Skip to content

S0238 Proxysvc

Proxysvc is a malicious DLL used by Lazarus Group in a campaign known as Operation GhostSecret. It has appeared to be operating undetected since 2017 and was mostly observed in higher education organizations. The goal of Proxysvc is to deliver additional payloads to the target and to maintain control for the attacker. It is in the form of a DLL that can also be executed as a standalone process. 1

Item Value
ID S0238
Associated Names
Version 1.2
Created 17 October 2018
Last Modified 30 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Proxysvc uses HTTP over SSL to communicate commands with the control server.1
enterprise T1119 Automated Collection Proxysvc automatically collects data about the victim and sends it to the control server.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c “ > %temp%\PM* .tmp 2>&1”.1
enterprise T1485 Data Destruction Proxysvc can overwrite files indicated by the attacker before deleting them.1
enterprise T1005 Data from Local System Proxysvc searches the local system and gathers data.1
enterprise T1041 Exfiltration Over C2 Channel Proxysvc performs data exfiltration over the control server channel using a custom protocol.1
enterprise T1083 File and Directory Discovery Proxysvc lists files in directories.1
enterprise T1070 Indicator Removal on Host -
enterprise T1070.004 File Deletion Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.1
enterprise T1057 Process Discovery Proxysvc lists processes running on the system.1
enterprise T1012 Query Registry Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.1
enterprise T1082 System Information Discovery Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.1
enterprise T1016 System Network Configuration Discovery Proxysvc collects the network adapter information and domain/username information based on current remote sessions.1
enterprise T1569 System Services -
enterprise T1569.002 Service Execution Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.1
enterprise T1124 System Time Discovery As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.1

Groups That Use This Software

ID Name References
G0032 Lazarus Group 1


Back to top