IO.MemoryStream", "iex ", "iex(", "Invoke-WebRequest", "set-MpPreference", "add-MpPreference", "certutil", "bitsadmin") // "csvhost.exe", "ekern.exe", "svhost.exe", ".dmp" or ProcessCommandLine matches regex @"[-/–][Ee^]{1,2}[ncodema^]*\s[A-Za-z0-9+/=]{15,}")) or (FileName =~ "curl.exe" and ProcessCommandLine contains "http") or (FileName =~ "wget.exe" and ProcessCommandLine contains "http") or ProcessCommandLine has_any ("E:jscript", "e:vbscript") or ProcessCommandLine has_all ("localgroup Administrators", "/add") or ProcessCommandLine has_all ("reg add", "DisableAntiSpyware", @"\Microsoft\Windows Defender") or ProcessCommandLine has_all ("reg add", "DisableRestrictedAdmin", @"CurrentControlSet\Control\Lsa") or ProcessCommandLine has_all ("wmic", "process call create") or ProcessCommandLine has_all ("net", "user ", "/add") or ProcessCommandLine has_all ("net1", "user ", "/add") or ProcessCommandLine has_all ("vssadmin", "delete", "shadows") or ProcessCommandLine has_all ("wmic", "delete", "shadowcopy") or ProcessCommandLine has_all ("wbadmin", "delete", "catalog") or (ProcessCommandLine has "lsass" and ProcessCommandLine has_any ("procdump", "tasklist", "findstr")) | where ProcessCommandLine !contains "download.microsoft.com" and ProcessCommandLine !contains "manageengine.com" and ProcessCommandLine !contains "msiexec" Ruby AsperaFaspex Suspicious Process Execution. DeviceProcessEvents | where InitiatingProcessFileName hasprefix "ruby" | where InitiatingProcessFolderPath has @"aspera" | where (FileName in~ ("powershell.exe", "powershell_ise.exe") and (ProcessCommandLine has_any ("whoami", "net user", "net group", "localgroup administrators", "dsquery", "samaccountname=", " echo ", "query session", "adscredentials", "o365accountconfiguration", "-dumpmode", "-ssh", "usoprivate", "usoshared", "Invoke-Expression", "DownloadString", "DownloadFile", "FromBase64String"


, "System.IO.Compression", "System.

Nationstate threat actor Mint Sandstorm refines tradecraft to attack highvalue targets


IO.MemoryStream", "iex ", "iex(", "Invoke-WebRequest", "set-MpPreference", "add-MpPreference", "certutil", "bitsadmin", "csvhost.exe", "ekern.exe", "svhost.exe", ".dmp") or ProcessCommandLine matches regex @"[-/–][Ee^]{1,2}[ncodema^]*\s[A-Za-z0-9+/=]{15,}")) or (FileName =~ "curl.exe" and ProcessCommandLine contains "http") or (FileName =~ "wget.exe" and ProcessCommandLine contains "http") or ProcessCommandLine has_any ("E:jscript", "e:vbscript") or ProcessCommandLine has_all ("localgroup Administrators", "/add") or ProcessCommandLine has_all ("reg add", "DisableAntiSpyware", @"\Microsoft\Windows Defender") or ProcessCommandLine has_all ("reg add", "DisableRestrictedAdmin", @"CurrentControlSet\Control\Lsa") or ProcessCommandLine has_all ("wmic", "process call create") or ProcessCommandLine has_all ("net", "user ", "/add") or ProcessCommandLine has_all ("net1", "user ", "/add") or ProcessCommandLine has_all ("vssadmin", "delete", "shadows") or ProcessCommandLine has_all ("wmic", "delete", "shadowcopy") or ProcessCommandLine has_all ("wbadmin", "delete", "catalog") or (ProcessCommandLine has "lsass" and ProcessCommandLine has_any ("procdump", "tasklist", "findstr")) Log4J Wstomcat Process Execution. DeviceProcessEvents | where InitiatingProcessFileName has "ws_tomcatservice.exe" and FileName !in~("repadmin.exe") Encoded watcher Function.


DeviceProcessEvents | where FileName =~ "powershell.exe" and ProcessCommandLine hasprefix "-e" | extend SplitString = split(ProcessCommandLine, " ") | mvexpand SS = SplitString | where SS matches regex "^[A-Za-z0-9+/]{50,}[=]{0,2}$" | extend base64_decoded = replace(@'\0', '', make_string(base64_decode_toarray(tostring(SS))))


| where not(base64_decoded has_any(@"software\checker", "set folder to watch")) | where base64_decoded has_all("$hst", "$prt") or base64_decoded has_any("watcher", @"WAt`CH`Er()")


Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytic (a series of analytics all prefixed with “TI map”) to automatically match the indicators mentioned in this blog post with data in their workspace.


If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.


More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy


In addition, Microsoft Sentinel customers can leverage the following content to hunt for and detect related activity in their environments: Log4J solution Potential Impacket Execution Commands executed by WMI on new hosts – potential Impacket Scheduled Task Hidden Remote Task Creation/Update using Schtasks Process Scheduled Task Creation or Update from User Writable Directory Exchange SSRF Autodiscover ProxyShell – Detection Indicators of compromise IndicatorTypeDescriptionSoldier.exeFile nameSoldier backdoorad55b4a40f9e52682d9d4f069914e09c941e8b77ca7b615e9deffccdfbc54145SHA256Soldier backdoor hashDrokbk.exeFile nameDrokbk backdoor64f39b85c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac0f841bSHA256Drokbk


backdoor hashsync-system-time[.]cfDomainDrokbk C2 infrastructureupdate-windows-security[.]tkDomainDrokbk C2 infrastructuredns-iprecords[.]tkDomainDrokbk C2 infrastructureuniversityofmhealth[.]bizDomainDrokbk C2 infrastructureoracle-java[.]cfDomainDrokbk C2 infrastructure54.39.202[.]0 IP addressDrokbk C2 infrastructure51.89.135[.]15IP


addressDrokbk C2 infrastructure51.89.169[.]201IP addressDrokbk C2 infrastructure51.89.187[.]222IP


addressDrokbk C2 infrastructureNY.docx.docxFile nameCharmPower lure document used for template injection57cc5e44fd84d98942c45799f367db78adc36a5424b7f8d9319346f945f64a72SHA256NY.docx.docx hashAbraham%20Accords%20Du.[.]docxFile nameCharmPower lure document used for template injection3dcdb0ffebc5ce6691da3d0159b5e811c7aa91f6d8fc204963d2944225b0119dSHA256Abraham%20Accords%20Du.[.]docx hashDocTemplate.dotmFile nameMalicious remote template document used in intrusions involving CharmPower65e48f63f455c94d3bf681acaf115caa6e1e60499362add49ca614458bbc4f85SHA256DocTemplate.dotmDntDocTemp.dotmFile nameMalicious remote template document used in intrusions involving CharmPower444075183ff6cae52ab5b93299eb9841dcd8b0321e3a90fb29260dc12133b6a2 SHA256DntDocTemp.dotm hash0onlyastep0[.]xyzDomainCharmPower C2 infrastructure0readerazone0[.]xyzDomainCharmPower C2 infrastructure0tryamore0[.]xyzDomainCharmPower C2 infrastructure References Iran: Background and U.S. Policy.


Congressional Research Service Cobalt Illusion Masquerades as Atlantic Council Employee.


Secureworks Apt42: Crooked Charms, Cons, and Compromises.


Mandiant Badblood: TA453 Targets US & Israel in Credential Phishing.


Proofpoint Treasury Sanctions IRGC-Affiliated Cyber Actors for Roles in Ransomware Activity.


U.S. Department of the Treasury Officials: Israel Linked to a Disruptive Cyberattack on Iranian Port Facility.


The Washington Post Iran Says Cyberattack Causes Widespread Disruption at Gas Stations.


Thomson Reuters Iran’s Evolving Approach to Asymmetric Naval Warfare.


The Washington Institute for Near East Policy Hackers breach Iran rail network, disrupt service | Reuters.


Reuters APT35 Exploits Log4J Vulnerability to Distribute New Modular PowerShell Toolkit.


Checkpoint Iran Says Gas Stations Were Target Of Cyberattack To Foment Unrest (iranintl.com) Complaint – Summons – Civil Cover Sheet.pdf (noticeofpleadings.com)


The post Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets appeared first on Microsoft Security Blog.


GuLoader Demystified:

GuLoader Demystified Unraveling its Vectored Exception Handler Approach


Unraveling its Vectored Exception Handler Approach url: https://securitynews.sonicwall.com/xmlpost/guloader-demystified-unraveling-its-vectored-exception-handler-approach/ GuLoader Demystified:


Unraveling its Vectored Exception Handler Approach May 31, 2023 OVERVIEW SonicWall Capture Labs Research team recently observed a new variant of GuLoader (a.k.a Cloudeye).


GuLoader is a shellcode-based downloader, known for its numerous anti-analysis techniques and control flow obfuscation.


In latest variant of GuLoader it introduces new ways to raise exceptions that hamper complete analysis process and its execution under controlled environment.


In this blog post, we will discuss Unpacking of GuLoader’s shellcodes.


Understanding a new anti-debug technique deployed by GuLoader.


Deep dive into GuLoader’s custom Vectored Exception Handler.


Writing an IDAPython script to deobfuscate the control flow of shellcode and to make GuLoader’s analysis easy and fast.


INTRODUCTION GuLoader is an advanced downloader first discovered in 2019 and since then it kept evolving, adding new anti-debugging techniques with its every new variant.


It downloads malicious payload including AgentTesla, Azorult and Ramcos RAT etc.


Currently GuLoader is spreading through malspam campaign and packed using NSIS installer.


UNPACKING GULOADER’S SHELLCODE GuLoader’s shellcode is executed after three layers.


Layer 1: Recent variant of GuLoader is spreading as NSIS Installer consisting of NSIS script, DLL plugin and encrypted shellcode’s file.


We need NSIS variant of 7-zip to extract the NSIS script, as typical installer of 7-zip is unable to extract the NSIS script.


Fig 1.


Extracted files from NSIS installer.


File “Hangarer.Man” contains shellcode of Layer 2 and an encrypted shellcode of Layer 3 which is main shellcode of GuLoader.


System.dll is DLL file which exports multiple functions.


An Exported function named as “Call” is called by NSIS script.


This function is responsible to allocate and execute Layer 2 shellcode.


Fig 2.


NSIS script calling Exported function Call.


Call function allocates memory space and copies content of file Hangarer.


Man from offset 0x409 till last byte.


It then calls CallWindowProcW API.


First parameter of CallWindowProcW is lpPrevWndFunc.


lpPrevWndFunc is callback function, which is set to address of allocated memory space, which results in indirect execution of the Layer 2’s shellcode.


Layer 2: Malware immediately decrypts the third layer which located at offset 0x1c9 in layer 2 and starts its execution.


Fig 3.


