000         | lea                 esi, [edi + 0x510]\n\n\n\n

\/\/   7534                 | jne                 0x36<\/p>\n\n\n\n

$sequence_8 = { 68???????? 50 e8???????? 83c40c 8d85e0fdffff ffb574f7ffff }<\/p>\n\n\n\n

\/\/ n = 6, score = 200<\/p>\n\n\n\n

\/\/   68????????           |<\/p>\n\n\n\n

\/\/   50                   | push                eax<\/p>\n\n\n\n

\/\/   e8????????           |<\/p>\n\n\n\n

\/\/   83c40c               | add                 esp, 0xc<\/p>\n\n\n\n

\/\/   8d85e0fdffff         | lea                 eax, [ebp – 0x220]\n\n\n\n

\/\/   ffb574f7ffff         | push                dword ptr [ebp – 0x88c]\n\n\n\n

$sequence_9 = { 899570f7ffff 3b5708 0f82c3feffff e9???????? }<\/p>\n\n\n\n

\/\/ n = 4, score = 200<\/p>\n\n\n\n

\/\/   899570f7ffff         | mov                 dword ptr [ebp – 0x890], edx<\/p>\n\n\n\n

\/\/   3b5708               | cmp                 edx, dword ptr [edi + 8]\n\n\n\n

\/\/   0f82c3feffff         | jb                  0xfffffec9<\/p>\n\n\n\n

\/\/   e9????????           |<\/p>\n\n\n\n

$sequence_10 = { 6a5c 668945f2 58 56 }<\/p>\n\n\n\n

\/\/ n = 4, score = 200<\/p>\n\n\n\n

\/\/   6a5c                 | push                0x5c<\/p>\n\n\n\n

\/\/   668945f2             | mov                 word ptr [ebp – 0xe], ax<\/p>\n\n\n\n

\/\/   58                   | pop                 eax<\/p>\n\n\n\n

\/\/   56                   | push                esi<\/p>\n\n\n\n

$sequence_11 = { 83ee01 75f8 e8???????? c3 8b770c 8d4710 8bd6 }<\/p>\n\n\n\n

\/\/ n = 7, score = 200<\/p>\n\n\n\n

\/\/   83ee01               | sub                 esi, 1<\/p>\n\n\n\n

\/\/   75f8                 | jne                 0xfffffffa<\/p>\n\n\n\n

\/\/   e8????????           |<\/p>\n\n\n\n

\/\/   c3                   | ret<\/p>\n\n\n\n

\/\/   8b770c               | mov                 esi, dword ptr [edi + 0xc]\n\n\n\n

\/\/   8d4710               | lea                 eax, [edi + 0x10]\n\n\n\n

\/\/   8bd6                 | mov                 edx, esi<\/p>\n\n\n\n

$sequence_12 = { e8???????? 83c410 ebe6 8b45e4 8b0c85a8bf4100 8b45e8 f644012880 }<\/p>\n\n\n\n

\/\/ n = 7, score = 200<\/p>\n\n\n\n

\/\/   e8????????           |<\/p>\n\n\n\n

\/\/   83c410               | add                 esp, 0x10<\/p>\n\n\n\n

\/\/   ebe6                 | jmp                 0xffffffe8<\/p>\n\n\n\n

\/\/   8b45e4               | mov                 eax, dword ptr [ebp – 0x1c]\n\n\n\n

\/\/   8b0c85a8bf4100       | mov                 ecx, dword ptr [eax*4 + 0x41bfa8]\n\n\n\n

\/\/   8b45e8               | mov                 eax, dword ptr [ebp – 0x18]\n\n\n\n

\/\/   f644012880           | test                byte ptr [ecx + eax + 0x28], 0x80<\/p>\n\n\n\n

$sequence_13 = { c746345c4b4100 57 ff7634 c6463c01 e8???????? 59 59 }<\/p>\n\n\n\n

\/\/ n = 7, score = 200<\/p>\n\n\n\n

\/\/   c746345c4b4100       | mov                 dword ptr [esi + 0x34], 0x414b5c<\/p>\n\n\n\n

\/\/   57                   | push                edi<\/p>\n\n\n\n

\/\/   ff7634               | push                dword ptr [esi + 0x34]\n\n\n\n

\/\/   c6463c01             | mov                 byte ptr [esi + 0x3c], 1<\/p>\n\n\n\n

\/\/   e8????????           |<\/p>\n\n\n\n

\/\/   59                   | pop                 ecx<\/p>\n\n\n\n

\/\/   59                   | pop                 ecx<\/p>\n\n\n\n

$sequence_14 = { 6a2f 59 668908 33c9 8b4608 66890c78 668b45d8 }<\/p>\n\n\n\n

\/\/ n = 7, score = 200<\/p>\n\n\n\n

\/\/   6a2f                 | push                0x2f<\/p>\n\n\n\n

\/\/   59                   | pop                 ecx<\/p>\n\n\n\n

\/\/   668908               | mov                 word ptr [eax], cx<\/p>\n\n\n\n

\/\/   33c9                 | xor                 ecx, ecx<\/p>\n\n\n\n

\/\/   8b4608               | mov                 eax, dword ptr [esi + 8]\n\n\n\n

\/\/   66890c78             | mov                 word ptr [eax + edi*2], cx<\/p>\n\n\n\n

\/\/   668b45d8             | mov                 ax, word ptr [ebp – 0x28]\n\n\n\n

condition:<\/p>\n\n\n\n

7 of them and filesize &lt; 999424<\/p>\n\n\n\n

}<\/p>\n","protected":false},"excerpt":{"rendered":"

In this research, we have primarily focused on the Turkish APT group APT-C-41 (aka StrongPity and Promethium). The modus operandi of this group has been to install a backdoor on its victims machine to perform Cyber espionage operations. The main targets of this APT group have been Financial organisations, Industrial plants and Educational institutes. LMNTRIX […]<\/p>\n","protected":false},"author":1,"featured_media":2282,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2281"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2281\/revisions"}],"predecessor-version":[{"id":4227,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2281\/revisions\/4227"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2282"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}