1. Home
  2. Software
  3. DnsSystem

DnsSystem

DnsSystem is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by HEXANE since at least June 2022.[1]

ID: S1021
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 24 June 2022
Last Modified: 01 September 2022
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

DnsSystem can upload files from infected machines after receiving a command with uploaddd in the string.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

DnsSystem can write itself to the Startup folder to gain persistence.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

DnsSystem can use cmd.exe for execution.[1]
Enterprise T1071 .004 应用层协议: DNS

DnsSystem can direct queries to custom DNS servers and return C2 commands using TXT records.[1]
Enterprise T1132 .001 数据编码: Standard Encoding

DnsSystem can Base64 encode data sent to C2.[1]
Enterprise T1204 .002 用户执行: Malicious File

DnsSystem has lured victims into opening macro-enabled Word documents for execution.[1]
Enterprise T1033 系统所有者/用户发现

DnsSystem can use the Windows user name to create a unique identification for infected users and systems.[1]
Enterprise T1105 输入工具传输

DnsSystem can download files to compromised systems after receiving a command with the string downloaddd.[1]
Enterprise T1041 通过C2信道渗出

DnsSystem can exfiltrate collected data to its C2 server.[1]

Groups That Use This Software

ID Name References
G1001 HEXANE

[1]

References

  1. Shivtarkar, N. and Kumar, A. (2022, June 9). Lyceum .NET DNS Backdoor. Retrieved June 23, 2022.