Decryption of layer 3.


Layer 3: It is the final GuLoader shellcode.


This shellcode has complex obfuscation, consisting of junk code, indirect function calls, dynamic API resolution, obfuscated arithmetic value calculations, using stack to decrypt strings, fake instructions, anti-debug, anti-vm, anti-analysis, anti-dump, anti-API hook, anti-emulation techniques.


During analysis of this variant, we have identified a significant enhancement in GuLoader’s one of most effective anti-debug technique that it’s custom Vectored Exception Handler.


Malware raises exceptions by executing cleverly crafted series of instructions.


Also it uses same instructions multiple times in shellcode to make it hard for reverser to perform static and dynamic analysis and to consume lot of time.


Ultimate goal of GuLoader for using this anti-debug technique is to achieve runtime control flow obfuscation.


GuLoader incorporates various evasions techniques.


Mentioning them below in order in which they are get executed.


Scan the virtual memory for the strings related to analysis tools.


Uses Heaven Gate technique to redirect it’s execution under x64 OS.


Check QEMU emulator related strings.


Patch DbgBreakPoint and DbgUiRemoteBreakin API used by debuggers.


Uses EnumWindows API to enumerates windows.


Uses NtSetInformationThread API with ThreadHideDebugger(0x11).


Uses EnumDeviceDrivers and GetDeviceDriverBaseNameA APIs.


Uses MsiEnumProductsA and MsiGetProductInfoA APIs.


Uses OpenSCManagerA and EnumServicesStatusA APIs.


Use NtQueryInformationProcess API with DebugPort(0x7).


An Overview of the Payload’s Execution Sequence Create suspended child process of itself.


In newly created process, it creates a section using genuine file to avoid AVs suspicious scanning.


In this case it was using mshtml.dll. Injects complete main shellcode in child process.


Repeats executing the mentioned evasion techniques one more time.


After successful bypass , it decrypts the c2 URL and download encrypted payload from c2.


Generate the payload decryption key.


In analyzed sample, key length was 0x303 bytes.


GuLoader allocates approximately 60MB of memory space for the payload of size few KBs.


It decrypts an encrypted payload, use process hollowing to inject decrypted payload into child process and resolves its Import Address Table.


Lastly, it starts payload execution using the ZwCreateThreadEx API. Fig 4.


Snippet of Payload decryption function.


All of the above-mentioned evasion techniques and payload execution sequences are already explained in detail in SonicWall Capture Labs Research team’s blog.


NEW ENHANCED ANTI-DEBUG TECHNIQUE


In the below section we will discuss Exception types and implementation.


Decoding Vectored Exception Handler function.


Writing IDAPython script to restore deobfuscate control flow.


EXCEPTION TYPES & IMPLEMENTATION


This variant of GuLoader has added two new additional exceptions EXCEPTION_ACCESS_VIOLATION & EXCEPTION_SINGLE_STEP compared to last variant it has only one exception EXCEPTION_BREAKPOINT exception.


We will discuss each exception and understand its pattern to write a script.


EXCEPTION_ACCESS_VIOLATION (code 0xC0000005)


When malware intentionally tries to write to an inaccessible memory address, exception EXCEPTION_ACCESS_VIOLATION is raised.


Here, malware constructs zero by series of arithmetic calculations.


Then it tries to access memory address pointed by it, which raises exception as zero is inaccessible memory address.


Fig 5.


EXCEPTION_ACCESS_VIOLATION instructions pattern.


As we can see the constant values and operations (mov, xor, sub) are keeps varying for each exception raised.


EXCEPTION_SINGLE_STEP (code 0x80000004)


The FLAGS register is the status register that contains the current state of a x86 CPU.


The trap flag is 8th bit of FLAGS register.


When the trap flag is set, the system is instructed to single step, it will execute one instruction and then stop.


Then contents of registers and memory locations can be examined by Vectored Exception Handler; if they are correct, the system can execute the next instruction.


The x86 processor has no instruction to directly set or reset the trap flag.


Malware uses combination of (PUSHFD/POPFD) instructions to set trap flag.


These operations are done by.


Pushing the flag register on the stack (PUSHFD) .


Modifying the trap flag bit (uses 0x100)


Popping the flag register back off the stack (POPFD).


When malware is running without debugger, when SINGLE_STEP exception is raised and handled by Vectored Exception Handler.


Fig 6. SINGLE_STEP


exception instructions pattern.


However while using debugger, no exception can be seen being raised as trap flag is always gets reset after each debugger event is delivered.


EXCEPTION_BREAKPOINT (code 0x80000003) INT3 instruction (0xCC opcode) is used as software breakpoint in debuggers, that’s why when program is running under debugger, control remains to the debugger after it encounter INT3.


When malware is running without debugger exception EXCEPTION_BREAKPOINT is raised, and control is transferred to the Vectored Exception Handler.


Fig 7.


BREAKPOINT exception instruction patterns.


Now we have understood how exceptions are being raised by malware.


Next will see how malware uses these exceptions to change the control flow at runtime using its custom Vectored Exception Handler. DECODING VECTORED EXCEPTION HANDLER An application can register a function to handle all exceptions for the application.


Vectored handlers are called in the order that they were added.


GuLoader call RtlAddVectoredExceptionHandler API to add its custom Vectored Exception Handler. RtlAddVectoredExceptionHandler accepts two parameters.


Fig 8.


Structures of EXCEPTION RECORD & CONTEXT.


As we can see in below image, pointer of structure EXCEPTION_POINTERS is being passed as an argument to Vectored Exception Handler(VEH).


Using structure EXCEPTION_POINTERS, VEH can access all the information regarding raised exceptions and reading the values of all the registers of processor using structure CONTEXT.


Fig 9.


Pseudocode of Custom Vectored Exception Handler.


When EXCEPTION_ACCESS_VIOLATION and SINGLE_STEP_EXCEPTION exceptions are raised, handler perform following steps: It checks whether memory address being currently accessed is zero or not.


If it is not zero, then it returns 0 and ultimately crashes down.


But how handler gets the address of currently accessed memory location?


So it uses ExceptionInformantion[1] member of Exception Record to get this additional information about exception.


Checks if any hardware breakpoints have been set by checking status of the debug registers(DR0 to DR7).


If found it set the ContextRecord to 0 which leads malware to crash.


If successfully pass the check, it then transforms the EIP to new address using logic Context->Eip += ByteAt(Eip + 2) ^


0x6A where Value 2 depicts size of instruction (mov, jg, jne etc.) where exception is raised.


0x6A is byte key to transform EIP.


(It differs sample to sample) Fig 10.


Debug register check.


When EXCEPTION_BREAKPOINT exception is raised, handler perform following steps:


Checks whether hardware breakpoints have been set by checking status of the debug registers(DR0 to DR7).


Scans for applied software breakpoint i.e. CC byte in loop.


If successfully pass the check, it then transforms the EIP to new address using logic Context->Eip += ByteAt(Eip + 1) ^


0x6A where Value 1 depicts size of instruction (CC) where exception is raised.


WRITING IDA PYTHON SCRIPT IDAPython is an IDA Pro plugin that integrates the python programming language, allowing scripts to run in IDA Pro. IDA provides different modules to work on disassembly of instructions.


The python script finds instructions pattern that raise an exception and patch them by jump instruction with transformed EIP offset as a target.


After running the python script in IDA, we get clean, easy to analyze, deobfuscated code of GuLoader’s shellcode.


Also finds out that GuLoader’s VEH has been called more than 1100 times.


Fig 11.


Obfuscated code(A), deobfuscated code(B), GuLoader’s entire shellcode graph view(C).


CONCLUSION GuLoader malware introduces new techniques very often which takes much time and efforts of malware analysts to fully analyzed it.


We have completely analyzed GuLoader’s custom Vectored Exception Handler and understood how it works.


We have written python script to defeat GuLoader shellcode control flow obfuscation and saving time and efforts of malware analyst.


We expect further development in GuLoader anti-analysis, anti-debug techniques in upcoming days.


SonicWall Capture Labs provides protection against this threat via the SonicWall Capture ATP w/RTDMI.


IOC’s SHA256 : 55130719554a0b3dcbf971c646e6e668b663b796f4be09816d405cc15a16d7d6 C2 URL : hxxp[:]//lena[.]utf[.]by/wp-content/plugins/f8eb81f6deba45169c3b41c05c4590ad/y/mm/mmd/kdRrHFMqRUIujuOy126[.]bin Final Payload (Azorult stealer): d5af42b118d0597c6b71831f2b2ebc8294eca907481d53939563fce7c0f14767 REFERENCES


[1] https://securitynews.sonicwall.com/xmlpost/guloader-a-fileless-shellcode-based-malware-in-action/ [2] https://learn.microsoft.com/en-us/windows/win32/debug/vectored-exception-handling [3] https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-exception_record


APT & Targeted Attacks Pack it Secretly: Earth Preta’s Updated Stealthy Strategies After months of investigation, we found that several undisclosed malware and interesting tools used for exfiltration purposes were being used by Earth Preta.

Pack it Secretly Earth Pretas Updated Stealthy Strategies


We also observed that the threat actors were actively changing their tools, tactics, and procedures (TTPs) to bypass security solutions.


In this blog entry, we will introduce and analyze the other tools and malware used by the threat actor.


By: Vickie Su, Nick Dai, Sunny Lu March 23, 2023Read time: ( words) Save to Folio Subscribe


In our previous research, we disclosed and analyzed a new campaign initiated by the threat actor group Earth Preta (aka Mustang Panda).


In a more recent campaign we’ve been tracking, we discovered Earth Preta delivering lure archives via spear-phishing emails and Google Drive links.


After months of investigation, we found that several undisclosed malware and interesting tools used for exfiltration purposes were used in this campaign.


In this blog entry, we will introduce and analyze the other tools and malware used by Earth Preta.


Infection chain As we previously mentioned in our past blog entry, the entire attack begins with a spear-phishing email.


After a long-term investigation into the attack routine, we’ve determined that the full infection chain works as follows: Figure 1.


The full infection chain We categorize the different TTPs into six stages: arrival vectors, discovery, privilege escalation, lateral movement, command and control (C&C) and exfiltration, respectively.


In our previous research, we covered most of the new TTPs and malware during the first stage, arrival vectors.


However, we observed that some of TTPs have been changed.


In the following sections, we focus on the updated arrival vectors and their succeeding stages.


Arrival vectors We previously summarized the arrival vectors used by Earth Preta by categorizing them into three types (DLL sideloading, shortcut links, and fake file extensions).


Starting in October and November 2022, we observed that the threat actors began changing their TTPs to deploy the TONEINS, TONESHELL, and PUBLOAD malware, and QMAGENT malware.


We believe that the threat actors are employing these new techniques to avoid detection.


Trojan.Win32.TONEINS Based on our earlier observation, the TONEINS and TONESHELL malware were downloaded from the Google Drive link embedded in the body of an email.


