To x86": "%windir%\\syswow64\\runonce[.]exe", "Spawn To x64": "%windir%\\sysnative\\runonce[.]exe", "Jitter": 39, "Method 2": "POST", "Port": 443, "Beacon Type": "8 (HTTPS)", "Polling": 62719, "HTTP Method Path 2": "/btn_bg", "Method 1": "GET", "C2 Server": "dimentos[.]com,/FAQ""Spawn To x86": "%windir%\\syswow64\\runonce[.]exe", "Spawn To x64": "%windir%\\sysnative\\runonce[.]exe", "Jitter": 39, "Method 2": "POST", "Port": 443, "Beacon Type": "8 (HTTPS)", "Polling": 62719, "HTTP Method Path 2": "/btn_bg", "Method 1": "GET", "C2 Server": "dimentos[.]com,/bg"Port 80:"Spawn To x86": "%windir%\\syswow64\\runonce[.]exe", "Spawn To x64": "%windir%\\sysnative\\runonce[.]exe", "Jitter": 39, "Method 2": "POST", "Port": 80, "Beacon Type": "0 (HTTP)", "Polling": 62719, "HTTP Method Path 2": "/btn_bg", "Method 1": "GET", "C2 Server": "192[.]99[.]178[.]145,/r-arrow""Spawn To x86": "%windir%\\syswow64\\runonce[.]exe", "Spawn To x64": "%windir%\\sysnative\\runonce[.]exe", "Jitter": 39, "Method 2": "POST", "Port": 80, "Beacon Type": "0 (HTTP)", "Polling": 62719, "HTTP Method Path 2": "/btn_bg", "Method 1": "GET", "C2 Server": "192[.]99[.]178[.]145,/bg" Machine beaconing out to Cobalt Strike using the above profile Persistence An account named “nuuser” was created by one of the Cobalt Strike Beacons.


As these commands were run on a domain controller, it essentially added the account to the Built-in Administrators domain group, granting it administrative privileges in the AD domain.


net user /add /Y


nuuser 7HeC00l3stP@ssw0rd net localgroup administrators nuuser /add


Credential Access LSASS was accessed by an unusual process “runonce.exe” on multiple hosts, including a domain controller.


EventID: 10Description: Process Access SourceImage: “C:\Windows\System32\runonce.exe” TargetImage: “C:\Windows\system32\lsass.exe” SourceImage: C:\Windows\system32\runonce.exe"TargetImage: "C:\Windows\system32\lsass.exe"GrantedAccess: 0x1010CallTrace: "C:\Windows\SYSTEM32\ntdll.dll+9c584|C:\Windows\System32\KERNELBASE.dll+2730e|UNKNOWN(0000028A62BDC798)"


The overpass-the hash technique was used to acquire a valid Kerberos ticket for the administrator user.


Impact About two and a half hours after initial hands on keyboard activity, the Cobalt Strike Beacon processes running across the target systems injected the Conti DLL into memory.


Conti deployments using a DLL seem to have first started showing up in December 2020.


First time that I see #Conti ransomware spread as a DLL :Hash : 5c278c04bb19196dc8559d45b9728b3ba0c1bc5cdd20a766f56248e561c6f5a6 Pdb : A:sourceconti_v3x64Releasecryptor_dll.pdb (cc @GrujaRS @malwrhunterteam )


pic.twitter.com/gH3uCpVMpB— (づ｡◕‿‿◕｡)づ (@Glacius_)


December 8, 2020 Some traces of this particular DLL were found in the memory dump taken from one of the compromised systems.


We were unable to reconstruct the DLL from memory but Maxime Thiebaut (@0xThiebaut) from NVISO helped us out.


The Yara rule, located in the detections section below was made possible due to him reconstructing the DLL.


Thanks Maxime!


Conti scans the network for 445/SMB, looking for machines to encrypt.


Ransom note Which leads you here.


The threat actors asked for 150k and could have been talked down at least ~20%.


Multiple machines within the environment were not usable after being ransomed including a domain controller.


The machines were left like this and you were not able to do anything but press control+alt+delete.


Paying the ransom will not help you here.


Pivots While researching the infrastructure related to this campaign, we found the threat actor revealed further infrastructure.


The domain associated with the Cobalt Strike C2 (dimentos[.]com) has an unredacted Whois record that reveals several other domains also registered by the address pokix19891[@]kindbest[.]com.


You’ll notice the fake address and fake phone number as well.


All the domains were registered on 2021-03-30, and according to public data available in VirusTotal, three of them have been associated with Cobalt Strike infrastructure so far; the domain seen in this intrusion, powelin[.]com and awesents[.]com.


The two other domains (jocinet[.]com, ilimennt[.]com) have subdomains that look like name servers (ns1 and ns2), which were pointed to two of the Cobalt Strike hosting IP’s.


All of this infrastructure was hosted on the VPS provider OVH. IOCs Files b52c0640957e5032b5160578f8cb99f9b066fde4f9431ee6869b2eea67338f28.dll.exe b52c0640957e5032b5160578f8cb99f9b066fde4f9431ee6869b2eea67338f28 icju1.exe e54f38d06a4f11e1b92bb7454e70c949d3e1a4db83894db1ab76e9d64146ee06 rate_x32.dat eb79168391e64160883b1b3839ed4045b4fd40da14d6eec5a93cfa9365503586192145.dll f29bc338e63a62c24c301c04961084013816733dad446a29c20d4413c5c818af9 Network IcedID vaclicinni[.]xyz thulleultinn[.]club oxythuler[.]cyou dictorecovery[.]cyou expertulthima[.]club 68.183.20[.]194:80 159.89.140[.]116:443 83.97.20[.]160:443 Cobalt Strikedimentos[.]com 192.99.178[.]145:80 Proxy38.135.122[.]194:8080 Detections Surricata ET MALWARE Win32/IcedID Requesting Encoded Binary M4 ET MALWARE W32/Photoloader.


Downloader Request Cookie ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers – Potential Second Stage Download ET INFO Packed Executable Download ET POLICY OpenSSL Demo CA – Internet Widgits Pty ATTACK


[PTsecurity] Overpass the hash.


Encryption downgrade activity to ARCFOUR-HMAC-MD5 ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection ET SCAN Behavioral Unusual Port 1434 traffic Potential Scan or Infection ET SCAN Behavioral Unusual Port 1435 traffic Potential Scan or Infection Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_commands_recon_activity.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_defender_disabled.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_tool_psexec.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_in_memory_assembly_execution.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_net_user_add.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_psexesvc_start.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_psexec_eula.yml Sigma Rule Converter for SIEMs and EDRs: https://uncoder.io/ YARA /*YARA Rule SetAuthor:


The DFIR ReportDate: 2021-05-09Identifier: 3584Reference: https://thedfirreport.com*//*


*/import "pe"rule icedid_rate_x32 {meta:description = "files - file rate_x32.dat"author = "The DFIR Report"reference = "https://thedfirreport.com"date = "2021-05-09"hash1 = "eb79168391e64160883b1b3839ed4045b4fd40da14d6eec5a93cfa9365503586"strings:$s1 = "UAWAVAUATVWSH" fullword ascii$s2 = "UAWAVVWSPH" fullword ascii$s3 = "AWAVAUATVWUSH" fullword ascii$s4 = "update" fullword ascii /*


Goodware String - occured 207 times */$s5 = "?klopW@@YAHXZ" fullword ascii$s6 = "?jutre@@YAHXZ" fullword ascii$s7 = "PluginInit" fullword ascii$s8 = "[]_^A\\A]A^A_"


fullword ascii$s9 = "e8[_^A\\A]A^A_]" fullword ascii$s10 = "[_^A\\A]A^A_]" fullword ascii$s11 = "Kts=R,4iu" fullword ascii$s12 = "mqr55c" fullword ascii$s13 = "R,4i=Bj" fullword ascii$s14 = "Ktw=R,4iu" fullword ascii$s15 = "Ktu=R,4iu" fullword ascii$s16 = "Kt{=R,4iu" fullword ascii$s17 = "KVL.Mp" fullword ascii$s18 = "Kt|=R,4iu" fullword ascii$s19 = "=8c[Vt8=" fullword ascii$s20 = "Ktx=R,4iu" fullword asciicondition:uint16(0) == 0x5a4d and filesize < 700KB and( pe.imphash() == "15787e97e92f1f138de37f6f972eb43c" and ( pe.exports("?jutre@@YAHXZ") and pe.exports("?klopW@@YAHXZ") and pe.exports("PluginInit") and pe.exports("update") ) or 8 of them )}rule conti_cobaltstrike_192145 {meta:description = "files - file 192145.dll"author = "The DFIR Report"reference = "https://thedfirreport.com"date = "2021-05-09"hash1 = "29bc338e63a62c24c301c04961084013816733dad446a29c20d4413c5c818af9"strings:$x1 = "cmd.exe /c


echo


NGAtoDgLpvgJwPLEPFdj>\"%s\"&exit" fullword ascii$s2 = "veniamatquiest90.dll" fullword ascii$s3 = "Quaerat magni assumenda nihil architecto labore ullam autem unde temporibus mollitia illum" fullword ascii$s4 = "Quaerat tempora culpa provident" fullword ascii$s5 = "Velit consequuntur quisquam tempora error" fullword ascii$s6 = "Quo omnis repellat ut expedita temporibus eius fuga error" fullword ascii$s7 = "Dolores ullam tempora error distinctio ut natus facere quibusdam" fullword ascii$s8 = "Corporis minima omnis qui est temporibus sint quo error magnam" fullword ascii$s9 = "Officia sit maiores deserunt nobis tempora deleniti aut et quidem fugit" fullword ascii$s10 = "Rerum tenetur sapiente est tempora qui deserunt" fullword ascii$s11 = "Sed nulla quaerat porro error excepturi" fullword ascii$s12 = "Aut tempore quo cumque dicta ut quia in" fullword ascii$s13 = "Doloribus commodi repudiandae voluptates consequuntur neque tempora ut neque nemo ad ut" fullword ascii$s14 = "Tempore possimus aperiam nam mollitia illum hic at ut doloremque" fullword ascii$s15 = "Dolorum eum ipsum tempora non et" fullword ascii$s16 = "Quas alias illum laborum tempora sit est rerum temporibus dicta et" fullword ascii$s17 = "Et quia aut temporibus enim repellat dolores totam recusandae repudiandae" fullword ascii$s18 = "Sed velit ipsa et dolor tempore sunt nostrum" fullword ascii$s19 = "Veniam voluptatem aliquam et eaque tempore tenetur possimus" fullword ascii$s20 = "Possimus suscipit placeat dolor quia tempora voluptas qui fugiat et accusantium" fullword asciicondition:uint16(0) == 0x5a4d and filesize < 2000KB and( pe.imphash() == "5cf3cdfe8585c01d2673249153057181" and pe.exports("StartW") or ( 1 of ($x*) or 4 of them ) )}rule conti_cobaltstrike_icju1


