G0049: OilRig

OilRig has obtained stolen code signing certificates to digitally sign malware.[3]

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.CitationFireEye APT34 July 2019

OilRig has run hostname and systeminfo on a victim.[4][5]CitationFireEye APT34 July 2019[8][9]

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.[6]CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT35 2018CitationFireEye APT34 July 2019

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.CitationOilRig ISMAgent July 2017

OilRig has used HTTP for C2.[6]CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT34 July 2019

OilRig has used PowerShell to upload files from compromised systems.[10]

OilRig has modified Windows firewall rules to enable remote access.[9]

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.[1]CitationOilRig ISMAgent July 2017CitationUnit 42 OopsIE! Feb 2018[7]CitationUnit42 OilRig Nov 2018 OilRig has used batch scripts.[1]CitationOilRig ISMAgent July 2017CitationUnit 42 OopsIE! Feb 2018[7]CitationUnit42 OilRig Nov 2018

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.[6]CitationFireEye APT34 Webinar Dec 2017CitationCrowdstrike GTR2020 Mar 2020[9][9]

OilRig has used web shells, often to maintain access to a victim network.[6]CitationFireEye APT34 Webinar Dec 2017CitationCrowdstrike GTR2020 Mar 2020[10]

OilRig actively developed and used a series of downloaders during 2022.CitationESET OilRig Downloaders DEC 2023

OilRig has hosted malware on fake websites designed to target specific audiences.[3]

OilRig has used .doc file extensions to mask malicious executables.[8]

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.[10]

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.[4]

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.CitationFireEye APT34 Webinar Dec 2017

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.[4]

OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.CitationFireEye Outlook Dec 2019

OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.[4]

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.CitationFireEye APT34 Webinar Dec 2017

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.[9]

OilRig has used sc query on a victim to gather information about services.[4]

OilRig has registered a password filter DLL in order to drop malware.[10]

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.[1]CitationOilRig New Delivery Oct 2017[12][10]

OilRig has deleted files associated with their payload after execution.[1]CitationUnit 42 OopsIE! Feb 2018

OilRig has made use of the publicly available tools including Plink and Mimikatz.[9][10]

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.CitationUnit 42 OopsIE! Feb 2018[7][12][8][3]

OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.CitationFireEye APT34 Webinar Dec 2017

OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.[10]

OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.CitationFireEye Targeted Attacks Middle East Banks

OilRig has compromised email accounts to send phishing emails.[3]

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.[4]

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.[6]CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT35 2018CitationFireEye APT34 July 2019

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.[1]CitationOilRig New Delivery Oct 2017CitationUnit 42 OopsIE! Feb 2018CitationCrowdstrike GTR2020 Mar 2020

OilRig has signed its malware with stolen certificates.[3]

OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.[5][10]

OilRig has used brute force techniques to obtain credentials.CitationFireEye APT34 Webinar Dec 2017[11]

OilRig has used VBScript macros for execution on compromised hosts.[8]

OilRig has sent spearphising emails with malicious links to potential victims.CitationUnit 42 OopsIE! Feb 2018[3]

OilRig has used reg.exe to modify system configuration.[9][10]

OilRig has used tools to identify if a mouse is connected to a targeted system.[8]

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.[6]CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT34 July 2019[8]

OilRig had downloaded remote files onto victim infrastructure.[1][10]

OilRig has used netstat -an on a victim to get a listing of network connections.[4]

OilRig has used a compromised Domain Controller to create a service on a remote host.[9]

OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities.[10]

OilRig has delivered malicious links to achieve execution on the target system.CitationUnit 42 OopsIE! Feb 2018[7][12][3]

OilRig has used compromised credentials to access other systems on a victim network.[6]CitationFireEye APT34 Webinar Dec 2017CitationCrowdstrike GTR2020 Mar 2020[11]

OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.CitationFireEye APT34 Webinar Dec 2017

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.CitationUnit 42 OopsIE! Feb 2018[7][12][3]

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.CitationUnit 42 OopsIE! Feb 2018[7]CitationFireEye APT34 July 2019[8]

OilRig has used automated collection.[6]

OilRig has set up fake VPN portals, conference sign ups, and job application websites to target victims.[3]

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT34 July 2019[9]

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.[9]

OilRig has run whoami on a victim.[4][5][8]

OilRig has used LinkedIn to send spearphishing links.CitationFireEye APT34 July 2019

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.[6]CitationFireEye APT34 Webinar Dec 2017CitationFireEye APT34 July 2019[9]