To bypass email-scanning services and email gateway solutions, the Google Drive link has now been embedded in a lure document.


The document lures users into downloading a malicious password-protected archive with the embedded link.


The files can then be extracted inside via the password provided in the document.


By using this technique, the malicious actor behind the attack can successfully bypass scanning services.


A lure document (allegedly concerning the government-related Myanmar Sustainable Development Plan) embedded with a Google Drive link and a password For the new arrival vector, the whole infection flow has been changed to the procedure shown in Figure 3.


Infection flow for the new arrival vector File name Detection name Description Letter Head.docx Decoy document with Google Drive link List of terrorist personnel IN border.rar (all entries below are part of this archive) List of terrorist personnel at the border.exe First-stage legitimate executable for DLL sideloading libcef.dll Trojan.Win32.TONEINS First-stage malware ~$Evidence information.docx Second-stage legitimate executable for DLL sideloading ~$List of terrorist personnel at the border.docx Backdoor.Win32.TONESHELL Second-stage malware Internal Letter.docx Decoy document Letter Head.docx Decoy document Table 1.


Files in the new arrival vector After analyzing the downloaded archive, we discovered it to be a malicious RAR file with the TONEINS malware libcef.dll and the TONESHELL malware ~List of terrorist personnel at the border.docx.


The infection flow for these is similar to the arrival vector type C in our previous report, with the only difference being that the fake .docx files have XOR-encrypted content to prevent detection.


For example, ~$Evidence information.docx is a file disguising itself as an Office Open XML document.


As such, it seems harmless and can even be opened by using decompression software such as 7-Zip.


We found that the threat actors have hidden a PE file in one of the archive’s ZIPFILERECORD structures.


The TONEINS malware, libcef.dll, will decrypt this file with a single byte in XOR operations, find the PE header, and drop the payload to the specified path.


A PE file is revealed after decrypting the frData member in the last ZIPFILECECORD structure.


The decryption function of TONEINS The succeeding behaviors of the infection flow are generally the same as those in our previous analysis, where we provide more details.


Trojan.Win32.PUBLOAD In more recent cases, the malware PUBLOAD was also being delivered through Google Drive links embedded in decoy documents.


The lure document Invitation letter from the US embassy.docx Since October 2022, we have been observing a new variant of PUBLOAD, which uses the spoofed HTTP header to transfer the data, as LAC’s report also discusses.


In contrast to the previous PUBLOAD variant, it prepends an HTTP header with a legitimate-looking host name to the packets.


We believe that the threat actors are trying to conceal malicious data among normal traffic.


The data in the HTTP body is the same as the past variant, which has the same magic bytes 17 03 03 and the encrypted victim information.


We were able to successfully retrieve the payload from a live C&C server and were therefore able to continue our analysis.


C&C traffic of the PUBLOAD HTTP variant Once the payload is received, it will check if the first three magic bytes are 17 03 03 and if the following two bytes are the size of payload.


It will then decrypt the encrypted payload with the predefined RC4 key 78 5A 12 4D 75 14 14 11 6C 02 71 15 5A 73 05 08 70 14 65 3B 64 42 22 23 20 00 00 00 00 00 00 00, which is the same as the one used in the PUBLOAD loader.


The first payload retrieved from the PUBLOAD HTTP variant After decryption, it then checks if the first byte of the decrypted payload is 0x06.


The decrypted payload contains another payload that is XOR-encrypted with the bytes 23 BE 84 E1 6C D6 AE 52 90.


The second payload retrieved from the PUBLOAD HTTP variant After this is decrypted, there is yet another final backdoor payload that supports data upload and command execution.


The final payload of the PUBLOAD HTTP variant Command Internal string 0x03 - 0x01 - 0x1B UploadBegin error : %d! 0x1D UploadData error : %d! 0x1A - 0x1E CmdStart error : %d! 0x1F CmdWrite error :


%d! 0x30 CmdWrite error : %d 0x20 - Table 2.


Command codes in the PUBLOAD HTTP variant In addition, we found some interesting debug strings and event names among the PUBLOAD samples.


Event name in PUBLOAD Figure 12.


Debug string in PUBLOAD In summary, we think that the new TONESHELL and PUBLOAD archives have been evolving and now have something in common.


For example, both of them are now being placed in decoy documents (such as Google Drive links) in order to bypass antivirus scanning.


Discovery Once the threat actors obtain access to the victim’s environment, they can start inspecting the environment via the following commands: net user net user <username> net user <username>


/DOMAIN Privilege escalation In this campaign, we discovered several tools used for UAC bypass in Windows 10.


We will go into detail for each of them.


HackTool.


Win 32.ABPASS HackTool.Win32.ABPASS is a tool used to bypass UAC in Windows 10.


Based on our analysis, it reuses codes from the function ucmShellRegModMethod3, which is from a famous open-source project called UACME.


A report from Sophos introduces this tool.


￼ This tool accepts an argument, and the following data is written into registry: Registry Key Name Value HKEY_USERS\<SID>-1001_Classes\aaabbb32\shell\open\command (Default)


argv[1] HKEY_USERS\<SID>-1001_Classes\ms-settings\CurVer (Default) aaabbb32 Table 3.


Registry keys changed by ABPASS


It also changes how Windows handles the ms-settings protocol — in this case, the string ms-settings is a Programmatic Identifier (ProgID).


If the CurVer key is set under a ProgID, it will be used for versioning and mapping the current ProgID (ms-settings) to the one specified in the CurVer’s default value.


In turn, the behavior of ms-settings is redirected to the custom defined ProgID aaabbb32.


It also sets up a new ProgID aaabbb32 and its shell open command.


Finally, fodhelper.exe or computerDefaults.exe will be executed to trigger the ms-settings protocol.


The added ProgID aaabbb32 HackTool.


Win 32.CCPASS HackTool.


Win32.CCPASS is another tool that is also used for Windows 10 UAC bypass and similarly reuses codes from the function ucmMsStoreProtocolMethod in the project UACME.


Code similarities in CCPASS and ucmMsStoreProtocolMethod It works in a similar way to ABPASS.


However, unlike ABPASS, it hijacks the ms-windows-store protocol.


The hack tool CCPASS works as follows: It disables the application association toasts for the protocol ms-windows-store.


It creates a new Shell in the registry.


It invokes the undocumented API UserAssocSet to update the file association.


It executes WSReset.exe to trigger this protocol.


In Windows 10 and above, the system shows a new toast dialog for selecting the open application for the selected file type.


To hide this window, the tool explicitly adds new entries to HKCU\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts to disable all toasts related to the protocol ms-windows-store.


An example of the application association toast Figure 16.


Hiding application association toasts via the registry Once this is done, the tool starts to alter the shell command of ms-windows-store and finally triggers it using WSReset.exe.


SilentCleanup In Windows 10, there is a native Windows service called “SilentCleanup.”


This service has the highest privileges that can be abused for Windows 10 UAC bypass.


Normally, this service is intended for running %windir%\system32\cleanmgr.exe.


However, the environment variable %windir% can be hijacked and changed to any path to achieve privilege escalation.


Malicious commands abusing the SilentCleanup service We observed that the threat actors used this technique to execute c:\users\public\1.exe.


Lateral movement In this stage, we observed certain malware such as HIUPAN and ACNSHELL (initially introduced and analyzed by Mandiant and Sophos) being used to install themselves to removable disks and create a reverse shell.


USB Worm: Worm.


Win 32.HIUPAN and+ Backdoor.


Win 32.ACNSHELL


We found a pair of malware comprised of a USB worm and a reverse shell —includin g a USB worm and a reverse shell (detected as Worm.Win32.HIUPAN and Backdoor.Win32.ACNSHELL, respectively,) — being used to spreadfor spreading themselves over removable drives., which we detected as Worm.Win32.HIUPAN and Backdoor.Win32.ACNSHELL.


This These malware wereas detailed and introducedpreviously discussed in the reports published by Mandiant and Sophos.


Figure 18 shows the infection chain for both. Figure 18.


HIUPAN and ACNSHELL infection flow The USB Driver.exe program first sideloads u2ec.dll, which then loads the payload file usb.ini.


They have the following PDB strings, respectively: G:\project\APT\U盘劫持\new\u2ec\Release\u2ec.pdb


G:\project\APT\U盘劫持\new\shellcode\Release\shellcode.pdb The string U盘劫持 means “U disk hijacking,” where “U disk” refers to removable drives.


USB Driver.exe then starts checking whether it is properly installed.


If it is installed, it will start to infect more removable disks and copy files to a folder named autorun.inf.


If it is not installed, it installs itself to %programdata% and then sets the registry run key for persistence.


Finally, the ACNSHELL malware rzlog4cpp.dll is sideloaded.


It will then create a reverse shell via ncat.exe to the server closed[.]theworkpc[.]com.


Command and Control (C&C)C&C stage Earth Preta employed several tools and commands for the C&C stage.


For example, the group used certutil.exe to download the legitimate WinRAR binary as rar1.exe from the server 103[.]159[.]132[.]91. Figure 19.


The certutil.exe program downloads the WinRAR binary We also observed that the threat actors used PowerShell to download multiple malware and archives from the server 103[.]159[.]132[.]181 for future use. Figure 20.


PowerShell downloading malware In certain instances, they even leveraged the WinRAR binary installed on the victim hosts to decompress all the malware.


Decompressing malware with the installed WinRAR binary Although we found several logs involving multiple pieces of dropped malware, we only managed to retrieve a few of them.


Among all our collected samples, we will introduce the most noteworthy ones.


Backdoor.


Win32.CLEXEC The file name of the backdoor CLEXEC is SensorAware.dll.


This is a simple backdoor that is capable of executing commands and clearing event logs.


Command codes of CLEXEC Backdoor.


Win32.COOLCLIENT The backdoor COOLCLIENT was first introduced in a report from Sophos; the sample mentioned in the report was compiled in 2021.


In our case, the COOLCLIENT sample we analyzed had a more recent compilation time in 2022, and while it provides the same functionalities, it has the added capability to open a decoy document (work.pdf) when the current process name has “.pdf” or “.jpg” file extensions.


It contains also possesses the ability to reduce debug strings (less OutputDebugStrings calls).


Meanwhile, loader.ja is used under two processes: One is under googleupdate.exe, which is used for the first sideloading.


The second is under winver.exe, which is injected to conduct backdoor behaviors.


Furthermore, COOLCLIENT applies obfuscation techniques that we discuss in later sections. Figure 23.


Open decoy document Figure 24 shows the whole execution flow of COOLCLIENT. Figure 24.


Execution flow of COOLCLIENT The arguments of COOLCLIENT provide the following capabilities: install.


There are three conditions different ways to decide the method of installation for COOLCLIENT, detailed here: It installs itself by creating an InstallSvc service called InstallSvc which will trigger “googleupdate.exe work”..


It sets up a run key for via the command C:\ProgramData\GoogleUpdate\googleupdate.exe work for persistence. work.