{meta:description = "files - file icju1.exe"author = "The DFIR Report"reference = "https://thedfirreport.com"date = "2021-05-09"hash1 = "e54f38d06a4f11e1b92bb7454e70c949d3e1a4db83894db1ab76e9d64146ee06"strings:$x1 = "cmd.exe /c


echo NGAtoDgLpvgJwPLEPFdj>\"%s\"&exit" fullword ascii$s2 = "veniamatquiest90.dll" fullword ascii$s3 = "Quaerat magni assumenda nihil architecto labore ullam autem unde temporibus mollitia illum" fullword ascii$s4 = "Quaerat tempora culpa provident" fullword ascii$s5 = "Velit consequuntur quisquam tempora error" fullword ascii$s6 = "Quo omnis repellat ut expedita temporibus eius fuga error" fullword ascii$s7 = "Dolores ullam tempora error distinctio ut natus facere quibusdam" fullword ascii$s8 = "Corporis minima omnis qui est temporibus sint quo error magnam" fullword ascii$s9 = "Officia sit maiores deserunt nobis tempora deleniti aut et quidem fugit" fullword ascii$s10 = "Rerum tenetur sapiente est tempora qui deserunt" fullword ascii$s11 = "Sed nulla quaerat porro error excepturi" fullword ascii$s12 = "Aut tempore quo cumque dicta ut quia in" fullword ascii$s13 = "Doloribus commodi repudiandae voluptates consequuntur neque tempora ut neque nemo ad ut" fullword ascii$s14 = "Tempore possimus aperiam nam mollitia illum hic at ut doloremque" fullword ascii$s15 = "Dolorum eum ipsum tempora non et" fullword ascii$s16 = "Quas alias illum laborum tempora sit est rerum temporibus dicta et" fullword ascii$s17 = "Et quia aut temporibus enim repellat dolores totam recusandae repudiandae" fullword ascii$s18 = "Sed velit ipsa et dolor tempore sunt nostrum" fullword ascii$s19 = "Veniam voluptatem aliquam et eaque tempore tenetur possimus" fullword ascii$s20 = "Possimus suscipit placeat dolor quia tempora voluptas qui fugiat et accusantium" fullword asciicondition:uint16(0) == 0x5a4d and filesize < 2000KB and( pe.imphash() == "a6d9b7f182ef1cfe180f692d89ecc759" or ( 1 of ($x*) or 4 of them ) )}rule conti_v3 {meta:description = "conti_yara - file conti_v3.dll" author = "pigerlin" reference = "https://thedfirreport.com" date = "2021-05-09" hash1 = "8391dc3e087a5cecba74a638d50b771915831340ae3e027f0bb8217ad7ba4682"strings: $s1 = "AppPolicyGetProcessTerminationMethod" fullword ascii $s2 = "conti_v3.dll" fullword ascii $s3 = " <requestedExecutionLevel level='asInvoker' uiAccess='false' />" fullword ascii $s4 = " Type Descriptor'" fullword ascii $s5 = "operator co_await" fullword ascii $s6 = " <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii $s7 = "api-ms-win-appmodel-runtime-l1-1-2" fullword wide $s8 = " Base Class Descriptor at (" fullword ascii $s9 = " Class Hierarchy Descriptor'" fullword ascii $s10 = " Complete Object Locator'" fullword ascii $s11 = " delete[]" fullword ascii $s12 = " </trustInfo>" fullword ascii $s13 = "__swift_1" fullword ascii $s15 = "__swift_2" fullword ascii $s19 = " delete" fullword asciicondition:uint16(0) == 0x5a4d and filesize < 700KB andall of them}rule conti_cobaltstrike_192145_icju1_0 {meta:description = "files - from files 192145.dll, icju1.exe"author = "The DFIR Report"reference = "https://thedfirreport.com"date = "2021-05-09"hash1 = "29bc338e63a62c24c301c04961084013816733dad446a29c20d4413c5c818af9"hash2 = "e54f38d06a4f11e1b92bb7454e70c949d3e1a4db83894db1ab76e9d64146ee06"strings:$x1 = "cmd.exe /c


echo NGAtoDgLpvgJwPLEPFdj>\"%s\"&exit" fullword ascii$s2 = "veniamatquiest90.dll" fullword ascii$s3 = "Quaerat magni assumenda nihil architecto labore ullam autem unde temporibus mollitia illum" fullword ascii$s4 = "Quaerat tempora culpa provident" fullword ascii$s5 = "Dolores ullam tempora error distinctio


ut natus facere quibusdam" fullword ascii$s6 = "Velit consequuntur quisquam tempora error" fullword ascii$s7 = "Corporis minima omnis qui est temporibus sint quo error magnam" fullword ascii$s8 = "Quo omnis repellat ut expedita temporibus eius fuga error" fullword ascii$s9 = "Officia sit maiores deserunt nobis tempora deleniti aut et quidem fugit" fullword ascii$s10 = "Rerum tenetur sapiente est tempora qui deserunt" fullword ascii$s11 = "Sed nulla quaerat porro error excepturi" fullword ascii$s12 = "Aut tempore quo cumque dicta ut quia in" fullword ascii$s13 = "Doloribus commodi repudiandae voluptates consequuntur neque tempora ut neque nemo ad ut" fullword ascii$s14 = "Tempore possimus aperiam nam mollitia illum hic at ut doloremque" fullword ascii$s15 = "Et quia aut temporibus enim repellat dolores totam recusandae repudiandae" fullword ascii$s16 = "Dolorum eum ipsum tempora non et" fullword ascii$s17 = "Quas alias illum laborum tempora sit est rerum temporibus dicta et" fullword ascii$s18 = "Sed velit ipsa et dolor tempore sunt nostrum" fullword ascii$s19 = "Veniam voluptatem aliquam et eaque tempore tenetur possimus" fullword ascii$s20 = "Possimus suscipit placeat dolor quia tempora voluptas qui fugiat et accusantium" fullword asciicondition:( uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) and 4 of them ))


or ( all of them )} MITRE: Command and Scripting Interpreter – T1059External Proxy – T1090.002Remote Desktop Protocol – T1021.001OS Credential Dumping –


T1003Pass the Hash – T1550.002Service Execution – T1569.002SMB/Windows Admin Shares – T1021.002Data Encrypted for Impact – T1486System Owner/User Discovery – T1033Permission Groups Discovery – T1069Application Layer Protocol – T1071Process Injection – T1055Group Policy Modification –


T1484Access Token Manipulation – T1134Create Account – T1136Remote System Discovery – T1018Network Service Scanning – T1046Domain Account – T1087.002Impair Defenses – T1562 Internal case: 3584 The post Conti Ransomware appeared first on The DFIR Report.


Botnet malware operations are a constantly evolving threat to devices and networks.

Microsoft research uncovers new Zerobot capabilities  Microsoft Security Blog


Threat actors target Internet of Things (IoT) devices for recruitment into malicious operations as IoT devices’ configurations often leave them exposed, and the number of internet-connected devices continue to grow.


Recent trends have shown that operators are redeploying malware for a variety of distributions and objectives, modifying existing botnets to scale operations and add as many devices as possible to their infrastructure.


Zerobot, a Go-based botnet that spreads primarily through IoT and web application vulnerabilities, is an example of an evolving threat, with operators continuously adding new exploits and capabilities to the malware.


The Microsoft Defender for IoT research team has been monitoring Zerobot (also called ZeroStresser by its operators) for months.


Zerobot is offered as part of a malware as a service scheme and has been updated several times since Microsoft started to track it.


One domain with links to Zerobot was among several domains associated with DDoS-for-hire services seized by the FBI in December 2022.


Microsoft has previously reported on the evolving threat ecosystem.


The shift toward malware as a service in the cyber economy has industrialized attacks and has made it easier for attackers to purchase and use malware, establish and maintain access to compromised networks, and utilize ready-made tools to perform their attacks.


We have tracked advertisements for the Zerobot botnet on various social media networks in addition to other announcements regarding the sale and maintenance of the malware, as well as new capabilities in development.


In this blog post, we present information about the latest version of the malware, Zerobot 1.1, including newly identified capabilities and further context to Fortinet’s recent analysis on the threat.


Zerobot 1.1 increases its capabilities with the inclusion of new attack methods and new exploits for supported architectures, expanding the malware’s reach to different types of devices.


In addition to these findings, we’re sharing new indicators of compromise (IOCs) and recommendations to help defenders protect devices and networks against this threat.


What is Zerobot? Zerobot affects a variety of devices that include firewall devices, routers, and cameras, adding compromised devices to a distributed denial of service (DDoS) botnet.


Using several modules, the malware can infect vulnerable devices built on diverse architectures and operating systems, find additional devices to infect, achieve persistence, and attack a range of protocols.


Microsoft tracks this activity as DEV-1061.


The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities.


Microsoft uses DEV-#### designations as a temporary name given to an unknown, emerging, or developing cluster of threat activity, allowing Microsoft to track it as a unique set of information until we can reach high confidence about the origin or identity of the actor behind the activity.


Once it meets defined criteria, a DEV group is converted to a named actor.


How Zerobot gains and maintains device access IoT devices are often internet-exposed, leaving unpatched and improperly secured devices vulnerable to exploitation by threat actors.


Zerobot is capable of propagating through brute force attacks on vulnerable devices with insecure configurations that use default or weak credentials.


The malware may attempt to gain device access by using a combination of eight common usernames and 130 passwords for IoT devices over SSH and telnet on ports 23 and 2323 to spread to devices.


Microsoft researchers identified numerous SSH and telnet connection attempts on default ports 22 and 23, as well as attempts to open ports and connect to them by port-knocking on ports 80, 8080, 8888, and 2323.


In addition to brute force attempts on devices, Zerobot exploits dozens of vulnerabilities, which malware operators add on a rolling basis to gain access and inject malicious payloads.


Zerobot 1.1 includes several new vulnerabilities, such as: VulnerabilityAffected softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.


Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.


Microsoft researchers have also found new evidence that Zerobot propagates by compromising devices with known vulnerabilities that are not included in the malware binary, such as CVE-2022-30023, a command injection vulnerability in Tenda GPON AC1200 routers.


Upon gaining device access, Zerobot injects a malicious payload, which may be a generic script called zero.sh that downloads and attempts to execute Zerobot, or a script that downloads the Zerobot binary of a specific architecture.


The bash script that attempts to download different Zerobot binaries tries to identify the architecture by brute-force, attempting to download and execute binaries of various architectures until it succeeds, as IoT devices are based on many computer processing units (CPUs).


Microsoft has observed scripts targeting various architectures including ARM64, MIPS, and x86_64.


Depending on the operating system of the device, the malware has different persistence mechanisms.


Persistence tactics are used by malware operators to obtain and maintain access to devices.


While Zerobot is unable to spread to Windows machines, we have found several samples that can run on Windows.


On Windows machines, the malware copies itself to the Startup folder with the file name FireWall.exe


(older versions use my.exe).


Microsoft Defender for Endpoint detects this malware and related malicious activity on both Windows and Linux devices.


See detection details below.


To achieve persistence on Linux-based devices, Zerobot uses a combination of desktop entry, daemon, and service methods: Desktop entry: Zerobot copies itself to $HOME/.config/ssh.service/sshf then writes a desktop entry file called sshf.desktop to the same directory.


