Huntress Details Threat Actor’s Use of Dokan and PowerShell to Collect and Exfiltrate Data
Summary
Huntress analysts reconstructed an intrusion involving brief TeamViewer access, curl downloads, Dokan driver use, PowerShell data collection, and data exfiltration. They could not determine whether the actor dumped credentials.
Key points
- Huntress observed an unusual, 18-second TeamViewer connection about 11 hours before its agent was installed; the entry showed an unknown account and aligned with a login using a known administrator account.
- Three days after installation, curl downloaded Dokan and MemProcFS from 193.149.176.90; the Dokan driver was installed and used to create a mount point.
- A PowerShell script archived a minidump file from the mounted volume, but analysts could not identify the process associated with the dump or confirm credential dumping.
- The actor later logged in through RDP using a second account that Huntress described as compromised, then removed the Dokan driver.
- A subsequent PowerShell script collected files and browser data; curl then uploaded an archive to the same IP address.
- Huntress said the actor used mostly native tools, GUI-based utilities, and pre-known system names, and could not determine how the actor obtained valid account credentials.
Article Details
- Attack Vectors
- A brief, unusual TeamViewer remote-control connection using an unknown account was associated with later malicious activity.
- The threat actor used a compromised account to log in through Terminal Services/RDP.
- The actor used curl.exe to download Dokan and MemProcFS archives from 193.149.176.90.
- A PowerShell script archived a process minidump; another script collected files and browser data.
- The actor used curl.exe to upload out.zip to 193.149.176.90.
- The actor pinged several specifically named endpoints in the environment.
- Defensive Notes
- Review TeamViewer connection records for short-lived sessions and entries with unknown account names.
- Retain and review Windows Event Log records for Dokan driver installation, mount-point creation, and removal; the article notes these events persisted after the driver was removed.
- Investigate suspicious curl.exe downloads and uploads, PowerShell archive creation, and unexpected Dokan or MemProcFS use.
- Review Terminal Services/RDP logons for use of compromised accounts and correlate them with endpoint activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]149[.]176[.]90 | Host used to serve Dokan_x64.msi.zip and MemProcFS.zip and receive the exfiltrated out.zip archive. |
MITRE ATT&CK
T1003.001 · LSASS MemoryPossible credential dumping: a process minidump was archived, but analysts could not determine which process was dumped.T1005 · Data from Local SystemThe bk11.ps1 script collected files and browser settings and history from the endpoint.T1018 · Remote System DiscoveryThe actor pinged several other endpoints by specifying their system names rather than running a ping sweep.T1021.001 · Remote Desktop ProtocolThe actor logged back into the system through Terminal Services/RDP using a second account.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe actor used curl.exe to upload out.zip over HTTP to 193.149.176.90.T1059.001 · PowerShellPowerShell scripts archived a minidump and collected files and browser data.T1059.003 · Windows Command ShellThe article reports Windows command-line activity, including commands to install and remove the Dokan driver.T1078 · Valid AccountsThe actor used known valid accounts, including a second account described as compromised, to access the system.T1105 · Ingress Tool TransferThe actor used curl.exe to download Dokan_x64.msi.zip and MemProcFS.zip from 193.149.176.90.T1560 · Archive Collected DataA PowerShell script added a minidump file to an archive before a later data-collection script ran.
Products
DokanNineteen seconds later, Huntress analysts observed subsequent commands to download MemProcFS, and then 48 seconds after the Dokan MSI file download, for installation of the Dokan file system driver:TeamViewerthat approximately 11 hours before the Huntress agent was installed, there was an unusual connection to TeamViewer; the TeamViewer connections_incoming.txt file contained an entry that read:
Tools
curlThree days after the Huntress agent was installed, existing detections fired alerts based on a file download that occurred via curl.exe:MemProcFSNineteen seconds later, Huntress analysts observed subsequent commands to download MemProcFS, and then 48 seconds after the Dokan MSI file download, for installation of the Dokan file system driver:PowerShellApproximately 10 seconds later, a PowerShell script was run that added the file M:\pid\1508\minidump\minidump.dmp to an archive.