The malware will continue to read and decrypt goopdate.ja and inject it into winver.exe for the next-stage payload (COOLCLIENT), which contains malicious behaviors.


passuac.


The malware will check if the process avp.exe exists.


If avp.exe doesn’t exist, UAC bypass will be executed via the CMSTPLUA COM interface.


If avp.exe exists, UAC bypass will be executed via the AppInfo RPC service.


UAC Bypass via the CMSTPLUA COM interface Figure 26.


UAC Bypass via the AppInfo RPC service Based on the class name used in COOLCLIENT, we learned thaAccording to our analysis, it reads the encrypted configuration filecan expand the C&C server via time.sig., an encrypted configuration.


It is also able to communicate through different network protocols such as UDP (User Datagram Protocol) and TCP (Transmission Control Protocol).


Based on some internal strings and the APIs used by Earth Preta, the functionalities of this backdoor can be inferred as follows: Send portmap Build connection Read file Delete file Keystrokes and windows monitoring Backdoor.


Win32.TROCLIENT The backdoor TROCLIENT, which was also first disclosed in Sophos’s report, is similar to COOLCLIENT.


However, this backdoor has an anti-debugging technique, which will check if the running processes have the strings dbg.exe or olly. Figure 27.


TROCLIENT anti-debugging technique.


Figure 28 shows the whole execution flow of TROCLIENT. Figure 28.


Execution flow of TROCLIENT The arguments of TROCLIENT provide the following capabilities: install.


There are two waysto determine the method of installation for TROCLIENT, detailed here: It installs itself by creating aservice called InstallSvc which will trigger “C:\programdata\netsky\netsky.exe online”.


It sets up a run key for the command C:\programdata\netsky\netsky.exe online for persistence.


online: It will read the next stage payloads, free.plg and main.plg, and inject them into dllhost.exe. passuac:


If it does not, UAC bypass is executed via the CMSTPLUA COM interface.


If avp.exe exists, UAC bypass is executed via token manipulation.


The capabilities of three different arguments This backdoor provides the following capabilities: Read file Delete file Monitor keystrokes and windows There are several similarities and differences between COOLCLIENT and TROCLIENT, as Table 3 shows.


Argument/Behaviors COOLCLIENT TROCLIENT install Creates a service named InstallSvc ✓ ✓ Executes itself with passuac ✓ ✓ Sets Run Key with “work/online” ✓ ✓ passuac AppInfo RPC ✓ CMSTPLUA COM ✓ ✓ Token manipulation ✓ work/online Send portmap ✓ Connect to C&C ✓ ✓ File operations ✓ ✓ Keylogging ✓ ✓ Table 3.


Comparison of COOLCLIENT and TROCLIENT


In addition to the aforementioned malware, we also found several shellcode loaders for PlugX. Since it is a known malware family, we will not expand on its details in this blog entry.


Exfiltration Based on our telemetry, we found that Earth Preta used multiple approaches to exfiltrate sensitive data from the victims.


For example, in some cases, we observed that WinRAR and curl (or cURL) were leveraged to collect and transfer data to the threat actor’s server.


After further investigation, we even found some previously unseen pieces of malware that were used to collect data in a custom-made file format.


In the following sections, we share the details of the unique exfiltration toolsets developed by Earth Preta.


WinRAR and curl According to some of our monitoring logs, the threat actors abused the installed WinRAR binary and the uploaded curl executable to exfiltrate the files (Figure 30 shows the executed command).


Note that the executable log.log is a legitimate curl binary.


All the exfiltrated data was collected and sent back to the threat actor-controlled FTP (File Transfer Protocol) server.


Exfiltrate data using WinRAR and curl In some cases, we accidentally stumbled on the account and password of the FTP server.


Upon checking the FTP server, we learned that the threat actors focused on sensitive and confidential documents, most of which were compressed and protected with a password.


Based on our observations, the documents were organized via the categorization of the victim’s host name and disk drive.


FTP servers with stolen documents HackTool.


Win32.NUPAKAGE Apart from well-known legitimate tools, the threat actors also crafted highly customized tools used for exfiltration.


We named this malware “NUPAKAGE," a name derived from its unique PDB string, D:\Project\NEW_PACKAGE_FILE\Release\NEW_PACKAGE_FILE.pdb.


The NUPAKAGE malware needs a unique passcode to be executed, with the exfiltrated data being wrapped in a custom file format.


It seems that the threat actors are continuously updating this tool to provide more flexibility and lower the possibility of detection, including adding more command-line arguments and obfuscation mechanisms.


By default, it only collects documents, including the files with the following extensions: .doc .docx .xls .xlsx .ppt .pptx .pdf


It avoids collecting documents with file names starting with “$” or “~” since these types of documents are usually either temporary files generated by the system or PE files pretending to be decoy documents (as we discussed in the arrival vectors section).


The usage of this tool is as follows: malware.exe passcode start end chunk -s extension_A extension_B … Argument Name Format Example Value Description passcode String comeon A unique code to execute it start String 2022-01-01


The start range of the exfiltrated file’s modification timestamp end String 2022-12-31


The end range of the exfiltrated file’s modification timestamp chunk Integer 4096 Splits the generated data in chunks by the specified size (MB) -s String File extensions to be collected; optional Table 5.


Arguments of the NUPAKAGE malware Every NUPAKAGE malware needs a unique passcode as its first argument to continue execution.


As Figure 32 shows, it first checks if the passcode exists.


If not, the malware execution procedure will terminate.


In our collection, we observed different passcodes in each malware. Figure 32.


Passcode check routine in NUPAKAGE SHA256 Passcode 634977a24e8fb2e3e82a0cddfe8d007375d387415eb131cce74ca03e0e93565f notebook c835577f1ddf66a957dd0f92599f45cb67e7f3ea4e073a98df962fc3d9a3fbe0 comeon 2937580b16e70f82e27cfbc3524c2661340b8814794cc15cb0d534f5312db0e0 update c2f5a12ebaeb39d4861e4c3b35253e68e6d5dc78f8598d74bc85db21aeb504e8 comeon Table 4.


Passcodes in NUPAKAGE After execution, NUPAKAGE will drop two files, xxx.zip and xxx.z.


The file xxx.zip is a logging file with a fake ZIP header prepended at offset 0x0 and taking up the first 0x100 bytes.


Starting from the offset 0x100, the logging strings are encrypted with a single byte in XOR operations as shown Figure 33.


The original logging file (top), with plain text revealed in the decrypted logging file (bottom) Taking one of the execution results as an example, much of the information of the exfiltrated data is saved, including the original file path, the original file size, and the compressed file size.


We believe that the threat actors use it to further track which files have been processed.


For security researchers, this logging file also helps reveal how much data is exfiltrated and provides information on the impact scope.


[+] Program ready!


[+] FILE ORIGINAL PATH: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf [+] FILE PATH SIZE: 198 [+] FILE ORIGINAL SIZE: 186837


[+] FILE COMPRESSED SIZE: 183734 [+] FILE ORIGINAL PATH:


C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on ‘Change’ to select default PDF handler.pdf [+] FILE PATH SIZE: 210 [+] FILE ORIGINAL SIZE:


186837 [+] FILE COMPRESSED SIZE: 183734 ...


<omitted> ...


[*] File or folder access denied!


[+] All completed!


The file with a .z extension is a blob of exfiltrated data within a self-defined file format.


The NUPAKAGE malware first generates a key blob randomly, with the key being encrypted in a custom algorithm.


After, it stores the encrypted key blob into the first 0x80 bytes of the file with the .z extension.


Starting from the offset 0x80, there exists a long array of all the exfiltrated data.


Much of the information from the exfiltrated files are saved, such as the MD5 hash, the length of the file name, the compressed file size, the original file size, the file name, and the file’s content.


To separate the file blobs, it puts a unique byte sequence at the end of each, 55 55 55 55 AA AA AA AA FF FF FF FF 99 99 99 99.


Figure 34.


Self-defined format in the file with the .z extension generated by NUPAKAGE Table 5.


Self-defined format description in the file with the .z extension generated by NUPAKAGE It’s also worth mentioning that in the more recent versions of NUPAKAGE, an increasing number of obfuscations are being adopted to thwart static analysis.


Junk codes in more recent versions of NUPAKAGE HackTool.


Win32.ZPAKAGE ZPAKAGE is another example of custom malware used for packing files; it also works similarly to NUPAKAGE.


It also needs a passcode to ensure that it is being used as intended.


In the example shown in Figure 36, the passcode is “start”.


Figure 36.


An example of a ZPAKAGE password ZPAKAGE also supports command-line arguments, but it possesses less functions than NUPAKAGE.


The usage of this tool is shown as follows: malware.exe passcode time Argument Name Format Example Value Description Passcode String start A unique code in order to execute it Time String 20221221 The start date Table 6.


Arguments supported by ZPAKAGE ZPAKAGE also shows similar behaviors to NUPAKAGE.


For instance, it also avoids files with names starting with “$” or “~”.


In addition, it generates two files, one with a .z extension and another with a .zip extension.


The file with a .z extension is the exfiltrated data blob and the file with a .zip extension is the logging file.


In the generated file with a .z extension, the exfiltrated files will be compressed by the zlib algorithm to minimize the file size.


It also defines a Boolean field “type” for storage, whether a file is compressed or not.


If a file is compressed and its file size is less than the original one, the type will be 1.


Otherwise, the type will be set to 0, and the original file content will be chosen instead of the compressed one.


Regardless of whether the file content is compressed or not, it will be encrypted in XOR operations with a specific string, qwerasdf.


Self-defined format in the file with .z extension generated by ZPAKAGE Table 7. Self-defined format description in the file with the .z extension generated by ZPAKAGE Threat Hunting Since October 2022, the threat actors have changed their TTPs and have started using password-protected archives.


For example, we found a TONEINS sample (SHA256: 8b98e8669d1ba49b66c07199638ae6012adf7d5d93c1ca3bf31d6329506da58a) on VirusTotal that can’t be linked to any other file in the “Relations” tab.


However, we observed two files that have been opened in the “Behaviors” tab with the file names ~$Evidence information.docx and ~$List of terrorist personnel at the border.docx.


As mentioned in the arrival vectors section, the next stage payloads are normally embedded in the fake document files.


Opened files of TONEINS sample Figure 39 shows the search results for the query “List of terrorist personnel at the border” on VirusTotal.


The first file is the TONEINS DLL sample that we mentioned earlier in this section, while the second file is a benign executable file originally named adobe_licensing_wf_helper.exe, which was apparently uploaded to VirusTotal with the file name List of terrorist personnel at the border.exe.


Search result for the string List of terrorist personnel at the border on VirusTotal Figure 40.


Submission of adobe_licensing_wf_helper.exe The third file is a password-protected archive, which has the exact same file name, List of terrorist personnel at the border[1].rar.


Unfortunately, we didn’t have the password, so we were unable to decompress it.


