Deep Instinct Analyzes Nimbus Manticore Malware’s Evasion and Lateral-Movement Capabilities
Summary
Deep Instinct’s analysis describes Nimbus Manticore as a 64-bit Windows malware sample with obfuscation, sandbox-evasion indicators, and potential RPC-based privilege escalation and lateral-movement capabilities.
Key points
- The article characterizes Nimbus Manticore as malware linked to an Iranian-backed group and designed to spread beyond an initially compromised endpoint.
- The analyzed 64-bit Windows executable has unusually high-entropy code and data sections, which the article says are consistent with obfuscation and encryption.
- Imports associated with dynamic library loading may help conceal functionality from static analysis.
- Timing-related strings may indicate sandbox detection, while a suspicious DLL is identified as a likely dynamically loaded malicious component.
- RPC-related functions, including RpcImpersonateClient, are cited as indicators of potential privilege escalation and lateral movement.
- Deep Instinct says it was the only VirusTotal vendor detecting and preventing the malware a week after the initial attack.
Article Details
- Attack Vectors
- Deep Instinct describes Nimbus Manticore as capable of lateral movement, privilege escalation, and persistence, but does not identify the initial access method.
- Import analysis found GetProcAddress, LoadLibraryA, and LoadLibraryExW, which Deep Instinct associates with import hiding and dynamic component loading.
- Strings for GetSystemTimeAsFileTime, QueryPerformanceCounter, and Sleep suggest a capability to detect analysis environments through execution timing.
- RPC-related strings, including RpcImpersonateClient, suggest potential client impersonation and RPC-based lateral movement; the article does not document a specific instance of either behavior.
- Defensive Notes
- Deep Instinct recommends visibility into both endpoint and network activity because endpoint-only detection may miss lateral movement.
- The article recommends detection that does not rely solely on static signatures or execution in automated sandboxes.
- Deep Instinct claims it was the only vendor on VirusTotal detecting Nimbus Manticore a week after the initial attack; the article provides no dates or detection counts.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDeep Instinct reports abnormal entropy in Nimbus Manticore's .text section consistent with encoded or compressed code, and high entropy in its .data section consistent with encryption.T1027.007 · Dynamic API ResolutionDeep Instinct associates the binary's GetProcAddress, LoadLibraryA, and LoadLibraryExW imports with hiding imports and loading components dynamically.T1497.003 · Time Based ChecksDeep Instinct says timing-related strings, including QueryPerformanceCounter and Sleep, indicate a capability to identify analysis environments by measuring execution timing.