Older Linux versions use $HOME/.config/autostart instead of $HOME/.config/ssh.service.


Daemon: Copies itself to /usr/bin/sshf and writes a configuration at /etc/init/sshf.conf.


Service: Copies itself to /etc/sshf and writes a service configuration at /lib/system/system/sshf.service, then enables the service (to make sure it starts at boot) with two commands: systemctl enable sshf service enable sshf All persistence mechanisms on older Linux versions use my.bin and my.bin.desktop instead of sshf and sshf.desktop.


New attack capabilities


In addition to the functions and attacks included in previous versions of the malware, Zerobot 1.1 has additional DDoS attack capabilities.


These functions allow threat actors to target resources and make them inaccessible.


Successful DDoS attacks may be used by threat actors to extort ransom payments, distract from other malicious activities, or disrupt operations.


In almost every attack, the destination port is customizable, and threat actors who purchase the malware can modify the attack according to their target.


The following are the previously known Zerobot capabilities: Attack methodDescriptionUDP_LEGITSends UDP packets without data.


MC_PINGMeant for DDoS on Minecraft servers.


Sends a handshake and status request.


TCP_HANDSHAKEFloods with TCP handshakes.


TCP_SOCKETContinuously sends random payloads on an open TCP socket.


Payload length is customizable.


TLS_SOCKETContinuously sends random payloads on an open TLS socket.


HTTP_HANDLESends HTTP GET requests using a Golang standard library.


HTTP_RAWFormats and sends HTTP GET requests.


HTTP_BYPASSSends HTTP GET requests with spoofed headers.


headers are each one random byte (not necessarily ascii).Previously undisclosed and new capabilities are the following: Attack methodDescriptionUDP_RAWSends UDP packets where the payload is customizable.


ICMP_FLOODSupposed to be an ICMP flood, but the packet is built incorrectly.


TCP_CUSTOMSends TCP packets where the payload and flags are fully customizable.


TCP_SYNSends SYN packets.


TCP_ACKSends ACK packets.


TCP_SYNACKSends SYN-ACK packets.


TCP_XMASChristmas tree attack (all TCP flags are set).


The reset cause field is “xmas”.


How Zerobot spreads After persistence is achieved, Zerobot scans for other internet-exposed devices to infect.


The malware randomly generates a number between 0 and 255 and scans all IPs starting with this value.


Using a function called new_botnet_selfRepo_isHoneypot, the malware tries to identify honeypot IP addresses, which are used by network decoys to attract cyberattacks and collect information on threats and attempts to access resources.


This function includes 61 IP subnets, preventing scanning of these IPs.


Microsoft researchers also identified a sample that can run on Windows based on a cross-platform (Linux, Windows, macOS) open-source remote administration tool (RAT) with various features such as managing processes, file operations, screenshotting, and running commands.


This tool was found by investigating the command-and-control (C2) IPs used by the malware.


The script, which is used to download this RAT, is called impst.sh: Figure 1.


The impst.sh script used to download the remote administration toolDefending devices and networks against Zerobot The continuous evolution and rapid addition of new capabilities in the latest Zerobot version underscores the urgency of implementing comprehensive security measures.


Microsoft recommends the following steps to protect devices and networks against the threat of Zerobot: Use security solutions with cross-domain visibility and detection capabilities like Microsoft 365 Defender, which provides integrated defense across endpoints, identities, email, applications, and data.


Microsoft Defender Antivirus and Microsoft Defender for Endpoint detect Zerobot malware variants and malicious behavior related to this threat.


Adopt a comprehensive IoT security solution such as Microsoft Defender for IoT to allow visibility and monitoring of all IoT and OT devices, threat detection and response, and integration with SIEM/SOAR and XDR platforms such as Microsoft Sentinel and Microsoft 365 Defender.


Ensure secure configurations for devices: Change the default password to a strong one, and block SSH from external access.


Maintain device health with updates: Make sure devices are up to date with the latest firmware and patches.


Use least privileges access: Use a secure virtual private network (VPN) service for remote access and restrict remote access to the device.


Harden endpoints with a comprehensive Windows security solution:Manage the apps your employees can use through Windows Defender Application Control and for unmanaged solutions, enabling Smart App Control.


Perform timely cleanup of all unused and stale executables sitting on yours or your organizations’ devices.


Detections Microsoft Defender for IoT Microsoft Defender for IoT uses detection rules and signatures to identify malicious behavior.


Microsoft Defender for IoT has alerts for the following vulnerabilities and exploits which may be tied to Zerobot activity: CVE-2014-8361 CVE-2016-20017 CVE-2017-17105 CVE-2017-17215 CVE-2018-10561 CVE-2018-20057 CVE-2019-10655 CVE-2020-7209 CVE-2020-10987 CVE-2020-25506 CVE-2021-35395 CVE-2021-36260 CVE-2021-42013 CVE-2021-46422 CVE-2022-22965 CVE-2022-25075 CVE-2022-26186 CVE-2022-26210 CVE-2022-30023 CVE-2022-30525 CVE-2022-31137 CVE-2022-33891 CVE-2022-34538 CVE-2022-37061 ZERO-36290 ZSL-2022-5717 Microsoft Defender Antivirus Microsoft Defender Antivirus detects the malicious files under the following platforms and threat names:


Zerobot (Win32/64 and Linux) SparkRat (Win32/64 and Linux)


Microsoft Defender for Endpoint Microsoft Defender for Endpoint alerts with the following titles can indicate threat activity on your network: DEV-1061 threat activity group detected An active ‘PrivateLoader’ malware process was detected while executing ‘Morila’ malware was prevented ‘Multiverze’ malware was detected Microsoft Defender for Endpoint also has detections for the following vulnerabilities exploited by Zerobot: CVE-2022-22965 (Spring4Shell) Microsoft Defender for Endpoint’s Device Discovery capabilities discover and classify devices.


With these capabilities, Microsoft 365 Defender customers using Microsoft Defender for IoT have visibility into security recommendations for devices with the following vulnerabilities: CVE-2014-8361 CVE-2019-10655 CVE-2020-25506 CVE-2021-36260 CVE-2021-42013 CVE-2022-30525 CVE-2022-31137 CVE-2022-37061 Devices with these vulnerabilities are also visible in the Microsoft Defender Vulnerability Management inventory.


Microsoft Defender for Cloud Microsoft Defender for Cloud alerts with the following titles can indicate threat activity on your network: VM_ReverseShell VM_SuspectDownloadArtifacts SQL.VM_ShellExternalSourceAnomaly AppServices_CurlToDisk Advanced hunting queries Microsoft 365 Defender Microsoft 365 Defender customers can run the following query to find related activity in their networks.


Zerobot files This query finds the file hashes associated with Zerobot activity.


let IoCList = externaldata(TimeGenerated:datetime,IoC:string,IoC_Type:string,ExpirationDateTime:datetime,Description:string, Action:string, ConfidenceScore:real, ThreatType:string, Active:string,Type:string, TrafficLightProtocolLevel:string, ActivityGroupNames:string)[@"https://raw.githubusercontent.com/microsoft/mstic/master/RapidReleaseTI/Indicators.csv"] with(format="csv", ignoreFirstRecord=True); let shahashes = IoCList | where IoC_Type =~ "sha256" and Description =~ "Dev-1061 Zerobot affecting IoT devices" | distinct IoC; DeviceFileEvents | where SHA256 in (shahashes) Zerobot HTTP requests This query finds suspicious HTTP requests originated by the IOCs associated with Zerobot activity.


DeviceNetworkEvents | where RemoteIP in("176.65.137.5","176.65.137.6") | where ActionType == "NetworkSignatureInspected" | where Timestamp > ago(30d) |extend json = parse_json(AdditionalFields) | extend SignatureName =tostring(json.SignatureName), SignatureMatchedContent = tostring(json.SignatureMatchedContent), SignatureSampleContent = tostring(json.


SamplePacketContent) |where SignatureName


== "HTTP_Client" |project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort, LocalIP, LocalPort, SignatureName, SignatureMatchedContent, SignatureSampleContent Zerobot port knocking This query finds incoming connections from IOCs associated with Zerobot activity.


DeviceNetworkEvents | where RemoteIP in("176.65.137.5","176.65.137.6") | where ActionType == "InboundConnectionAccepted" | where Timestamp > ago(30d) |project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort, LocalIP, LocalPort, InitiatingProcessFileName Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace.


More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy Indicators of compromise (IOCs): Domains and IP addresses: zero[.]sudolite[.]ml 176.65.137[.]5 176.65.137[.]5:1401 176.65.137[.]6 ws[:]//176.65.137[.]5/handle http[:]//176.65.137[.]5:8000/ws New Zerobot hashes (SHA-256) aed95a8f5822e9b1cd1239abbad29d3c202567afafcf00f85a65df4a365bedbb bf582b5d470106521a8e7167a5732f7e3a4330d604de969eb8461cbbbbdd9b9a 0a5eebf19ccfe92a2216c492d6929f9cac72ef37089390572d4e21d0932972c8


In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others.

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic Peoples Republic of Korea DPRK


ITG10’s tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft.


The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a second stage RokRAT shellcode.


RokRAT can execute remote C2 commands, data exfiltration, file download/upload, and keylogging.


The uncovered lure documents suggest ITG10 may be targeting individuals and organizations involved in foreign policy associated with the Korean peninsula.


Key Findings: ITG10 likely targeting South Korean government, universities, think tanks, and dissidents Phishing emails spoof legitimate senders to deliver RokRAT via LNK files Email attachments mimic legitimate documents Additional malware samples possibly related to ITG10 RokRAT campaigns Decoy Documents In late April 2023, X-Force uncovered several Zip Archives files hosting multiple lure documents likely sent via phishing campaigns operated by ITG10. X-Force assesses that the documents are likely decoys geared toward various personnel within two subsets of activity: South Korean government, communication, and educational centers; and energy, manufacturing, and supply chain.


This section provides analysis of the lure documents and potential targets.


South Korean Government, Communications and Educational Centers


The first suspected subset of activity revealed Korean-language lure documents.


The first titled (0722)상임위원회 및 상설특별위원회 위원 명단(최종).zip


[(0722) List of Standing Committee and Standing Special Committee members (final).zip)], contains charts listing the Standing Committee members and assignments associated with broadcast media in South Korea as of July 2022.


Examination of the contents suggests that it is a directory of eighteen South Korean parliamentary committee assignments, the number of committee members, their names, and political party affiliation.


Committees include Education and Judicial, International and Foreign Affairs, Defense, and Intelligence.


The intended targets for this lure are likely to be parliamentary members seeking information on their committee assignment or reporters covering parliament.


(0722)상임위원회 및 상설특별위원회 위원 명단(최종).zip


An additional decoy document titled 계약서내용.pdf (Contract detail.pdf) appears to be associated with a national South Korean broadcaster.


The contents detail the company’s approach to radio drama production scheduled for broadcast in May 2023.


North Korean sponsored threat actors have previously been known to create accounts posing as broadcasting scriptwriters to deceive watchers.


In 2021, North Korean threat actors compromised several email accounts of prominent defectors to send malicious documents to contacts working on DPRK issues.


