1. Home
  2. Software
  3. Waterbear

Waterbear

Waterbear is modular malware attributed to BlackTech that has been used primarily for lateral movement, decrypting, and triggering payloads and is capable of hiding network behaviors.[1]

ID: S0579
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 22 February 2021
Last Modified: 10 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1112 修改注册表

Waterbear has deleted certain values from the Registry to load a malicious DLL.[1]

Enterprise T1574 .002 劫持执行流: DLL Side-Loading

Waterbear has used DLL side loading to import and load a malicious DLL loader.[1]

Enterprise T1140 反混淆/解码文件或信息

Waterbear has the ability to decrypt its RC4 encrypted payload for execution.[1]
Enterprise T1562 .006 妨碍防御: Indicator Blocking

Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.[1]
Enterprise T1106 本机API

Waterbear can leverage API functions for execution.[1]
Enterprise T1012 查询注册表

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value OracleOcilib exists.[1]
Enterprise T1027 .005 混淆文件或信息: Indicator Removal from Tools

Waterbear can scramble functions not to be executed again with random values.[1]
.013 混淆文件或信息: Encrypted/Encoded File

Waterbear has used RC4 encrypted shellcode and encrypted functions.[1]
Enterprise T1049 系统网络连接发现

Waterbear can use API hooks on GetExtendedTcpTable to retrieve a table containing a list of TCP endpoints available to the application.[1]

Enterprise T1518 .001 软件发现: Security Software Discovery

Waterbear can find the presence of a specific security software.[1]
Enterprise T1105 输入工具传输

Waterbear can receive and load executables from remote C2 servers.[1]
Enterprise T1057 进程发现

Waterbear can identify the process for a specific security product.[1]
Enterprise T1055 进程注入

Waterbear can inject decrypted shellcode into the LanmanServer service.[1]
.003 Thread Execution Hijacking

Waterbear can use thread injection to inject shellcode into the process of security software.[1]

Groups That Use This Software

ID Name References
G0098 BlackTech

[1]

References

  1. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.