T1036.005 — Masquerading: Match Legitimate Name or Location - CornFlake RAT IoCs
CornFlake is a newly identified Remote Access Trojan (RAT) attributed to a campaign dubbed CaptiveCrunch, attributed to the APT29 (Cozy Bear, Midnight Blizzard) sub-cluster tracked as Storm-2945. Real intrusion and sandbox dynamic analysis identifies the RAT landing initially as a file called edge_update.exe which, upon execution, copies itself to a binary named svchost32.exe, masquerading as the legitimate svchost.exe binary to evade detection. Notes: Detection uses the case operator to match surfaced artifacts against source MSRC article and live sandbox detonation artifacts. MSRC reports the malicious svchost32.exe landing in %APPDATA%\svchost32\svchost32.exe, however live sandbox analysis observes the file path being %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe. Case statement checks against both to be safe, as neither should exist in a standard environment. Also, remember that IoCs such as file names are low on the pyramid of pain. Taking into account MSRC's article showing the attackers using a handful of different lures, the edge_update.exe process name is likely only one of many for the initial implant. I would expect the svchost32.exe process to be slightly higher fidelity, but defenders should not assume that this detection being in place means they are fully covered from CornFlake RAT.
Microsoft Sentinel (KQL)
