1. Home
  2. Software
  3. Comnie

Comnie

Comnie is a remote backdoor which has been used in attacks in East Asia. [1]

ID: S0244
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 17 October 2018
Last Modified: 30 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1573 .001 加密通道: Symmetric Cryptography

Comnie encrypts command and control communications with RC4.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.[1]
.009 启动或登录自动启动执行: Shortcut Modification

Comnie establishes persistence via a .lnk file in the victim’s startup path.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Comnie executes BAT scripts.[1]
.005 命令与脚本解释器: Visual Basic

Comnie executes VBS scripts.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Comnie uses HTTP for C2 communication.[1]
Enterprise T1027 混淆文件或信息

Comnie uses RC4 and Base64 to obfuscate strings.[1]
.001 Binary Padding

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.[1]
Enterprise T1218 .011 系统二进制代理执行: Rundll32

Comnie uses Rundll32 to load a malicious DLL.[1]
Enterprise T1082 系统信息发现

Comnie collects the hostname of the victim machine.[1]
Enterprise T1007 系统服务发现

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.[1]
Enterprise T1049 系统网络连接发现

Comnie executes the netstat -ano command.[1]
Enterprise T1016 系统网络配置发现

Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.[1]
Enterprise T1102 .002 网络服务: Bidirectional Communication

Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.[1]
Enterprise T1119 自动化收集

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.[1]
Enterprise T1087 .001 账号发现: Local Account

Comnie uses the net user command.[1]
Enterprise T1518 .001 软件发现: Security Software Discovery

Comnie attempts to detect several anti-virus products.[1]
Enterprise T1057 进程发现

Comnie uses the tasklist to view running processes on the victim’s machine.[1]
Enterprise T1018 远程系统发现

Comnie runs the net view command

References

  1. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.