But it has an interesting execution parent in the “Relations” tab, which is a document file named Letter Head.docx. Figure 41.


Execution parent of List of terrorist personnel at the border[1].rar Inside the document Letter Head.docx


, there is a Google Drive link and a password.


The content itself is related to the Government of the Republic of the Union of Myanmar, and is written in Burmese.


Letter Head.docx Upon checking the download link, we discovered that it was the same password-protected archive file that we found on VirusTotal earlier.


Screenshot of the Google Drive link The new arrival vector flow is similar to the one we introduced in the arrival vector section: Victims will receive and interact with a decoy document containing a Google Drive link and a corresponding password instead of an archive download link embedded in the email.


As for why the password-protected archive has the execution parent, upon checking the sandbox execution behaviors of Letter Head.docx on VirusTotal, we discovered that the VirusTotal sandbox will select any link embedded in the document.


This leads to the opening of an Internet Explorer window with the file download prompt.


Sandbox screenshot of the file Letter Head.docx on VirusTotal When the download prompt is shown, Internet Explorer will silently download this file in the background even before the user selects the “Save” button.


As a result, the file will be saved to the cache folder named “INetCache,” after which we see a dropped RAR file: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\R0IAZP7Z\List%20of%20terrorist%20personnel%20at%20the%20border[1].rar.


Since the RAR file is downloaded automatically by Internet Explorer, Letter Head.docx will be treated as its execution parent.


This sample can then be used for hunting this campaign.


The dropped files of Letter Head.docx on VirusTotal To find additional password-protected archives and documents embedded with a Google Drive link, we tried to use the following query:


tag:rar tag:encrypted name:INetCache size:500kb+ The query finds any encrypted RAR archive with a large enough file size containing the folder name “INetCache” in its path.


Fortunately, we found another RAR file with the document execution parent “Notic(20221010)(final).docx” that turned out to be a TONESHELL archive.


Figure 46.


Relations of the archive file Figure 47.


Content of the file Notic(20221010)(final).docx It’s interesting to note that the threat actors use date and time strings written in the same format (DD-MM-YYYY) as the extracting passwords in all the cases we’ve collected so far.


Connecting the Dots During our investigation, we observed some data points that connect to the same personnel.


For example, we found a specific name “TaoZongjie” among the different malware samples we collected.


In addition, the GitHub repository named “YanNaingOo0072022,” mentioned in Avast’s December 2022 report,￼hosted multiple pieces of malware, including TONESHELL.


We also observed that the obfuscation methods have similarities among the different malwares.


User “TaoZongjie” We found some samples sharing the same special string/name “TaoZongjie,” including the Cobalt Strike malware, a Windows user on a TONESHELL C&C server, and the displayed message in the pop-up dialog box of TONESHELL.


Our investigation started with the TONESHELL C&C server 38[.]54[.]33[.]228 that had the remote desktop service enabled.


Here, we found that one of the Windows users was called “TaoZongjie.”


Figure 48.


Windows users in 38[.]54[.]33[.]228 While hunting samples related to this campaign, we came across a tweet about Cobalt Strike posted in April 2021.


At first glance, Cobalt Strike was used in a manner similar to this campaign, including the use of DLL sideloading, the use of a Google Drive link for delivery, and the creation of a schedule task.


A tweet about Cobalt Strike The infection flow is as follows: The archive file is delivered through a Google Drive link, which contains a legitimate EXE file, a malicious DLL file, and a decoy document written in Burmese.


Once the malicious DLL is sideloaded, it will drop the legitimate EXE file and the malicious DLL file, which are embedded in the resource section of the DLL file.


In this sample, the string By:Taozongjie is being used as the event name.


Infection flow of Cobalt Strike Figure 51.


Special string in the sample In one TONEINS sample (SHA256: 7436f75911561434153d899100916d3888500b1737ca6036e41e0f65a8a68707), we also observed the string taozongjie, which was being used for an event name.


Create event taozongjie in TONEINS In another TONESHELL sample (SHA256: d950d7d9402dcf014d6e77d30ddd81f994b70f7b0c6931ff1e705abe122a481a), there are some insignificant export functions, which will appear via message boxes, with the strings Tao or zhang!.


Even though the names of these two strings are not spelled exactly same way as taozongjie, their spellings are still similar.


Message boxes of TONESHELL Based on what we found among the different samples, we assume that taozongjie could be one of the flags used by the threat actors.


GitHub user “YanNaingOo0072022” The GitHub user “YanNaingOo0072022” was mentioned in both an Avast and an ESET report.


The user’s repositories host various malware, including the latest versions of TONEINS, TONESHELL, and a new tool, QMAGENT, which is ESET named MQsTTang”.


At the time of writing, this GitHub space was still accessible, with five repositories: “View2015,” “View2016,” “1226,” “ee,” and “14.”


Among these, “View2015” and “View2016” were empty.


The YanNaingOo0072022 GitHub space 1226


The archive files in this repository are all the same but have different file names.


We believe that these files were meant for different victims.


The 1226 repository Upon unarchiving the compressed file, we found two files with the fake extension “.doc” containing one-byte XOR encrypted sections.


Both share the same file structure (a PE payload hidden in a DOCX file) as the one we referred to in the arrival vectors section.


These files ended up being the TONEINS and TONESHELL malware.


Figure 56.


The files inside the archive 14 The file Documents members of delegation diplomatic from Germany.


Exe, found in the Documents.rar archive, is a novel malware that communicates over the MQTT protocol.


In March 2023, ESET published a detailed technical report on this backdoor, which it named “MQsTTang.”


Beginning in January, we discovered that MQsTTang was being used as the new arrival vector in some of incidents we encountered, specifically in campaigns targeting individuals involved with government entities.


This backdoor is unique because it communicates to its C&C servers over the MQTT protocol, which is commonly used in internet-of-things (IoT) devices.


Malicious actors using this technique can effectively hide the real C&C server behind the protocol.


The 14 repository ee The file CVs Amb Office PASSPORT Ministry Of Foreign Affairs.exe, which is the malware QMAGENT, can be found in the CVs Amb.rar archive.


The ee repository Conclusion Over the past year, security researchers have been discovering and analyzing Earth Preta’s campaigns and toolsets.


We were able to attribute some of these to Earth Preta based on similarities among the TTPs, the malware being used, and the timeline of the campaigns.


Starting October 2022, the threat actors changed the arrival vector of the TONEINS, TONESHELL, and PUBLOAD malware.


Instead of attaching malicious archives or Google Drive links to an email, they now embed the download link in another decoy document and add a password to the archive.


Based on our observations, Earth Preta tends to hide malicious payloads in fake files, disguising them as legitimate ones — a technique that has been proven effective for avoiding detection.


As for privilege escalation, the threat actors tend to reuse codes copied from open-source repositories.


Meanwhile, they developed customized toolsets designed to collect confidential documents in the exfiltration stage.


Overall, we believe that Earth Preta is a capable and organized threat actor that is continuously honing its TTPs, strengthening its development capabilities, and building a versatile arsenal of tools and malware.


To help prevent potential threats such as the one posed by advanced persistent threat (APT) groups, we suggest that organizations conduct phishing awareness training for their employees and partners to stress the importance of caution when opening emails, particularly those messages from unfamiliar senders or with unknown subjects.


To assist organizations in protecting themselves against sophisticated threats, we recommend adopting a comprehensive security strategy that employs advanced technologies capable of identifying and halting such threats across multiple channels, including endpoints, servers, networks, and email communications.


Indicators of Compromise (IOCs)


The full list of IOCs can be found here.


MITRE ATT&CK Tactic ID Name Resource Development T1583.004 Acquire Infrastructure: Server T1587.001 Develop Capabilities: Malware T1585.002 Establish Accounts: Email Accounts T1588.002 Obtain Capabilities: Tool T1608.001 Stage Capabilities:


Upload Malware Initial Access T1566.002 Phishing: Spearphishing Link Execution T1204.001 User Execution: Malicious Link T1204.002 User Execution: Malicious File Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1574.002 Hijack Execution Flow: DLL Side-Loading T1053.005


Scheduled Task/Job: Scheduled Task Privilege Escalation T1068 Exploitation for Privilege Escalation T1134 Access Token Manipulation Defense Evasion T1140 Deobfuscate/Decode Files or Information T1036.005 Masquerading: Match Legitimate Name or Location Lateral Movement T1091 Replication Through Removable Media Command and Control T1071.001 Application Layer Protocol: Web Protocols T1573.001 Encrypted Channel:


Symmetric Cryptography T1104 Multi-Stage Channels T1095 Non-Application Layer Protocol Exfiltration T1048 Exfiltration Over Alternative Protocol Authors Vickie Su Threats Analyst Nick Dai Sr. Threat Researcher Sunny Lu Threats Analyst


In part 1 of this series, we warmed up and aligned with basic computing terminologies.

Malware Reverse Engineering for Beginners  Part 2


We learned the basics of assembly and how to use disassemblers.


All of these tools and techniques are very important for reversing malware samples.


Different sorts of malware have different capabilities and implementations.


As reverse engineers, we need to be familiar with them and be able to identify and understand them.


Often, malware targeting Windows will be packed and delivered as a second stage.


There are different ways to “deliver” malware to the endpoint.


This blog will cover key concepts and examples regarding how malware is packed, obfuscated, delivered, and executed on the endpoint.


Here’s what we’ll cover: Basic terms that explain how malware is delivered to endpoints.


A deep dive on packers – what they are, how they work and how to identify packed samples.


Following the technical information, we will demonstrate two hands-on analyses of packed malware.


Basic Terminology for Reverse Engineers to Know An executable file can conceal its true code through either encryption or compression.


When the file is executed, some initial code usually called a stub, decrypts or decompresses the real code so it can be executed.


These tools, that we will describe in this section, can be used by legitimate vendors that want to protect their software from piracy and copyright violations but threat actors also use these tools to evade detection and make the reversing engineering and analysis process harder.


Now, let’s look at these four tools: a packer, crypter, protector, and a loader.


What’s a Packer? Packers are often used to compress the payload so it will take less space on disk.


While packers can be used for legitimate purposes, malware developers utilize packers to make the malicious payload smaller and avoid detection based on static malware analysis techniques.


Examples: UPX is an open-source packing algorithm.


MPRESS is a free packer.


Andromeda is a custom packer that makes reverse-engineering more difficult.


What’s a Crypter?


Some security tools use signatures or keywords to detect malware.


To avoid detection by these tools, malware developers can use crypters.


A crypter encrypts the payload, so it will be harder for signature-based and standard anti-viruses to detect the malicious payload.


Examples: PEUNION EXECryptor What’s a Protector?


For most threat actors, one of the goals they want to achieve is to evade detection, and if the malware is detected then make the analysis process harder for researchers.


That’s where protectors come into the picture – they offer many features that can make static and dynamic analysis tedious and time-consuming.


Having said that, legitimate organizations can use protectors to protect their software from being cracked and manipulated.