ITG10 has also been known to infect news websites with malware likely to spy on readers.


A third decoy 2023년도 4월 29일 세미나.pdf (April 29, 2023 Seminar.pdf) appears to be an itinerary for an event hosted in April 2023 by a South Korean think tank.


The event includes multiple seminars on political theory, military history, and a talk on “Intelligence activities and cyber security of the National Intelligence Service.”


Members of this think tank include professors from multiple universities and South Korean government entities.


There are two mobile phone numbers and a Zoom link with a password in the decoy document, which can be scraped to launch phishing material over social medial platforms.


Based on the document’s content, academic and government employees, especially those in intelligence and cybersecurity, are probable targets for phishing emails containing this type of decoy document.


2023년도 4월 29일 세미나.pdf Energy, Manufacturing and Supply Chain The second grouping of lure documents features a zip file projects in Libya.zip containing a LNK file Pipelines Profile (Elfeel- Sharara-Mellitah + Wafa – Mellitah).lnk, as well as additional English-language decoy files.


The decoy files are a Microsoft Word Document and PDF copy of a document titled Proposed MOU GTE Korea.


The documents appear to be legitimate and establish a written Memorandum of Understanding (MOU) between an authentic privately owned Libyan energy company and a South Korean consulting firm specializing in energy, procurement, construction and finance (EPC&F).


In addition, the zip contains a second non-malicious lure PDF titled MFZ Executive Summary Korea detailing a feasibility study regarding the development and expansion of the “sea port free zone of Misurata.”


Based on the decoy content, the likely recipients of this phishing campaign would be organizations or individuals involved with a construction project in the Middle East.


The Middle East has been a traditional customer for many large-scale construction projects for multiple South Korean companies, and there has been a recent push by the South Korean administration to what’s known as the ‘2nd construction boom’.


These construction projects are part of the South Korean government’s pivot to the Middle East, deepening ties both militarily and economically.


Sample Analysis RokRAT has been previously analyzed as having a multi-stage process with two components.


The first involves tooling, and the second involves the payload, likely to inhibit researchers from analyzing the final payload, while maintaining the ability to stop delivery once a target system is infected.


RokRAT campaigns typically begin with a phishing email with a ZIP file attachment, containing a LNK file disguised as a Word document.


When the LNK file is activated, a PowerShell script is executed, opening a decoy document to start the download process of RokRAT which is hosted at OneDrive or similar cloud application.


In another campaign, ITG10 was observed delivering RokRAT via HWP and Word files containing LNK files.


In X-Force’s analysis of recent RokRAT-related files, in lieu of a ZIP file, we found Optical Disc Image files (ISO) containing LNK files that had slightly modified PowerShell scripts, and Hangul Word Processor decoy documents (HWP).


ISO Files The ISO files that X-Force observed contained a LNK file disguised as an exe icon, subsequently containing a HWP file, and a batch file.


The LNK file contains a PowerShell command, as seen below as an example.


Once the LNK file is executed, it extracts and drops a decoy file, and a batch file within the user’s %TEMP% folder.


In this instance, the files were 2023년도 4월 29일 세미나.pdf – decoy file, and 230415.bat.


icon_location = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe PowerShell Commands: Related Malware?


While researching the RokRAT-related files, X-Force also uncovered three LNK files that behave differently than expected.


There is no use of OneDrive or similar cloud applications to host a second-stage payload, and instead of dropping a batch file, these LNK files drop VBS, with the obfuscation technique for the dropped files being hex-encoding vs. string concatenation.


In addition, the RokRAT LNK files drop batch files and downloads the payload that is decoded using the first byte as a key, then the payload is executed using Windows API functions (VirtualProtect).


With these additional LNK files, the VBS downloaders do not perform these actions.


The LNK files analyzed contain an encoded PowerShell, and once the LNK files are executed, the PowerShell script is run, and two files are dropped to the user’s %TEMP% folder.


In one analyzed sample, the files dropped were a VBS file (tmp<random-9-digit-number>.vbs ), and a Plaintext file with contents asdfgqwert.


The VBS file will get executed via Wscript.exe: “C:\Windows\System32\WScript.exe” “C:\Users\Usuario\AppData\Local\Temp\tmp<nine-digit-number>.vbs”.


Wscript.exe is a service Wscript.exe is a service provided by the Windows system with scripting abilities.


Subsequently, two GET requests are initiated.


In a third file we analyzed, instead of the LNK file dropping a VBS and a Plaintext file, a VBS file and a JPEG decoy file are dropped to the users %TEMPT% folder.


In this case, the JPEG decoy file appears to be a correspondence related to the “Proof of Digital Assets”.


At the time of this analysis, X-Force was unable to retrieve the final payload from the servers as they have been taken down; therefore, it is uncertain whether these additional LNK files are related to ITG10 activity.


Further research and analysis are needed to determine relevance and attribution.


Encoded PowerShell:


Decoded PowerShell: tmp1698268529.vbs GET Requests: Proof of Digital Assets JPEG X-Force Recommendations Multiple lure documents uncovered in this campaign suggest ITG10 continues to target individuals and organizations involved in foreign policy, potentially related to shifts in the geopolitical and security environment on the Korean peninsula.


IBM X-Force assesses with high confidence that individuals and organizations holding strategic, political, or military information in connection with the Korean peninsula will see elevated threats from the DPRK, given ITG10’s previous and recent activity.


Organizations that may be at elevated risk of targeting from ITG10 have the potential to decrease the risk to their organization by employing heightened vigilance toward potential phishing emails, warning employees of the phishing email threats, employing and closely monitoring endpoint detection and response (EDR) tools, and leveraging behavioral analytics to identify malicious behavior.


We also recommend that potentially targeted organizations alert on the following indicators of compromise to detect behavior related to this campaign.


Indicators of Compromise Indicator Indicator Type Context f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753 LNK 7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1 PDF Decoy 2023년도 4월 29일 세미나.pdf 06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d Batch File 230415.bat 1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3 ZIP (0722)상임위원회 및 상설특별위원회 위원 명단(최종).zip cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286 LNK 5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc HWP Decoy 0722.hwp 240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a Batch File 202207221.bat 9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9 LNK ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181 PDF Decoy 계약서내용.pdf cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0 Batch File 230422.bat 00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5 ZIP projects in Libya.zip 6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494 LNK Pipelines Profile (Elfeel- Sharara-Mellitah + Wafa – Mellitah).lnk f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc docx Proposed MOU GTE Korea.docx fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9 PDF Decoy Proposed MOU GTE Korea.pdf 76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b PDF Decoy MFZ Executive Summary Korea.pdf 5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8 PDF Decoy 230130.pdf C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Icon Location C:\Program Files (x86)\Hnc\Office 2020\HOffice110\Bin\Hwp.exe Icon Location hxxps[:]//api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBalFOTHZFRV9DVU9iUFdnLXhPZG8xRXFYckU_ZT1BM1QwV2Q/root/content URL Document Location hxxps[:]//api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL2kvcyFBaFhFWExKU05NUFRlNnFWazdDNHp2Yy1SekU_ZT1SSFZJSk4/root/content URL Document Location hxxps[:]//api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBaFFNUDZlZzhhUkZiN0xVMUNPQ2YzeE5vVFU_ZT1wZ2liaUM/root/content URL Document Location hxxps[:]//api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL2kvcyFBaFhFWExKU05NUFRiZnpnVU14TmJJbkM2Q0k_ZT1WZElLSjE/root/content URL Document Location hxxps[:]//api.onedrive[.]com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBdTJteTF4aDZ0OFhnUjJNem1zOG5oUndvLTZCP2U9akhIQzZ5/root/content URL Document Location 6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48 LNK 7529eaeeb29c713f8e15827c79001a9227d8bc31c9209bf524a4ff91648a526e VBS xn--vn4b27hka971hbue[.]kr C2 GET Request 50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7 LNK 3d1d2d0464013d9e1dd7611d73176f3a31328a41d6474d5b6d0582ad09d3b17d VBS partybbq.co[.]kr C2 GET Request 1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1 LNK 88c219656f853b2dc54ae02d32a716e10c8392ed471d1c813e57de2dc170951e VBS 7aa7233feb8e8a7b71ae6cdd0ddb8c2b192d4b6e131fed1ade82efdcb8096c57 JPEG Decoy Scroll to view full table To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here: IBM X-Force Scheduler If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034


The post ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK) appeared first on Security Intelligence.


Executive Summary While advanced persistent threats get the most breathless coverage in the news, many threat actors have money on their mind rather than espionage.

Banking Trojan Techniques How Financially Motivated Malware Became Infrastructure


You can learn a lot about the innovations used by these financially motivated groups by watching banking Trojans.


Because attackers constantly create new techniques to evade detection and perform malicious acts, studying monetarily motivated malware can help defenders understand threat actor tactics and protect organizations more effectively.


Some of the banking Trojans described here are historically known for being financial malware, but now they’re primarily used as infrastructure to deliver other malware.


Which is to say, by preventing techniques used by banking Trojans, you can also stop other types of threats.


We’ll survey techniques used by notorious banking Trojan families to evade detection, steal sensitive data and manipulate data.


We’ll also describe how those techniques can be blocked.


These families include Zeus, Kronos, Trickbot, IcedID, Emotet and Dridex.


Palo Alto Networks customers are protected from such attacks using Cortex XDR and WildFire.


Table of Contents What Are Webinjects?How to Detect WebinjectsInfecting Web Browsers During Process CreationHow to Prevent Attempts to Infect Web Browsers During Process CreationNamed Pipe Communication Between Injected ProcessesHow to Prevent Named Pipe Communication Between Injected ProcessesHeaven’s Gate Injection TechniqueHow to Prevent Heaven's GateEvasive Process Hollowing by Entrypoint PatchingHow to Prevent Evasive Process Hollowing by Entrypoint PatchingPE InjectionHow to Prevent PE InjectionProcess Injection via HookingHow to Prevent Injection via HookingAtomBombing Injection TechniqueHow to Prevent AtomBombing and its VariantsConclusionIndicators of Compromise What Are Webinjects?


Webinjects are modules that can inject HTML or JavaScript before a web page is rendered, and are often used to trick users.


They are known to be abused by banking Trojans, as well as being employed to steal credentials and manipulate form data inside web pages.


In most banking Trojan families, there is at least one webinjects module.


An early stager of the banking Trojan usually injects the banking Trojan’s main bot into a Windows process, and that process injects the webinjects module into the machine’s available web browser processes as shown in Figure 1. Figure 1.


Trickbot goes through processes one by one to find browsers to inject with its webinjects module, using a stealthy technique known as reflective injection.


The webinjects module hooks the API calls responsible for sending, receiving or encrypting data sent to a web server.


By intercepting the data before it is encrypted, the malware can read HTTP-POST headers and manipulate them on the fly.


Trickbot webinjects module placing hooks based on the browser.


Trickbot placing hooks on wininet.dll functions.


By fully controlling the HTTP headers just before the webpage is rendered, the malware can completely modify the forms and fool the user.


The malware may inject HTML or JavaScript code to trick the user into inserting sensitive information, such as a PIN code or credit card number, enabling the malware to collect it.


