Hello and welcome to the Friday, November 10th, 2020, edition of the Sansonet Stormer's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Nice educational diary today from Xavier.

Xavier is talking about code injection techniques and, well, how to visualize some of

these and how they sort of manifest themselves on your window system. Code injection refers to

a normal good process being manipulated, part of the code in memory being overwritten with malicious

code while the software is suspended. And yes, this is something, as Xavier points out,

that's specifically supported by Microsoft APIs. So it's as a result relatively straightforward to do. Well, Xavier is looking at a

specific sample here and this was a phishing email with an executable, it was attached as a SIP file

that then took advantage of this technique to inject itself. Savier visualized what

happened here to the particular process, sound volume.exe, with prock dot. If you're not familiar with

dot, dot, it's actually sort of a language to describe graphs like this and then draw pictures. It can also be used for flow diagrams.

I've seen it also being used like for network diagrams. But in this case, it's used to kind of

illustrate what is happening to these processes where the actual malicious code is injected.

So if you are doing malvernalysis, if you're trying to better understand these techniques,

take a look at the full diary by Xavier.

And looks like the Klopp ransomer gang moved on from exploiting MoVit systems to now going after

CIS aid. CIS8 has published a blog post explaining that they just released a new

version of their on-premise product, fixing a new vulnerability CVE 2020-2347-246, and this vulnerability is apparently

currently being exploited by the Klopp ransomware gang. CIS 8 makes offers for help desks and

issue management. If you are running CIS 8, make sure that you are running version 23.3.3.36.

As part of its blog, CIS8 also reveals a number of details about the compromise that they observed,

...