Combine cutting-edge XDR technology, multi-signal threat intelligence and 24/7 Elite Threat Hunters to help you build a world-class security operation.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Cyber risk and advisory programs that identify security gaps and build security strategies to address them.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
XDR with machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Seamless integration and threat investigation across your existing tech stack.
Defend brute force attacks, active intrusions and unauthorized scans.
Guard endpoints by isolating and remediating threats to prevent lateral spread.
Investigation and threat detection across multi-cloud or hybrid environments.
Remediate misconfigurations, vulnerabilities and policy violations.
Investigate and respond to compromised identities and insider threats.
Stop ransomware before it spreads.
Meet regulatory compliance mandates.
Detect and respond to zero-day exploits.
End misconfigurations and policy violations.
Defend third-party and supply chain risk.
Prevent disruption by outsourcing MDR.
Adopt a risk-based security approach.
Meet insurability requirements with MDR.
Protect your most sensitive data.
Build a proven security program.
Operationalize timely, accurate, and actionable cyber threat intelligence.
THE THREAT Beginning in early September 2024, eSentire observed an increase in the number of incidents involving Lumma Stealer malware; this activity has remained common leading into…
Oct 02, 2024THE THREATA recently disclosed vulnerability impacting Zimbra mail servers is being actively exploited by attacker(s). On September 27th, Zimbra publicly disclosed CVE-2024-45519, a…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Multi-Signal MDR with 300+ technology integrations to support your existing investments.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Three MDR package tiers are available based on per-user pricing and level of risk tolerance.
The latest security advisories, blogs, reports, industry publications and webinars published by TRU.
Compare eSentire to other Managed Detection and Response vendors to see how we stack up against the competition.
See why 2000+ organizations globally have chosen eSentire for their MDR Solution.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
In May 2024, eSentire's Threat Response Unit (TRU) identified and traced activity related to a more_eggs malware campaign targeting a customer in the industrial services industry. However, eSentire MDR for Endpoint blocked the activity after the user attempted to open the resume-themed loader.
Specifically, the targeted individual was a recruiter that was deceived by the threat actor into thinking they were a job applicant and lured them to their website to download the loader. eSentire observed similar tactics with more_eggs back in early 2022.
More_eggs is a malicious software containing several components engineered to steal valuable credentials, including usernames and passwords for corporate bank accounts, email accounts, and IT administrator accounts and is sold on the Dark Web as a Malware-as-a-Service (MaaS).
The Golden Chickens group (aka Venom Spider) is believed to be the threat operators behind more_eggs, and the malware is known to be utilized by the very capable FIN6, Evilnum, and Cobalt cybercriminals.
The delivery of the malware took place from the response to a LinkedIn job listing, where the attacker posed as a potential candidate, providing a link to the fake resume download site. When navigating to the site, the victim was met with a ‘Download CV’ button (Figure 1), which resulted in the download of a malicious Windows Shortcut File (LNK).
This delivery method has been observed by eSentire in previous more_eggs malware campaigns, where attackers have disguised themselves in both roles, as the recruiter and as the potential candidate.
The threat actors behind these campaigns target organizations and individuals by leveraging periods of time where hiring is typically at an increase.
Navigating to the same URL days later results in the individuals resume in plain HTML, with no indication of a redirect or download (Figure 2).
Once the victim downloads and opens the .LNK file, in this case “Christian C. Velour.LNK”, the shortcut points to the executable “cmd.exe” followed by a long-obfuscated command. The command uses a lot of string substitutions to make analysis more difficult.
However, once de-obfuscated (Figure 2), the intent of the malicious .LNK file becomes clearer. When opened, the malicious command line generates a series of strings which are added to a new .INF file: “ieuinit.inf”. An INF file is a plain text configuration file used by the Windows operating system to install, uninstall, or configure device drivers, software components, or system settings.
In this case, the Loader uses the configuration as a reference point for the Malicious DLL download URL.
From there, the malicious command line creates a copy of the legitimate Microsoft “ie4unit.exe” executable in the user’s appdata\microsoft directory, which is the same directory the loader saved the malicious .INF file.
The “ie4unit.exe” file is a legitimate Microsoft Windows executable that is responsible for initializing certain settings and components related to Internet Explorer.
Here, it is used to execute commands from the specially prepared “ie4uinit.inf” file and to download the malicious DLL from a8advbiejf[.]christianvelour[.]com.
As seen in Figure 3, Windows’ WMI is invoked to run the hijacked copy of “ie4unit.exe”, which then drops the malicious DLL file named “55609.dll”.
This DLL is then registered into the user’s registry and executed using “regsvr32.exe” to establish persistence, gather data about the infected host, and to drop additional payloads.
Upon inspection of the “55609.dll”, the DLL is highly obfuscated and contains multiple anti-debug and anti-sandbox checks. The DLL’s payload is encrypted and so a key is generated in an iterative fashion for the payload to get decrypted during execution.
Specifically, there is a loop which contains a string with the keyword “SqadTO” followed by a numerical number which starts at 0 and then increases by one until a match is found with a hardcoded hash (Figure 4). This process delays the execution of the payload until a match is generated.
As per the Security Brief from Proofpoint UK, the malware uses the RC4 algorithm to decrypt the strings.An example of the decryption can be seen in Figure 5 and 6.
Within the decrypted DLL, the malware sets up persistence on the host’s registry (Figure 7) and is responsible for dropping the “msxsl.exe” binary along with 2 other txt files which contain JavaScript code. These files are dropped in the %appdata%/Roaming/Microsoft folder.
The first text file “7E9CB3FBF4FD0B07.txt” (Figure 8), contains obfuscated JavaScript code that is responsible for launching the second text file “1A4D05F30007.txt” using msxsl.exe.
Within “1A4D05F30007.txt” there is a fair amount of JavaScript code with various functions (Figure 9), but in summary the code appears to setup a command and control (C2) client which reaches out to hxxps[://]dcc[.]olcrv[.]com/login/tologin, and sends details from the host’s system such as OS version, local IP, antivirus software installed.
The code also has the capability ability to check whether the malicious script has system privileges, a function called “eTask” that can execute tasks received from the C2 server, and the ability to further download and execute files via the “dExec” function, which are all similar functions previously observed in more_eggs campaigns.
You can access the Indicators of Compromise here.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.