The malware can extract this information and send it to its command and control (C2) server without actually sending the forged headers to the targeted web page server.


Chrome (chrome.dll) Firefox (nspr3.dll / nspr4.dll) Internet Explorer / Edge (Wininet.dll) ssl_read PR_Read HttpSendRequest ssl_write PR_Connect InternetCloseHandle PR_Close InternetReadFile PR_Write InternetQueryDataAvailable HttpQueryInfo InternetWriteFile HttpEndRequest InternetQueryOption InternetSetOption HttpOpenRequest InternetConnect Table 1.


Frequently hooked API functions.


How to Detect Webinjects This technique can be prevented by detecting an injection into a web browser process.


The injected thread calls the NtProtectVirtualMemory function where the NewAccessProtection argument is PAGE_EXECUTE_READWRITE and the BaseAddress argument is an address to a library function targeted by banking Trojans.


For example, Trickbot uses both VirtualProtect and VirtualProtectEx in its various versions.


Inspecting NtProtectVirtualMemory calls covers both.


Some banking Trojans opt to avoid code injection.


Instead, they suspend the remote process threads and install the hooks remotely.


Inspecting remote NtProtectVirtualMemory calls can detect this variant technique.


Figure 4. NtProtectVirtualMemory prototype.


Infecting Web Browsers During Process Creation


Some banking Trojans aim to infect a target process as soon as it is launched, by injecting code into a predicted parent process of the real target.


Once the banking Trojan executes in the context of the parent process, it hooks process creation library functions and waits until the real target is created.


Inside the hook, the banking Trojan manipulates the process creation flow.


Then, for example, it initializes the webinjects module inside the remote process.


The explorer.exe and runtimebroker.exe parent processes are frequently abused for this goal, as they usually launch the real targets.


For instance, the Karius banking Trojan used this technique by injecting code into explorer.exe and hooking CreateProcessInternalW. The Trojan’s hook handler looked for a spawned web browser process and injected the malicious webinjects module into it.


How to Prevent Attempts to Infect Web Browsers During Process Creation


This technique can be prevented by looking for an injection into explorer.exe or runtimebroker.exe, where the injected thread hooks process creation functions like NtCreateUserProcess, NtCreateProcessEx, CreateProcessInternalW, CreateProcessA or CreateProcessW. Named Pipe Communication Between Injected Processes Many banking Trojans use named pipes to communicate with various processes under the threat actor’s control.


To do this, they inject their main bot into a Windows process, and then inject their other modules into different processes according to the module’s purpose.


They then establish communication between the different processes using named pipes.


For example, Trickbot injects the main bot into svchost.exe.


It creates a named pipe server and reflectively injects the webinjects module into web browsers.


This injected module connects to the same named pipe as a client to communicate to the main bot and deliver the fetched credentials to the C2 server.


Trickbot named pipe server.


How to Prevent Named Pipe Communication Between Injected Processes This technique can be prevented by inspecting named-pipe events.


An injected thread creates a named pipe inside a Windows process, and then another injected thread that lives inside a web browser attempts to connect to that same named pipe.


Heaven’s Gate Injection Technique Heaven's Gate is a technique used by malware, which enables a 32-bit (WoW64) process to execute 64-bit code by performing a far jump/call using segment selector 0x33.


Modern malware uses Heaven's Gate to inject into both 64-bit and 32-bit processes from a single 32-bit process on x64 systems.


This bypasses WoW64 API hooks, it hinders analysis on some debuggers, and it fails emulation on some sandboxes.


Even though this method is old, it is still effective and frequently used.


Trickbot and Emotet loaders use Heaven's Gate for process hollowing from a WoW64 process into a 64-bit svchost.exe (For more about process hollowing, see the section on Evasive Process Hollowing By Entrypoint Patching below).


The architecture of these two banking Trojans dictates that their main bot persists inside svchost.exe while the web content manipulation and credential stealing modules live inside the browser processes.


Emotet using Heaven's Gate in its Microsoft Outlook Messaging API (MAPI) module.


How to Prevent Heaven's Gate A WoW64 process usually goes through the wow64cpu.dll to perform the transition to x64 CPU mode.


Heaven's Gate does this transition manually.


Prevention methods can find Heaven's Gate by inspecting whether a WoW64 process system call didn’t go through the wow64cpu.dll.


This can be done by placing hooks on critical APIs, generating a stack trace and inspecting the stack trace for wow64cpu.dll.


WoW64’s normal syscall flow.


Evasive Process Hollowing by Entrypoint Patching Process hollowing is a process injection technique that creates a new legitimate process in a suspended mode, unmaps its main image and replaces it with malicious code.


The malicious code is written into the newly created process and the suspended thread context instruction pointer is changed using NtGetContextThread/NtSetContextThread.


Security product vendors check for main image unmapping combined with the usage of NtGetContextThread/NtSetContextThread to detect process hollowing.


A known technique for evading detection is to patch the process entry point with a small jump that redirects execution to the payload without actually using NtGetContextThread/NtSetContextThread functions or unmapping the main image.


For example, Trickbot and Kronos have both used this technique.


Kronos mapped a suspended svchost.exe into its own process and patched it in its own memory address space.


Similar to other banking Trojans, Kronos' main module ran within svchost.exe and orchestrated the whole operation from the remote svchost.exe process.


Trickbot implemented process hollowing by first using VirtualProtectEx on the process entrypoint, and then writing the hook stub using WriteProcessMemory. Figure 8.


Kronos mapping svchost.exe and patching its entrypoint.


Kronos hook stub template – x86 opcodes for push and ret.


How to Prevent Evasive Process Hollowing by Entrypoint Patching This technique can be prevented either by inspecting whether the address argument provided to the calls of NtWriteVirtualMemory or NtProtectVirtualMemory is a remote process entry point or by detecting suspicious remote mapping and reading of svchost.exe memory.


PE Injection Common injection methods used by banking Trojans involve writing a mapped PE into a remote process using WriteProcessMemory.


Some malware families try to obscure the call by wiping artifacts from the buffer, such as wiping the PE header.


For example, Zeus variants use this technique to inject themselves into other processes, allowing them to stay hidden, as well as to perform webinjects and to perpetrate financial data theft. Figure 10.


Zeus injection code from its leaked source code.


How to Prevent PE Injection This technique can be prevented by inspecting the buffer sent to NtWriteVirtualMemory for executable artifacts.


Process Injection via Hooking Hooking can be used as an injection technique.


Injecting a banking Trojan’s main payload into a legitimate-looking process maintains stealth and helps avoid endpoint protection detection.


This technique utilizes hooking to get code execution, usually by hooking a frequently called API function with a jump to a payload/shellcode.


This avoids calling any suspicious APIs often used in code injection techniques like CreateRemoteThread or NtSetContextThread.


For instance, IcedID injects its main bot into a hollowed instance of svchost.exe using API hooking.


This is also known as the ZwClose technique (ZwClose was the hooked API in Zberp, the first to employ this injection technique in the wild).


The injection flow of IcedID is slightly different than that of Zberp.


It first hooks NtCreateUserProcess and then calls CreateProcessA to create svchost.exe without any special parameters or argument.


In a regular flow, the newly created svchost.exe should terminate right away.


IcedID initiates svchost.exe hooking.


IcedID hooks NtCreateUserProcess.


However, because IcedID hooked NtCreateUserProcess, the hook handler is called right after the call to CreateProcessA. In the handler, it performs the following activities: Unhooks NtCreateUserProcess Calls NtCreateUserProcess (which creates svchost.exe) Decompresses a local buffer that contains the payload to inject using RtlDecompressBuffer Allocates memory for the payload at the remote svchost.exe process Writes the payload into the remote svchost.exe using NtAllocateVirtualMemory and ZwWriteVirtualMemory


For the execution, IcedID hooks RtlExitUserProcess in the newly created svchost.exe with a jump stub to the payload.


As mentioned, svchost.exe was created without any parameters and it will try to exit.


However, due to the IcedID hook, it will jump to the payload.


IcedID hooks RtlExitUserProcess.


How to Prevent Injection via Hooking This technique can be prevented by inspecting calls to NtProtectVirtualMemory and NtWriteVirtualMemory.


The provided address argument for NtProtectVirtualMemory is an exported function from one of the Windows libraries, and the NtWriteVirtualMemory written buffer is a hooking stub.


In both cases, the remote process has to be a known injection target.


AtomBombing Injection Technique AtomBombing is a technique that allows malware to inject code while avoiding calling suspicious APIs that security vendors are watching.


Dridex uses a slightly modified AtomBombing technique that injects one of its stages into a Windows process (usually explorer.exe) and employs various steps to cause financial data theft.


Malware using the AtomBombing technique first writes the payload into the global atom table, which can be accessed by all processes.


They then dispatch an asynchronous procedure call (APC) to the APC queue of a target process thread using NtQueueApcThread, forcing the target process to call GlobalGetAtomA.


The target thread then retrieves the payload from the global atom table and inserts it into a read/write (RW) region inside the target process memory space (a code cave inside the kernelbase.dll data section).


The payload has to be split into NULL-terminated strings and an atom is created for each string.


For the execution, the injector process dispatches another APC using NtQueueApcThread to force the remote process to execute NtSetContextThread.


The injected process then calls NtSetContextThread, which invokes a return-oriented programming (ROP) chain that allocates execute/read/write (RWX) memory.


The ROP chain then copies the payload from the RW region into the newly allocated RWX region, and lastly, executes it.


The unique idea behind AtomBombing is the write-primitive, which allows writing to the remote process using atom tables and APC.


Dridex uses a variation of AtomBombing that queues an APC to call memset to clean an RW region in ntdll.dll.


Then, it copies the payload and its import table into the target process using the same write technique into the ntdll.dll RW region.


For the execution, Dridex modifies the copied payload memory into executable memory using NtProtectVirtualMemory.


Then it hooks GlobalGetAtomA by calling NtProtectVirtualMemory and by using the same write primitive.


Finally, it queues an APC into the patched GlobalGetAtomA to get the payload running. Figure 14.


AtomBombing proof of concept code.


How to Prevent AtomBombing and its Variants


These techniques can be prevented by inspecting whether the arguments provided to NtQueueApcThread/NtSetContextThread calls point to a suspicious API – the APC routine argument in the case of NtQueueApcThread, or the new instruction pointer in the context argument in the case of NtSetContextThread.


Both API calls have to be called into a remote process.


Conclusion Threat actors who are in it for the money use a wide range of malware techniques for injection and financial fraud, and they are always looking for new ways to develop evasive techniques.


We have explored some of the more interesting banking Trojan techniques and how they’re used to steal victims’ sensitive data.


And finally, we describe how these techniques can be used to detect malicious behavior, so it can be prevented.


Palo Alto Networks customers using Cortex XDR receive protections from such attacks in different layers, including the following: Local Analysis Machine Learning module Behavioral Threat Protection Behavioral indicators of compromise (BIOC) and Analytics BIOCs rules These layers identify the tactics and techniques that banking Trojans use at different stages of their execution.