Usually, protectors will encrypt the payload, remove and obfuscate imports, implement anti-debugging and anti-reversing techniques, and much more. Examples: Themida Enigma Protector VMProtect What’s a Loader?


Packed malware samples are compressed and stored inside the final executable, which will extract and execute the malware.


On the other hand, there are loaders that serve as the first stage of the attack, the payload of the malware can be part of the loader’s file or it can be downloaded from a remote location (by the loader, also known as a Downloader).


In addition, loaders can be used to set persistence and additional components needed for the execution of the malware.


For example, Bazarloader is a sophisticated loader with multiple techniques that is used in attacks against high-profile organizations.


Bazarloader delivers all sorts of threats, from spam to ransomware like Conti or Ryuk.


In many cases, malware is delivered by tools that implement some (or all) of the functionalities of packers, crypters, protects, and loaders –- all to make the analysis harder.


For example, Morphine has its loader and can encrypt the original file.


Deep Dive Into How Packers Work and Detection


Now let’s focus on packers, how they work, how to identify packed files, and how to extract the packed payload that can contain malicious code.


How do packers work?


The packed file contains three main components: packed content, a new PE header, and a stub, as seen in the image below: Packed sample view.


The packers compress (and if it has the functionality of a crypter also encrypts) the original executable, which is saved in one of the sections of the final packed file.


The entry point of the original file is relocated, and so is the Import Address Table (IAT).


The stub is a small part of code that implements the decompression (and decryption) of the originally packed file.


A new PE header is prepended to the packed file or modifies the existing header so it will be a valid executable.


How to detect packed files 1.


Static detection When data is being compressed or encrypted, the output is not structured and resembles more random data, resulting in high entropy.


In information theory, entropy is a measure of disorder/randomness.


The calculation is done using logarithm with base 2, also known as Shannon entropy, the result is in units of bits, hence the range of entropy level for binary files is 0 to 8.


We can check the entropy of the file sections, and if one of them has a value of 7 or higher, there is a high probability that the file is packed.


Packers may change the final payload’s section names, as seen in the screenshot below.


But in most cases, malware authors will rename the sections to more commonly used names that will not give away the fact that the file is packed.


Multiple tools can be used to detect indicators of a sample being packed: PEstudio, DiE (Detect it Easy), CFF explorer, and more.


There are many examples and tutorials that use these tools, so we will show another free tool that can be handy in this and later stages: radare2.


Viewing the section of a file (see technical analysis on this packer here).


Packed samples usually have very few imports as they don’t rely on external libraries like other programs.


When a file has a low number of imports, it strongly indicates that it contains another component that is dropped/loaded.


However, malware developers can add “dummy” imports to mislead researchers.


Viewing the imports for a packed file; full analysis results here.


Reverse Engineering Example: Static Unpacking of UPX Packed Samples


Standard UPX packed samples can be identified by the section names, as long as they were not modified by the attackers.


Let’s take a look at a sample with MD5 5598febfbf00839c9f7047d9fe3205e3.


The section names of the files contain the UPX string, as seen in the screenshot below: We can use the UPX command line utility to extract the packed payload.


The command to decompress a packed file is as follows: upx -d <packed>


-o <extracted payload>


You can run the command on the sample and verify that the extracted file has MD5 6d13f5d287fd735a9bbc261aafb49006.


Dynamic detection When we dynamically analyze a packed file, we aim to extract the payload.


Several functions can be a good place for putting a breakpoint and attempting to fetch the extraction process.


Let’s look at API calls and debuggers.


API Calls Essentially, all packers need to perform the following operations: allocate memory, change permissions, read the encrypted/packed chunk of code, decrypt it, load it to the allocated memory space and execute it.


To make all of these actions, the program must use system calls because these actions require interaction with the kernel.


The relevant system calls are VirtualAlloc used for allocating memory in the current process.


The memory is automatically initialized to zero.


One of the arguments is dwSize – that’s the size in bytes.


Knowing the size can help identify when a program allocates big memory space, possibly for the unpacked payload.


VirtualProtect changes the permissions of the given virtual address.


When malware wants to grant write or execute permissions flNewProtect argument will be set to PAGE_EXECUTE_READWRITE (0x40) or PAGE_EXECUTE_READ (0x20).


RtlDecompressBuffer decompresses the provided buffer.


CreateProcessInternalW creates a new process.


In the context of malware execution, it can create a new threat with the malicious unpacked payload.


We can look for these system calls in the list of imported functions.


However, malware authors usually try to hide these system calls.


For instance, we will not see them in the imported function list, and they not even be part of the strings in the sample.


In this case, the function and the corresponding library are dynamically loaded at runtime – also known as explicit linking.


In this case, dynamic debugging can be very helpful – debuggers like x64dbg let you put a breakpoint on function calls, even if the function is not imported.


The breakpoint will be triggered if the system call is executed.


Debugger A debugger is a powerful tool that allows developers and researchers to follow and control the execution of a program.


When debugging an executable, you can view the registers, stack, and memory and see how each instruction affects the stored data.


Debugging malware can reveal code executed only in runtime (meaning that you will not see it in standard static analysis).


Debuggers also allow you to see how strings and payloads are deobfuscated and constructed – making it easier to find the interesting patterns of the malware.


Different debuggers can be used to debug Windows executables and DLLs: OllyDbg – not maintained anymore Windbg – powerful kernel-mode and user-mode debugger created by Microsoft.


x64dbg – reliable and user-friendly.


For 32-bit executables, it’s x32dbg.


The main difference between these debuggers is the implementation, which may result in certain behaviors, but for the most part, it’s up to you to choose which debugger you prefer.


There are more tools for debugging (and analyzing) .NET


executables and other Windows executables, but that’s not covered in this blog.


Reverse Engineering Example:


Extracting Packed Locky Payload In this section, we will present a guide on extracting packed malware from 2 popular malware:


CobaltStrike and Locky.


Make sure to run (and debug) the following examples in an isolated Windows virtual machine.


You can watch the video of the hands-on unpacking process of Cobalt Strike.


The video shows generation of a Cobalt Strike payload, analysis of the assembly, dynamic execution of the stager to fetch payload, scanning the endpoint for in memory genetic analysis, and parsing the Beacon configuration.


The analysis of the Locky ransomware is covered in the section below.


Reverse engineering tools that will be used in these analyses:


Windows virtual machine x32 debugger Radare2 Command line commands: file, strings, shasum


In this example, we will inspect a packed sample of Locky ransomware.


While Intezer automatically identifies that the file is packed and extracts the payload for us, we will show how you can manually extract the payload here.


Static analysis First, we will check the entropy of the section (as we did in the previous example).


We will use radare2.


As seen in the screenshot below, the .rdata section has an entropy level higher than 7, and it’s very unusual for this section to have randomized data.


We can run the strings command on the sample.


The output contains lots of strings that look like a random collection of characters.


At this point, we can assume that the sample is packed, so we will move to dynamic analysis using the x32dbg debugger.


Dynamic analysis We will use the API calls we covered in the previous section.


Put breakpoints on VirtualAlloc and VirtualProtect.


bp VirtualAlloc bp VirtualProtect Now, let’s run the file.


It will first stop at the entrypoint, we will hit F9 (continue until next breakpoint – BP), and we will get to the first call to VirtualAlloc.


As seen in the screenshot below, the BP stopped on the call to VirtualAlloc, which is in the Kernel32.dll, and in the stack view (right low corner) we can see the arguments passed to the function.


We can see that the required allocated space is relatively small, so it’s probably not called by the unpacking routine.


So we will continue running the program – hit F9 again.


It might take a few more hits on the call to VirtualAlloc before we get to a call with the size 0xF41D.


At this point, we want to see where VirtualAlloc was called and what will be stored in the allocated spaces.


So, as shown below, we will ask x32dbg to run to user mode.


We will get to the instruction “ret 10” at this point.


We need to grab the value stored in EAX, which stores the return value of VirtualAlloc.


In my case, EAX is 0x240000.


We will hit right-click and follow in the dump.


The memory is zeroed out


but if we follow the execution of the code (hitting F8 several times), we will see that the memory contains some values, but they look random.


We can continue running the program until the next hit on the VirtualAlloc call.


Continue running the program until VirtualAlloc is called with the size: 0x17400 – which is even bigger than the previously allocated buffer.


Then again, hit “run to user code,” or “execute till return” and follow EAX in the dump and step through the use code until you see the allocated memory filled with data that looks like this: The dump contains the unpacked executable – we can identify it by the 0x4D5A (MZ) magic.


In the memory map, right-click the section and hit “Dump memory to file.”


The MD5 of the extracted payload is e96dad009437ca774035ffd73708bd3e.


We can see in Intezer that, indeed, it’s


Locky ransomware malware.


Mazal tov!


You have successfully extracted the Locky payload.


Automating Unpacking for Every File Learning the foundations of reverse engineering is important if it is a skill that you are trying to develop in your career.


But for many security teams, even at large companies, you may not have the time to manually unpack and reverse engineer files on a regular basis.


If you have automated tools that can unpack files and conduct reverse engineering-level analysis, those can ensure that you’re using your time efficiently to focus on threats that require your attention.


Since reverse engineering can be time intensive, you’ll want to only use manual methods for tasks like unpacking after you’ve exhausted your other tools and options.


Don’t have the time or skills for reverse engineering the volume of packed and obfuscated files your SOC team handles?


Intezer’s automated alert triage and response process collects files from your endpoint security solution (like CrowdStrike, Microsoft Defender, or SentinelOne) to identify packed files, extract the payload, and then respond autonomously or with the results Intezer provides for remediation.


To see how Intezer handles reverse engineering tasks for every alert, book a demo here.


The post Malware Reverse Engineering for Beginners – Part 2 appeared first on Intezer.


Original release date: December 1, 2020SummaryThis Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK:registered:) framework.

AA20336A Advanced Persistent Threat Actors Targeting US Think Tanks


See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.


The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have observed persistent continued cyber intrusions by advanced persistent threat (APT) actors targeting U.S. think tanks.


This malicious activity is often, but not exclusively, directed at individuals and organizations that focus on international affairs or national security policy.[1]


The following guidance may assist U.S. think tanks in developing network defense procedures to prevent or rapidly detect these attacks.


APT actors have relied on multiple avenues for initial access.


These have included low-effort capabilities such as spearphishing emails and third-party message services directed at both corporate and personal accounts, as well as exploiting vulnerable web-facing devices and remote connection capabilities.


Increased telework during the COVID-19 pandemic has expanded workforce reliance on remote connectivity, affording malicious actors more opportunities to exploit those connections and to blend in with increased traffic.


Attackers may leverage virtual private networks (VPNs) and other remote work tools to gain initial access or persistence on a victim’s network.


When successful, these low-effort, high-reward approaches allow threat actors to steal sensitive information, acquire user credentials, and gain persistent access to victim networks.


Given the importance that think tanks can have in shaping U.S. policy, CISA and FBI urge individuals and organizations in the international affairs and national security sectors to immediately adopt a heightened state of awareness and implement the critical steps listed in the Mitigations section of this Advisory.


Technical DetailsATT&CK Profile CISA created the following MITRE ATT&CK profile to provide a non-exhaustive list of tactics, techniques, and procedures (TTPs) employed by APT actors to break through think tanks’ defenses, conduct reconnaissance in their environments, exfiltrate proprietary or confidential information, and execute effects on targets.


These TTPs were included based upon closed reporting on APT actors that are known to target think tanks or based upon CISA incident response data.


Initial Access [TA0001] Valid Accounts [T1078] Valid Accounts: Cloud Accounts


[T1078.004] External Remote Services [T1133] Drive-by Compromise [T1189] Exploit Public-Facing Application [T1190] Supply Chain Compromise: Compromise Software Supply Chain


[T1195.002] Trusted Relationship [T1199] Phishing:


Spearphishing Attachment [T1566.001] Phishing:


Spearphishing Link [T1566.002] Phishing: Spearphishing via Service [T1566.003] Execution [TA0002] Windows Management Instrumentation


[T1047] Scheduled Task/Job: Scheduled Task


[T1053.005] Command and Scripting Interpreter:


PowerShell


Windows Command Shell [T1059.003] Command and Scripting Interpreter:


Unix Shell [T1059.004] Command and Scripting Interpreter:


Visual Basic [T1059.005] Command and Scripting Interpreter:


Python


[T1059.006] Native API [T1106] Exploitation for Client Execution [T1203] User Execution: Malicious Link [T1204.001] User Execution: Malicious File [T1204.002] Inter-Process Communication: Dynamic Data Exchange


[T1559.002] System Services:


Service Execution [T1569.002] Persistence [TA0003] Boot or Logon Initialization Scripts: Logon Script (Windows)


[T1037.001] Scheduled Task/Job: Scheduled Task


[T1053.005] Account Manipulation:


Exchange Email Delegate Permissions [T1098.002] Create Account: Local Account [T1136.001] Office Application Startup: Office Test [T1137.002] Office Application Startup:


Outlook Home Page [T1137.004] Browser Extensions [T1176] BITS Jobs


[T1197] Server Software Component: Web Shell [T1505.003] Pre-OS Boot:


Bootkit [T1542.003] Create or Modify System Process:


Windows Service [T1543.003] Event Triggered Execution: Change Default File Association


[T1546.001] Event Triggered Execution: Windows Management Instrumentation Event Subscription


[T1546.003] Event Triggered Execution: Accessibility Features


[T1546.008] Event Triggered Execution:


Component Object Model Hijacking


[T1546.015] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder


[T1547.001] Boot or Logon Autostart Execution: Shortcut Modification


[T1547.009] Privilege Escalation [TA0004] Process Injection [T1055] Process Injection: Process Hollowing


[T1055.012] Exploitation for Privilege Escalation


[T1068] Access Token Manipulation:


Token Impersonation/Theft


[T1134.001] Event Triggered Execution: Accessibility Features


[T1546.008] Boot or Logon Autostart Execution: Shortcut Modification


[T1547.009] Abuse Elevation Control Mechanism: Bypass User Access Control


[T1548.002] Hijack Execution Flow: DLL Side-Loading [T1574.002] Defense Evasion


[TA0005] Rootkit [T1014] Obfuscated Files or Information:


Binary Padding [T1027.001] Obfuscated Files or Information: Software Packing [T1027.002] Obfuscated Files or Information:


Steganography


[T1027.003] Obfuscated Files or Information: Indicator Removal from Tools [T1027.005] Masquerading: Match Legitimate Name or Location


[T1036.005] Indicator Removal on Host: Clear Windows Event Logs


[T1070.001] Indicator Removal on Host: Clear Command History [1070.003] Indicator Removal on Host: File Deletion


[T1070.004] Indicator Removal on Host:


Timestomp [T1070.006] Modify Registry


[T1112] Deobfuscate/Decode Files or Information [T1140] Exploitation for Defense Evasion


[T1211] Signed Binary Proxy Execution: Compiled HTML File [T1218.001] Signed Binary Proxy Execution:


Mshta [T1218.005] Signed Binary Proxy Execution: Rundll32


[T1218.011] Template Injection [T1221] Execution Guardrails: Environmental Keying [T1480.001] Abuse Elevation Control Mechanism: Bypass User Access Control


[T1548.002] Use Alternate Authentication Material: Application Access Token


[T1550.001] Subvert Trust Controls: Code Signing [T1553.002] Impair Defenses:


Disable or Modify Tools [T1562.001] Impair Defenses: Disable or Modify System Firewall [T1562.004] Hide Artifacts: Hidden Files and Directories


[T1564.001] Hide Artifacts:


Hidden Window


[T1564.003] Credential Access


[TA0006] OS Credential Dumping: LSASS Memory [T1003.001] OS Credential Dumping: Security Account Manager [T1003.002] OS Credential Dumping: NTDS


[T1003.003] OS Credential Dumping: LSA Secrets [T1003.004] OS Credential Dumping: Cached Domain Credentials [T1003.005]


Network Sniffing [T1040] Input Capture:


Keylogging [T1056.001] Brute Force: Password Cracking


[T1110.002]Brute Force: Password


Spraying [T1110.003] Forced Authentication [T1187] Steal Application Access


Token


[T1528] Unsecured Credentials: Credentials in Files [T1552.001] Unsecured Credentials: Group Policy Preferences [T1552.006] Credentials from Password Stores: Credentials from Web Browsers


[T1555.003] Discovery [TA0007] System Service Discovery


[T1007] Query Registry


[T1012] System Network Configuration Discovery [T1016] Remote System Discovery [T1018] System Owner/User Discovery [T1033] Network Sniffing [T1040] Network Service Scanning [T1046] System Network Connections Discovery [T1049] Process Discovery


[T1057] Permission Groups Discovery: Local Groups [T1069.001] Permission Groups Discovery:


Domain Groups [T1069.002] System Information Discovery [T1082] File and Directory Discovery [T1083] Account Discovery: Local Account [T1087.001] Account Discovery:


Domain Account


[T1087.002] Peripheral Device Discovery [T1120] Network Share Discovery [T1135] Password Policy Discovery [T1201] Software Discovery: Security Software Discovery [T1518.001] Lateral Movement


[TA0008] Remote Services:


Remote Desktop Protocol


[T1021.001] Remote Services: SSH [T1021.004] Taint Shared Content [T1080] Replication Through


Removable Media


[T1091] Exploitation of Remote Services [T1210] Use Alternate Authentication Material:


Pass the Hash


[T1550.002] Use Alternate Authentication Material:


Pass the Ticket [T1550.003] Collection


[TA0009] Data from Local System [T1005] Data from Removable Media


[T1025] Data Staged: Local Data Staging [T1074.001] Screen Capture [T1113] Email Collection:


Local Email Collection


[T1114.001] Email Collection:


Remote Email Collection


[T1114.002] Automated Collection [T1119] Audio Capture [T1123] Data from Information Repositories: SharePoint [T1213.002] Archive Collected Data: Archive via Utility [T1560.001] Archive Collected Data: Archive via Custom Method [T1560.003] Command and Control [TA0011] Data Obfuscation: Junk Data [T1001.001] Fallback Channels


[T1008] Application Layer Protocol: Web Protocols [T1071.001] Application Layer Protocol:


File Transfer Protocols


[T1071.002] Application Layer Protocol: Mail Protocols [T1071.003] Application Layer Protocol:


DNS [T1071.004] Proxy: External Proxy [T1090.002] Proxy: Multi-hop


Proxy [T1090.003] Proxy: Domain Fronting [T1090.004] Communication Through Removable Media


[T1092] Non-Application Layer Protocol


[T1095] Web Service: Dead Drop Resolver [T1102.001] Web Service:


Bidirectional Communication [T1102.002] Multi-Stage Channels [T1104] Ingress Tool Transfer [T1105] Data Encoding: Standard Encoding [T1132.001] Remote Access Software [T1219] Dynamic Resolution: Domain Generation Algorithms


[T1568.002] Non-Standard Port [T1571] Protocol Tunneling [T1572] Encrypted Channel:


Symmetric Cryptography [T1573.001] Encrypted Channel:


Asymmetric Cryptography


[T1573.002] Exfiltration [TA0010] Exfiltration Over C2 Channel [T1041] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol


[T1048.003] Impact [TA0040] Data Encrypted for Impact [T1486] Resource Hijacking [T1496] System Shutdown/Reboot [T1529] Disk Wipe: Disk Structure Wipe


[T1561.002] MitigationsCISA and FBI recommend think tank organizations apply the following critical practices to strengthen their security posture.


Leaders Implement a training program to familiarize users with identifying social engineering techniques and phishing emails.


Users/Staff Log off remote connections when not in use.


Be vigilant against tailored spearphishing attacks targeting corporate and personal accounts (including both email and social media accounts).


Use different passwords for corporate and personal accounts.


Install antivirus software on personal devices to automatically scan and quarantine suspicious files.


Employ strong multi-factor authentication for personal accounts, if available.


Exercise caution when: Opening email attachments, even if the attachment is expected and the sender appears to be known.


See Using Caution with Email Attachments.


Using removable media (e.g., USB thumb drives, external drives, CDs).


IT Staff/Cybersecurity Personnel Segment and segregate networks and functions.


Change the default username and password of applications and appliances.


Employ strong multi-factor authentication for corporate accounts.


Deploy antivirus software on organizational devices to automatically scan and quarantine suspicious files.


Apply encryption to data at rest and data in transit.


Use email security appliances to scan and remove malicious email attachments or links. Monitor key internal security tools and identify anomalous behavior.


Flag any known indicators of compromise or threat actor behaviors for immediate response.


Organizations can implement mitigations of varying complexity and restrictiveness to reduce the risk posed by threat actors who use Tor (The Onion Router) to carry out malicious activities.


See the CISA-FBI Joint Cybersecurity Advisory on Defending Against Malicious Cyber Activity Originating from Tor for mitigation options and additional information.


Prevent exploitation of known software vulnerabilities by routinely applying software patches and upgrades.


Foreign cyber threat actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations.


If these vulnerabilities are left unpatched, exploitation often requires few resources and provides threat actors with easy access to victim networks.


Review CISA and FBI’s Top 10 Routinely Exploited Vulnerabilities and other CISA alerts that identify vulnerabilities exploited by foreign attackers.


Implement an antivirus program and a formalized patch management process.


Block certain websites and email attachments commonly associated with malware (e.g., .scr, .pif, .cpl, .dll, .exe).


Block email attachments that cannot be scanned by antivirus software (e.g., .zip files).


Implement Group Policy Object and firewall rules.


Implement filters at the email gateway and block suspicious IP addresses at the firewall.