Palo Alto Networks customers also receive protections against the attacks discussed here through the WildFire cloud-delivered security subscription for the Next-Generation Firewall. Indicators of Compromise Trickbot testnewinj32Dll.dll:


4becc0d518a97cc31427cd08348958cda4e00487c7ec0ac38fdcd53bbe36b5cc Webinjects: ef6603a7ef46177ecba194148f72d396d0ddae47e3d6e86cf43085e34b3a64d4 Emotet: dd20506b3c65472d58ccc0a018cb67c65fab6718023fd4b16e148e64e69e5740 Kronos: aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc Zeus: 0f409bc42d5cd8d28abf6d950066e991bf9f4c7bd0e234d6af9754af7ad52aa6 IcedID: 358af26358a436a38d75ac5de22ae07c4d59a8d50241f4fff02c489aa69e462f Dridex: ffbd79ba40502a1373b8991909739a60a95e745829d2e15c4d312176bbfb5b3e Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


AhnLab Security Emergency response Center (ASEC) has confirmed the distribution of malware disguised as Hancom Office document files.

Tracking Traces of Malware Disguised as Hancom Office Document File and Being Distributed RedEyes


The malware that is being distributed is named “Who and What Threatens the World (Column).exe” and is designed to deceive users by using an icon that is similar to that of Hancom Office.


Decompressing the compressed file reveals a relatively large file with a size of 36,466,238 bytes.


AhnLab Endpoint Detection and Response (EDR) is capable of detecting such attack techniques through its trace data, and it allows users to check the data required to investigate the related breach case.


Execution flow diagram Figure 1 depicts the icon of the malware and its overall execution.


It provides a visual representation of which processes are used when the malware is executed. Figure 2.


File trace data of malware creation Figure 3.


Primary trace data of malware Figures 2 and 3 show the trace data of key behaviors within the overall flow of the malware.


In Figure 2, a trace can be observed of the malware creating a folder named onedrivenew in the AppData directory and self-copying itself with the filename onedrivenew.exe to appear as a normal file.


In Figure 3, a trace can be seen of the malware creating and executing a normal Hancom Office file with the same filename as the malware within the same directory where the malware was executed.


The malware is injected and executed within the normal Windows process called mstsc.exe.


The original file is deleted using the cmd command.


Trace data of the normal Windows process, mstsc.exe Figure 4 displays the trace data of mstsc.exe being executed after being injected with malware.


The malware registers its file with the name onedrivenew under the Run key in order to make it run after the system is rebooted.


Afterward, it uses the schtasks.exe command to register the file to the task scheduler with the name OneDriveOp to connect to a certain URL every 60 minutes using the normal Windows file mshta.exe.


The URL registered in the task scheduler appears to be a normal homepage, but it contains a web shell.


The inserted web shell has been confirmed to be similar to the one posted in “Targeted Attack on a Website Developed by a Specific Web Design Company (Red Eyes and APT37)” on the AhnLab Threat Intelligence Platform.


When it comes to targeted attacks, there are factors that general users may struggle to deal with.


Even if users find themselves exposed to such threats, AhnLab EDR can provide trace data for appropriate responses.


[File Detection]– Trojan/Win.


Agent.


[IOC]MD5 – 93fc0fb9b87a00b38f18c1cc4ee02e50 C2 – hxxp://ingarchi.com/bbs/data/culture– hxxp://ingarchi.com/bbs/data/culture/getcfg.php AhnLab EDR protects the endpoint environment by delivering behavioral detection, advanced analysis, holistic visibility, and proactive threat hunting.


For more information about the product, please visit our official website.


The post Tracking Traces of Malware Disguised as Hancom Office Document File and Being Distributed (RedEyes) appeared first on ASEC BLOG.


By Chetan Raghuprasad, Vanja Svajcer and Asheer Malhotra.

Attackers use domain fronting technique to target Myanmar with Cobalt Strike


News Summary Cisco Talos discovered a new malicious campaign using a leaked version of Cobalt Strike in September 2021.


This shows that Cobalt Strike, although it was originally created as a legitimate tool, continues to be something defenders need to monitor, as attackers are using it to set up attacks.


The threat actor in this case uses domain fronting with the Cloudflare Content Delivery Network, redirecting a Myanmar government owned-domain to an attacker-controlled server.


The threat actor employed the tactic of re-registering reputed domains in their attack chains to evade detections.


This threat demonstrates several techniques of the MITRE ATT&CK framework, most notably T1202 - Indirect Command Execution , T1027 - Obfuscated Files or Information, T1105 - Ingress Tool Transfer, T1071.001 - Application Layer Protocols:Web Protocols.


What's New? Cisco Talos discovered a malicious campaign using an obfuscated Meterpreter stager to deploy Cobalt Strike beacons in September 2021.


The actor used a domain owned and operated by the Myanmar government, the Myanmar Digital News network, as a domain front for their beacons.


The evolution of this threat indicates that the attackers have been active since at least August 2021 using a combination of Meterpreter stagers and Cobalt Strike beacons to establish presence on victim's endpoints.


How did it work?


The malware is typically a loader that runs on a victim machine, decodes and executes the Cobalt Strike beacon DLL via reflective injection.


It loads several libraries during the runtime and generates the beacon traffic according to the embedded configuration file.


The configuration file contains the information related to the command and control (C2) server which instructs the victim's machine to send the initial DNS request attempting to connect to the host of the Myanmar government-owned domain www[.]mdn[.]gov[.]mm.


The site is hosted behind the Cloudflare content delivery network and the actual C2 traffic is redirected to an attacker controlled server test[.]softlemon[.]net based on the HTTP host header information specified in the beacon's configuration data.


So what?


Cobalt Strike has been used by many actors in the past and is a de-facto standard tool for post-exploitation activities and pivoting.


Attackers use it to deploy a wide range of payloads, from commodity malware, to sophisticated state-sponsored activities.


Cobalt Strike allows actors to shape the traffic of beacons to mimic legitimate traffic patterns.


One of the techniques to conceal the traffic from DNS-based filtering is Domain Fronting.


Domain fronting uses legitimate or high-reputation domains to remain undetected by defenders.


The attacker's choice of Myanmar-specific domains for domain fronting may indicate an interest in the geopolitics of this area of the world.


In this campaign, the actor used staged payloads using the Meterpreter stager, which gives an indication that the beacon will be used for further attacks.


The defenders should be constantly vigilant and monitor network traffic to detect Cobalt Strike activities, since it is one of the most commonly used offensive tools by crimeware and APT operators.


Evolution of the campaign A study of the evolution of the campaign shows the actor experimenting with different combinations of hosts with the intent of perfecting the domain fronting technique.


The earliest beacon discovered around the middle of August 2021 contains the C2 URI set to test[.]softlemon[.]net while the HTTP Get and Post requests headers are pointing to dark-forest-002[.]president[.]workers[.]dev which is a Cloudflare serverless workers domain.


The default host header configuration for request contains the host name test[.]softlemon[.]net, which is also used by more recent samples.


Another sample discovered in late August 2021 consisted of the C2 host URI xxx[.]xxxx[.]tk and the host header setting configured to point to test[.]softlemon[.]net.


Beginning September 2021, the attackers started using the Myanmar Digital News domain for fronting their beacons.


While the default C2 domain was specified as www[.]mdn[.]gov[.]mm, the beacon's traffic was redirected to the de-facto C2 test[.]softlemon[.]net via HTTP Get and POST metadata specified in the beacon's configuration.


The actor likely changed the configuration to test their infrastructure and the domain fronting functionality before launching the attack.


Based on the beacon configuration template and the real C2 host test[.]softlemon[.]net, we assess with moderate confidence that the samples are created by a single actor.


Timeline of malware samples first seen in the wild.


Cobalt Strike beacon configurations


We extracted the beacon config from the payload that showed us the actor has used different values for the User Agent, C2-Server and Host-header in different malwares of this campaign.


The beacon configuration of samples usually has a User Agent, which is Mozilla compatible and of Windows 7. C2 server, UserAgent and de-facto C2 variations in the beacons.


Watermark The Cobalt Strike watermark is a number generated from the license file and is unique to a Cobalt Strike license.


The watermark on the beacons used in this campaign was 305419896 (hex: 0x12345678).


This particular watermark has previously been attributed to a leaked Cobalt Strike version and is unsurprisingly used by other malicious actors, such as Maze ransomware and Trickbot groups, making attribution based on the watermark number impossible.


It is difficult to assess if the usage of the previously registered expired domain for C2 server and the leaked Cobalt Strike point to an increased operational security awareness of the actor or to limited resources available to them.


Domain fronting The actor in this campaign has used domain fronting, which is a technique which can use high reputation domains to conceal the Cobalt Strike command and control traffic.


A government domain of Myanmar www[.]mdn[.]gov[.]mm was used in this particular instance.


The fronted domain mdn[.]gov[.]mm is a legitimate domain of Myanmar Digital News, a state-owned digital newspaper.


This website has previously been compromised in February by the Brotherhood of Myanmar group, a collection of militia groups.


Although there are no indications that the previous defacement of the domain by the Brotherhood of Myanmar and the campaign described in this post are related, the domain itself is clearly of interest to various actors.


Domain fronting can be achieved with a redirect between the malicious server and the target.


Malicious actors may misuse various content delivery networks (CDNs) to set up redirects of serving content to the content served by attacker-controlled C2 hosts.


Cloudflare is one of the CDN services that provides its users with a globally distributed cache for files hosted on their servers.


Cloudflare identifies distributions by the FQDN used to request resources.


Cloudflare users have the option to use their own subdomain and create a DNS record that points to Cloudflare.


This subdomain tells Cloudflare to associate that DNS record with a specific distribution.


The beacon calls home www[.]mdn[.]gov[.]mm,/api/3 and has set the Host header to the actual C2 server test[.]softlemon[.]net.


The beacon traffic resolves to a Cloudflare IP address.


The DNS request that led them there will be lost and relies on other parts of the HTTP request, including the Host header and the actual C2 test[.]softlemon[.]net.


Summary of domain fronting of Myanmar government's domain.


Cobalt Strike payload The beacons are of particular interest due to the domain fronting technique using a government host as the initial DNS lure.


The MITRE ATT&CK framework techniques used by this malware are: T1202 - Indirect Command Execution T1027 - Obfuscated Files or Information T1105 - Ingress Tool Transfer T1071.001 - Application Layer Protocols:Web Protocols


We also analysed the loader binary to find specifics of its memory loading and functionality.


We spotted a suspicious section .kxrt with the packed and encoded malicious code.


The malware links several functions at runtime and has the Meterpreter staging code.


When the malware runs, the .tls section runs first, loads the libraries and starts the execution of the malicious code at the entry point in the .kxrt section.


The entry point code calls a function to allocate virtual memory in its own process space. Function at address 00401550 shows the allocation of virtual memory.


The loader next calls the VirtualProtect function to set the virtual memory page permissions to Read-Write-Execute and writes the image base of the Cobalt Strike beacon which will be executed in a new thread.


Function sets the virtual memory page permission to Read-Write-Execute.


We spotted two libraries linking during runtime.


Aside from this, there are several other standard libraries the malware links during the runtime.