Routinely audit domain and local accounts as well as their permission levels to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.


Follow best practices for design and administration of the network to limit privileged account use across administrative tiers.


Implement a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system.


Disable or block unnecessary remote services.


Limit access to remote services through centrally managed concentrators.


Deny direct remote access to internal systems or resources by using network proxies, gateways, and firewalls.


Limit unnecessary lateral communications.


Disable file and printer sharing services.


If these services are required, use strong passwords or Active Directory authentication.


Ensure applications do not store sensitive data or credentials insecurely.


Enable a firewall on agency workstations, configured to deny unsolicited connection requests.


Disable unnecessary services on agency workstations and servers.


Scan for and remove suspicious email attachments; ensure any scanned attachment is its "true file type" (i.e., the extension matches the file header).


Monitor users' web browsing habits; restrict access to suspicious or risky sites.


Contact law enforcement or CISA immediately regarding any unauthorized network access identified.


Visit the MITRE ATT&CK techniques and tactics pages linked in the ATT&CK Profile section above for additional mitigation and detection strategies for this malicious activity targeting think tanks.


Contact InformationRecipients of this report are encouraged to contribute any additional information that they may have related to this threat.


To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at CyWatch@fbi.gov.


To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.gov. References CISA Alert: Microsoft Office 365 Security Recommendations CISA Alert: Technical Approaches to Uncovering and Remediating Malicious Activity CISA


Webpage: Telework Guidance CISA Webpage: VPN-Related Guidance FBI Private Industry Notification: PIN 20200409-001 References [1] CyberScoop:


As Europe prepares to vote, Microsoft warns of Fancy Bear attacks on democratic think tanks Revisions Initial Version: December 1, 2020


RedLine Stealer is a malware strain designed to steal sensitive information from compromised systems.

Do Not Cross The RedLine Stealer Detections and Analysis


It is typically distributed through phishing emails, social engineering tactics, and malicious URL links.


Since it was released, threat actors and adversaries have leveraged RedLine Stealer because of its availability and flexibility for stealing credentials that can cause financial loss and data leakage.


In 2020, there was a RedLine campaign that targeted both enterprise and personal devices.


Many industries received these malicious campaigns, but the most impacted was the Healthcare and manufacturing sectors.


Recently this year (May 10, 2023), there was a RedLine campaign found by stormshield that used a malicious chrome extension that will download several malware like Smoke Loader and Amadey Trojan.


Amadey malware is a botnet that is being used now to distribute RedLine malware to steal data such as browser credentials, crypto wallets and even credit card information.


This malicious software has been in the top malware sample shared for months on anyrun statistics reports as well as in Malware bazaar.


In this blog post, the Splunk Threat Research Team provides a deep dive analysis of this threat and valuable insights to enable blue teamers to defend and detect this malware variant.


Blog details include: Analysis of the phishing URLs The RedLine Loader The RedLine Stealer Capabilities Splunk Security Content Spear Phish Link Data The operators behind RedLine Stealer use several techniques to gain initial access to their victims.


One common initial access technique that this Trojan Stealer uses is a phishing URL link.


To gain more insight on how this malware executes its campaign, the Splunk Threat Research Team (STRT) collected 90 days of URL data from URLhaus and used Jupyter Notebooks to analyze the dataset to identify trends of the RedLine URL links.


Figure 1 shows the list of URLs from the data related to RedLine Stealer.


Based on URL tags, we can see that this Trojan is also bundled, downloaded or dropped by other malware like Amadey or SmokeLoader.


Figure 1 Using the URLhaus dataset, we can also learn that RedLine Stealer abuses several known legitimate file/code sharing and collaboration platforms for its campaigns.


Figure 2 shows the top 20 domains that RedLine Stealer used to host its malware.


Based on the list below, the most commonly abused legitimate file sharing domains are GitHub, Dropbox, Discord, Bitbucket, OneDrive and Google Drive.


The use of these legitimate platforms allows threat actors or adversaries to evade detections or to blend in its C2 communication with other normal network traffic so security solutions will not raise any red flags or detection alerts.


Figure 2 In the following section, we explore a recent RedLine Loader used, the defense evasion technique and RedLine Stealer capabilities.


Self Extractor Loader The Splunk Threat Research Team found an interesting RedLine Stealer Loader that was compiled as Win32 Cabinet self extractor executable (wextract) (1) (2).


This self-extracting archive is a type of compressed file that contains multiple files and can be executed as a program.


When a user runs a self-extracting archive, the contents of the archive are extracted to a specified location on the system.


Figure 3 shows a simple flow diagram of how RedLine Stealer uses a loader in the form of a self-extracting archive (.exe) to initiate its infection.


This loader then executes two more self-extracting archive executables that are responsible for decrypting a shellcode to load the Amadey Trojan and two instances of the RedLine Stealer malware onto the system.


Additionally, the loader also executes a .NET executable that is responsible for defense evasion.


Figure 3 (For a larger resolution of this diagram visit this link) Defense Evasion Component As described in Figure 3, the Redline Loader will also load an executable named it532878.exe, which is a .NET executable that is responsible for defense evasion.


Figure 4 shows the code snippet of this RedLine component that will do the following: Escalate its privilege as administrator or trustedinstaller Try to disable Windows Defender service “WinDefend” Try to disable Tamper Protection settings of Windows Defender.


Try to Disable AntiSpyware, Real Time Protection and notification of Windows Defender.


Disable Windows update services such as (“wuauserv”, “WaaSMedicSvc”, “UsoSvc”)


Disable Automatic Update and change Windows configurations related to Windows Update Figure 4 RedLine Stealer Deep Dive C2 Connection Check RedLine Stealer is designed to be stealthy and avoid detection by security software.


Therefore, it typically starts by decrypting its initial configuration data, which is often encoded or encrypted to prevent detection.


It starts its code by decrypting its initial configuration that the malware needs to connect to its Command and Control (C2) server and receive instructions on how to operate.


This includes the domain or IP address of the C2 server, as well as the connection IDs and keys that are used to establish a secure connection.


Figure 5 shows the code of the decryption algorithm used by RedLine Stealer to decrypt its initial configuration data which is a combination of Base64 and XOR functions.


Figure 5 Once the initial configuration data has been decrypted, it will constantly check its bind connection to its C2 server to download further command arguments or other configuration settings that will dictate what functionality will be enabled for its malicious client file.


Figure 6 shows the code of RedLine that consistently checks the connection of its client malware to the C2 server.


If the connection fails, It will break and throw an exception.


If the C2 server is already down or offline during analysis, this piece of code can be considered an anti-sandbox technique because RedLine will not continue its execution.


Figure 6 After establishing a connection to its C2, it will fetch another configuration setting data from its C2 server that will fill the ScanningArg() class, which is a data structure of boolean variables that will serve as a switch to RedLine functionality.


Figure 7 shows the snippet of ScanningArg() class data member of RedLine which accepts either ON or OFF (True or False) values to enable the chosen RedLine settings or functions.


Figure 7 RedLine Capabilities RedLine Stealer has several features that will be executed depending on the configuration setting it downloaded from its C2 to steal information from the compromised or targeted host.


Figure 8 is the screenshot showing several function capabilities of RedLine that we renamed during our analysis.


Figure 8 Gather System Information As stated earlier, RedLine Stealer has the ability to collect or extract various types of system information from a targeted or compromised computer.


The information that this malware can retrieve may be sensitive and can potentially compromise the security and privacy of the affected system.


To provide a more detailed explanation, the table summary below shows each of the functions of the RedLine Stealer malware and describes the specific information that each function attempts to gather.


Function name (renamed) Description func_GetHostSerialNumber() Retrieve the user domain name, username and host serial number (without “-”) and convert it into a MD5 hash func_GetExecutingAssembly() Get the full file path of its running malware sample func_GetLanguageTimeZoneOsVersion() Retrieves system default language, timezone and OS version func_GetUserName() Get the user name of the compromised host func_GetProcessor() Get processor information of the compromised host by executing "SELECT * FROM Win32_Processor" func_GetGraphicCards() Get AdapterRAM and Graphic Card Name and type by executing "root\\CIMV2", "SELECT *


FROM Win32_VideoController" func_GetBrowsers() Parse browser application and browser version installed in the compromised host by querying "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" or "SOFTWARE\Clients\StartMenuInternet" registry func_GetTotalRAM() Get the total RAM size of compromised host by executing "SELECT * FROM Win32_OperatingSystem" and look for "TotalVisibleMemorySize" func_ListPrograms() Parse all installed application in the compromised host by querying 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' registry func_GetFirewalls() Parse firewall and Anti Virus Product install in the compromised host by running "SELECT * FROM ROOT\\SecurityCenter2" "SELECT * FROM ROOT\\SecurityCenter" "SELECT *


FROM AntivirusProduct" "SELECT *


FROM FirewallProduct" "SELECT * FROM AntiSpyWareProduct" func_ListProcesses() Retrieve process list and process information by running 'SELECT *


FROM Win32_Process' func_AvailableLanguage() Get the install input language Screen Capture Based on one of the RedLine samples we analyzed, we saw that it has a functionality to capture a screenshot of the targeted or compromised host as part of its data collection and exfiltration.


In Figure 9 above, the function we’ve renamed as func_ScanScreen() is the one responsible for this screen capture capability.


RedLine uses .NET


Graphics class CopyFromScreen


Function() to transfer a bit block of color data from the screen to the Graphic drawing surface that will be saved in memory stream for data exfiltration.


Figure 9 Cracking Browser Password One of the powerful capabilities of this Trojan Stealer is cracking browser sensitive information like passwords, cookies, autofill and credit card information saved within the browser application.


Figure 10 shows a simple diagram of how RedLine Stealer was able to decrypt the password saved in the chrome browser.


It starts by locating and copying two specific file of Chrome profiles namely as “%userprofile%\Appdata\Local\Google\Chrome\User data\Local State” and “%userprofile%\Appdata\Local\Google\Chrome\User data\Default\Login Data” in the%temp% folder.


Afterward it will read the copied “Local State” file to grab the encoded and encrypted master key to decrypt the password stored in the “Login Data”.


The master key is encoded with Base64 and encrypted using Windows CryptProtectData() API.


Once the master key is decrypted, it will parse the AES IV (Initialization vector) and the encrypted password in the copied “Login Data” database file to decrypt it using AES GCM algorithm.


The decrypted password will be sent to its C2 Server as part of its data exfiltration.


Figure 10 Looking For Browser Extensions


This malware can also steal wallet files by scanning Chrome wallet browser extensions.


Figure 11 shows the RedLine Stealer code and how it enumerates several known Crypto Wallet directories and looks for files related to crypto currencies by looking for files having “wallet” substring on its file name.


Figure 11 The table below shows some of the targeted Chrome browser extensions that RedLine Stealer tries to parse to look for Crypto Wallets.


These extensions are popular among cryptocurrency users and are used to manage and store their cryptocurrency wallets' sensitive information.