Function that loads library during the runtime.


After allocating the virtual memory and setting the page permissions to Read-Write-Execute, a decryption routine is executed that decrypts the remaining malicious code in the .kxrt section and writes it to the virtual memory.


Decoder routine to decrypt the beacon DLL.


The decrypted malicious code is the actual Cobalt Strike beacon.


Once decoded, the loader's execution jumps to the beginning of the DLL resulting in a reflective-load of the beacon into the loader process memory.


This beacon is now responsible for decoding the configuration.


Stack view of info loaded from the beacon config.


The beacon resolves the proxy by calling WinHTTPGetProxyForUrlEx and WinHTTPCreateProxyResolver to bypass the proxy for the URL.


Function that resolves the victim's system proxy for the URL.


Soon after that, the beacon initiates the Cobalt Strike beacon traffic to the C2 server.


The DNS request for the initial host resolves to a Cloudflare-owned IP address that allows the attacker to employ domain fronting and send the traffic to the actual C2 host test[.]softlemon[.]net, also proxied by Cloudflare.


At the time of analysis, the sample C2 host infrastructure was not online and we received a 404 error.


Cobalt Strike beacon traffic.


The beacon contains techniques to detect debuggers using GetTickCount, IsDebuggerPresent and the NtDelayExecution call to delay the execution of the malware for evading sandbox-based dynamic analysis systems.


The beacon can also manage the system power policies registry keys to set the minimum and maximum sleep times and the lid open and close action policy.


The beacon modifies the victim's system power and lid open/close policies in the registry.


Command and control The C2 server - test[.]softlemon[.]net is the subdomain of softlemon[.]net.


The domain softlemon[.]net was registered under Google domains until August 2019 and likely expired since then.


The malicious actor re-registered this domain on Aug. 5, 2021.


The SSL certificate for the domain softlemon[.]net with the serial number 4aa6af6d719bfdd1c6dff3d7b640aed7ee3was issued by Let's Encrypt, a free SSL certificate provider.


The Talos reputation engine has classified it as an untrusted domain and Cisco Umbrella shows a spike in the DNS queries in September 2021.


This activity is consistent with the evolution of the Cobalt Strike beacons illustrated earlier the attackers started instrumenting beacons fronted with the Digital News domain at the beginning of September.


DNS spike for test[.]softlemon[.]net queries vs dates.


Our research uncovered that the C2 test[.]softlemon[.]net is a Windows server running Internet Information Services (IIS).


IIS service response rendered from the host test[.]softlemon[.]net.


According to Shodan, the IP address 193[.]135[.]134[.]124 hosted by a Russian provider may be the real C2 IP address protected by the Cloudflare infrastructure as the SSL certificate served on port 8443 belongs to Cloudflare and lists the X509v3 Subject Alternative Name as DNS:*.softlemon.net.


Conclusion Domain fronting is a technique used by attackers to circumvent protection based on DNS filtering.


In this campaign, a malicious Cobalt Strike beacon is configured to take advantage of a mechanism used by Cloudflare and other content distribution networks to instruct the proxy about the host to be used for serving the content.


When the beacon is launched, it will submit a DNS request for a legitimate high-reputation domain hosted behind Cloudflare infrastructure and modify the subsequent HTTPs requests header to instruct the CDN to direct the traffic to an attacker-controlled host.


Defenders should monitor their network traffic even to high reputation domains in order to identify the potential domain fronting attacks with Cobalt Strike and other offensive tools.


XDR tools should be deployed to endpoints in order to detect behavior of Cobalt Strike loaders and Meterpreter stagers as they are frequently used by a wide range of actors.


Coverage Ways our customers can detect and block this threat are listed below.


Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post.


Cisco Secure Malware Analytics (formerly Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.


The following ClamAV signatures have been released to detect this threat: Win.


CobaltStrike-9909816-0 Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. IOCs Hashes 658d550322cefa6efc51fbfd1a3e02839d1e519a20f8f17f01c534c0eaf36f27 e806e55713b9e46dc7896521ffb9a8b3abaa597147ea387ff2e93a2469546ba9 a0aec3e9cb3572a71c59144e9088d190b4978056c5c72d07cb458480213f2964 Network IOCs Hosts test[.]softlemon[.]net dark-forest-002.president[.]workers[.]dev IP addresses 193[.]135[.]134[.]124 URLs hxxp://test[.]softlemon[.]net:8081/api/3 hxxp://test[.]softlemon[.]net/ tcp://test[.]softlemon[.]net:8080/ hxxps://193[.]135[.]134[.]124:8443 hxxp://193[.]135[.]134[.]124:8080 hxxp://193[.]135[.]134[.]124:8081


Sophos X-Ops is tracking a developing situation concerning a seeming supply-chain attack, possibly undertaken by a nation-state-related group.

Update 2 3CX users under DLLsideloading attack What you need to know


This page provides an overview of the situation, a threat analysis, information for hunters, and information on detection protection.


We will update this page as events and understanding develop, including our threat and detection guidance.


[Latest version published 23:00 UTC 01-April-23, adding Troj/Steal-DLG to Detection Protections/Static detection, two more queries customers may use to determine their exposure to the attack, new analysis of an emergent line of inquiry concerning a timestamp mechanism in the malicious code, and information on analysis of other Electron-built apps using ffmpeg.dll 23:30 UTC 30-March-23, adding detail on affected versions, misuse of ffmpeg.dll, removal of malicious repository, comparison of PE shellcode loader to that used by Lazarus threat group, more queries customers may use to determine their exposure to the attack, and various additional detections] Overview The affected software is 3CX – a legitimate software-based PBX phone system available on Windows, MacOS, Linux, Android, and iOS.


Some Windows and MacOS versions of the application have been abused by the threat actor to add an installer that communicates with various command-and-control (C2) servers.


The software is a digitally signed version of the softphone desktop client for both Windows and MacOS, which includes a malicious payload.


According to 3CX, their Update 7 for Windows, version numbers 18.12.407 and 18.12.416, and Electron Mac App version numbers 18.11.1213, 18.12.402, 18.12.407 and 18.12.416, are affected.


The most common post-exploitation event we have observed to date is the presence of an infostealer that targets the browser(s) on a compromised system.


At this writing, 3CX has deprecated the affected versions of the Windows application.


At present, the only platforms confirmed by our customer data to be affected are Windows and MacOS, which is in agreement with 3CX’s information on affected platforms.


According to information on their support forum, Android and iOS versions of the software are not believed to be affected.


Threat analysis On March 22, users of 3CX began discussion of potential false-positive detections of 3CXDesktopApp by their endpoint security agents.


Figure 1: The update process at the moment the malicious version drops Sophos MDR first identified malicious activity directed at its own customers and stemming from 3CXDesktopApp on March 29, 2023.


Additionally, Sophos MDR has observed the campaign leveraging a public file storage to host encoded malware.


This repository has been in use since December 8, 2022; after news of the compromise spread widely on March 29, the repository was taken down.


The attack revolves around a DLL sideloading scenario, one with a remarkable number of components involved.


This is likely to ensure that customers were able to use the 3CX desktop package without noticing anything unusual about the affected package.


We have identified three crucial components: 3CXDesktopApp.exe, the clean loader d3dcompiler_47.dll, a DLL with an appended encrypted payload ffmpeg.dll, a Trojanized loader Figure 2 presents a high-level look at the attack flow as it works in Windows; there are some minor variations in the later steps with the MacOS version.


Figure 2: A high-level view of the attack flow The file ffmpeg.dll contains an embedded URL which retrieved a malicious encoded .ico payload from GitHub file storage at https[:]//raw.githubusercontent.com/IconStorages/images/main/ — though, again, once news of the compromise spread widely, this repository was taken down.


We saw several variations on the ffmpeg.dll file, including one that was signed by 3CX’s own certificate; these appear to be maliciously patched versions of the legitimate ffmpeg.dll.


In a statement on Thursday, the team responsible for ffmpeg’s source code took pains to distance their work from the 3CX compromise.


Figure 3: When ffmpeg stepped onto Twitter to defend its code In a normal DLL sideloading scenario, the malicious loader (ffmpeg.dll) would replace the clean dependency; its only function would be to queue up the payload.


However, in this case, that loader is also entirely functional, as it would normally be in the 3CX product – instead, there’s an additional payload inserted at the DllMain function.


This adds bulk, but may have lowered suspicions – the abused 3CX application functions as expected, even as the Trojan addresses reached out to the C2 beacon.


As part of our analysis, we also did a comparison of the ffmpeg.dll in 3CX with the same file in other Electron apps.


Our analysis has shown only the 3CX ffmpeg.dll contains the malicious code.


We conclude from this that this compromise does not affect other Electron apps — only the 3CX ffmpeg.dll. Figure 4: What the affected 3CX developers and customers experienced Allowing the abused software to remain functional is not dissimilar to other DLL sideloading cases we’ve seen, but this campaign is slightly different even from the current rash of DLL sideloading cases we’ve seen.


In particular, we’ve noted that the PE shellcode loader in use is unique in our experience.


Previous to this, we’ve only seen it in incidents attributed to the Lazarus group; the code in this incident is a byte-to-byte match to those previous samples.


TimeStamp Check Analysis As part of our ongoing investigation, we found a timestamp mechanism in the code as shown below.


Figure 5: A timestamp mechanism in the code Looking at this, we can see a while loop that calls the check_timestamp function and receives a 64-bit integer value from GetSystemTimeAsFileTime Api call.


The results of check_timestamp are evaluated against “v6,” a variable which holds the value coming from cbData.


cbData is collected from the “manifest” file as shown below.


Figure 6: Collecting the cbData “manifest” is a file that the malware writes to the system under the “3cxdesktopapp” folder during the initial stage of the infection.


When the manifest is created, a dword value is written based on the current timestamp, with additional arithmetic operations performed on it.


The above code checks if manifest exists and is writeable; if so, then it adds 7 days + the current system timestamp + rand() generated number % 21 days.


In other words, the value be up to a total of 28 days ahead.


Otherwise, it just reads the existing value from the manifest file.


So long as the results of check_timestamp are less than v6 (the timestamp value from manifest), the loop continues to sleep.


Only once the results of check_timestamp are greater than the manifest timestamp will the code proceed and generate the HTTP request to connect with GitHub, which initiates the payload download.


Hunting information Determining impact with Sophos XDR 1.


Determining whether hosts have communicated with threat actor infrastructure:


Data Lake The below query will search for hosts that have communicated with the various known URLs in use by this campaign.


SELECT meta_hostname, sophos_pids, domain, clean_urls, source_ips, destination_ips, timestamps, ingestion_timestamp FROM xdr_data WHERE query_name = 'sophos_urls_windows' AND (LOWER(domain) LIKE '%akamaicontainer[.]com%' OR LOWER(domain) LIKE '%akamaitechcloudservices[.]com%' OR LOWER(domain) LIKE '%azuredeploystore[.]com%' OR LOWER(domain) LIKE '%azureonlinecloud[.]com%' OR LOWER(domain) LIKE '%azureonlinestorage[.]com%' OR LOWER(domain) LIKE '%dunamistrd[.]com%' OR LOWER(domain) LIKE '%glcloudservice[.]com%' OR LOWER(domain) LIKE '%journalide[.]org%' OR LOWER(domain) LIKE '%msedgepackageinfo[.]com%' OR LOWER(domain) LIKE '%msstorageazure[.]com%' OR LOWER(domain) LIKE '%msstorageboxes[.]com%' OR LOWER(domain) LIKE '%officeaddons[.]com%' OR LOWER(domain) LIKE '%officestoragebox[.]com%' OR LOWER(domain) LIKE '%pbxcloudeservices[.]com%' OR LOWER(domain) LIKE '%pbxphonenetwork[.]com%' OR LOWER(domain) LIKE '%pbxsources[.]com%' OR LOWER(domain) LIKE '%qwepoi123098[.]com%' OR LOWER(domain) LIKE '%sbmsa[.]wiki%' OR LOWER(domain) LIKE '%sourceslabs[.]com%' OR LOWER(domain) LIKE '%visualstudiofactory[.]com%' OR LOWER(domain) LIKE '%zacharryblogs[.]com%' OR (LOWER(domain) LIKE '%raw.githubusercontent[.]com%' AND LOWER(clean_urls) LIKE '%/iconstorages/images/main/%'))


2. Determining whether hosts have interacted with malicious files SELECT f.filename, f.directory, ROUND((f.size * 10e-7),2) AS size_MB, h.sha256, f.type, f.attributes, f.mode, datetime(f.btime,'unixepoch') AS file_created_time, datetime(f.atime,'unixepoch') AS file_last_access_time, datetime(f.mtime,'unixepoch') AS file_last_modified_time, datetime(f.ctime,'unixepoch') AS file_last_status_change_time, f.uid, u.username AS file_owner FROM file f LEFT JOIN users u ON f.uid = u.uid LEFT JOIN groups g ON f.gid = g.gid LEFT JOIN hash h ON f.path = h.path


WHERE f.path like 'c:\users\%\appdata\local\programs\3cxdesktopapp\app\%'


AND (f.filename = 'ffmpeg.dll' OR f.filename LIKE 'd3dcompiler%.dll' OR f.filename = 'trololo.dll')


AND (h.sha256 = 'c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02' OR h.sha256 = '11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03' OR h.sha256 = '7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896' OR h.sha256 = 'aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973')


Determining whether hosts are running affected versions SELECT MIN(ingestion_timestamp) AS first_seen, MAX(ingestion_timestamp) AS last_seen, meta_hostname, ARRAY_JOIN(ARRAY_AGG(DISTINCT(meta_hostname)), ', ')


AS hosts, ARRAY_JOIN(ARRAY_AGG(sophos_pid),', ')


AS spids, LOWER(name) AS name, sha256, company_name, file_description, file_size, file_version, original_filename FROM xdr_data WHERE query_name = 'running_processes_windows_sophos' AND ( LOWER(name) = '3cxdesktopapp.exe' OR LOWER(original_filename) = '3cxdesktopapp.exe' OR LOWER(product_name)


='3cx desktop app')


GROUP by meta_hostname, LOWER(name), sha256, company_name, file_description, file_size, file_version, original_filename ORDER BY meta_hostname desc 4.


Determining whether hosts have communicated with threat actor infrastructure, for MacOS SELECT meta_hostname, date_format(from_unixtime(time), '%Y-%m-%d


%H:%i:%s')


AS date_time, ingestion_timestamp pid, name, cmdline, path, parent, gid, uid, euid, egid, sha1, sha256 FROM xdr_data WHERE query_name = 'running_processes_osx_events' AND LOWER(cmdline) LIKE '%sh -c%' AND LOWER(cmdline) LIKE '%/3cx desktop app/updateagent%' 5.


Enabling firewall customers to identify activity to malicious domains SELECT timestamp, log_component, log_subtype, user_name, user_group, app_name, src_ip, src_port, protocol, dst_ip, dst_port, http_category, url, domain, http_user_agent, http_status FROM xgfw_data WHERE LOWER(log_component) = 'http' AND (LOWER(domain) = 'akamaicontainer.com' OR LOWER(domain) = 'akamaitechcloudservices.com' OR LOWER(domain) = 'azuredeploystore.com' OR LOWER(domain) = 'azureonlinecloud.com' OR LOWER(domain) = 'azureonlinestorage.com' OR LOWER(domain) = 'dunamistrd.com' OR LOWER(domain) = 'glcloudservice.com' OR LOWER(domain) = 'journalide.org' OR LOWER(domain) = 'msedgepackageinfo.com' OR LOWER(domain) = 'msstorageazure.com' OR LOWER(domain) = 'msstorageboxes.com' OR LOWER(domain) = 'officeaddons.com' OR LOWER(domain) = 'officestoragebox.com' OR LOWER(domain) = 'pbxcloudeservices.com' OR LOWER(domain) = 'pbxphonenetwork.com' OR LOWER(domain) = 'pbxsources.com' OR LOWER(domain) = 'qwepoi123098.com' OR LOWER(domain) = 'sbmsa.wiki' OR LOWER(domain) = 'sourceslabs.com' OR LOWER(domain) = 'visualstudiofactory.com' OR LOWER(domain) = 'zacharryblogs.com' OR (LOWER(domain) LIKE '%raw.githubusercontent.com%' AND LOWER(url) LIKE '%/iconstorages/images/main/%'))


Enabling firewall customers to identify user agents of compromised version of 3cx SELECT timestamp, log_component, log_subtype, user_name, user_group, app_name, src_ip, src_port, protocol, dst_ip, dst_port, http_category, url, domain, http_user_agent, http_status FROM xgfw_data WHERE LOWER(log_component) = 'http' AND ( LOWER(http_user_agent) LIKE '%3cxdesktopapp/18.12.402%' OR LOWER(http_user_agent) LIKE '%3cxdesktopapp/18.12.416%' OR LOWER(http_user_agent) LIKE '%


3cxdesktopapp/18.12.407%' OR LOWER(http_user_agent) LIKE '%3cxdesktopapp/18.11.1213%' OR LOWER(http_user_agent) LIKE '


%3cxdesktopapp/18.11.1197%' )


We also recommend that users of 3CX’s software continue to monitor the company’s communications channels; they have a blog and also a support-and-information forum.


As of March 30, the company was recommending that customers uninstall and reinstall the app, and suggested that they might also use the company’s browser-based PWA client while the situation was sorted out.


On March 31, 3CX noted that Google has invalidated the company’s previous signing certificate, which means both the originally infected MSI files plus files issued by 3CX earlier in the week using that certificate will be blocked, and issued a fresh one.


3CX at this writing is building entirely new MSI installers using the newly issued certificate.


This applies to Windows only, as the company states they will not be rebuilding the Mac version of the desktop app yet while they focus on the Windows version (and on the security breach in general).


An updated list of IOCs for this attack is published on our GitHub.


Detection protection SophosLabs has blocked the malicious domains and published the following detections: Static detections: Troj/Loader-AF (Trojanized ffmpeg.dll) Troj/Mdrop-JTQ (installers) Troj/Steal-DLG OSX/Mdrop-JTR (installers) OSX/Loader-AG (Trojanized ffmpeg.dll) Reputation detection: Mal/Generic-R / Mal/Generic-S (d3dcompiler with appended shellcode) Memory detection: We have also blocked the list of known C2 domains associated with the threat and will continue to add to that list in the IOC file on our GitHub, as noted above.


Finally, the two malicious versions of the ffmpeg.dll bundled in the affected 3CXapplication are flagged by their hashes as being of low reputation.


SophosLabs is actively investigating additional detection opportunities for activity stemming from this software.


In addition, for customers of Sophos MDR, the MDR Detection Engineering team has a variety of behavioral detections in place that will detect follow up activity.


The LockBit ransomware (kinda) comes for macOS Analyzing a arm64 mach-O version of LockBit by: Patrick Wardle / April 16, 2023 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: :memo: :alien_monster: Want to play along?

The LockBit ransomware kinda comes for macOS


As “Sharing is Caring” I’ve uploaded the malicious binary LockBit to our public macOS malware collection.


The password is: infect3d ...please though, don't infect yourself!


Background Late Saturday (April 15the), @MalwareHunterTeam tweeted about a new LockBit ransomware variant targeting macOS: As shown in the tweet, the ransomware binary initially was undetected by any of the anti-virus engines on VirusTotal: locker_Apple_M1_64 on VirusTotal (image credit: @MalwareHunterTeam)


Good news, if you refresh the page on VirusTotal the av engines are now starting to pick up the file as malicious.


Shortly after @MalwareHunterTeam’s tweet, the fine folks of @vxunderground added their thoughts and shared samples: The relevance of this macOS specimen is well articulated in VXUnderground’s tweet: “Lockbit ransomware group has created their first MacOS-based payload.


We believe this is the first time a large ransomware threat group has developed a payload for Apple products.”


-VXUnderground


Ok, so even though it’s the weekend, we have what appears to be a new macOS malware specimen from one of the more notorious ransomware gangs!


Coupled with the fact that this may be, (as noted by @VXUnderground), “the first time a large ransomware threat group has developed a payload for Apple products” …I was intrigued to decided to dig right in!


In this blog post we’ll tear apart the sample, showing that ultimately, while yes it can indeed run on Apple Silicon, that is basically the extent of it’s impact.


Thus macOS users have nothing to worry about …for now!


Triage The (SHA-1) hash for the binary (aptly named locker_Apple_M1_64) is 9e9a5f8d86356796162cee881c843cde9eaedfb3 While we're only focusing on the macOS sample, it appears the LockBit group has built this sample for a host of other OS's: Using macOS’s file utility, we see the locker_Apple_M1_64 binary is an x86_64 (Intel) Mach-O: % file LockBit/locker_Apple_M1_64 LockBit/locker_Apple_M1_64: Mach-O 64-bit executable arm64 And what about it’s code signing information?


Let’s take a peek via macOS’s codesign and spctl utilities:


% codesign -dvv


LockBit/locker_Apple_M1_64 Executable=LockBit/locker_Apple_M1_64 Identifier=locker Format=Mach-O thin (arm64) CodeDirectory v=20400 size=3295


flags=0x20002(adhoc,linker-signed) hashes=100+0 location=embedded Signature=adhoc Info.plist=not bound TeamIdentifier=not set Sealed Resources=none Internal requirements=none % spctl -a -vvv


-t install LockBit/locker_Apple_M1_64 LockBit/locker_Apple_M1_64: invalid signature (code or signature have been modified)


The codesign utility shows that though it’s signed, it’s signed “ad-hoc” (say vs. an Apple Developer ID).


This means if downloaded to a macOS system (i.e. deployed by the attackers) macOS won’t let it run.


This is confirmed by the spctl utility which shows “invalid signature” …or if you’re brave enough to try run it: An invalid signature means macOS will block it Let’s now run the strings command (with the "-" option which instructs it to scan the whole file), we find a few strings that appear to be related to standard ransomware activity including: Encryption File Extensions Ransom instructions % strings - -n 3 locker_Apple_M1_64 curve25519xsalsa20poly1305 blake2b blake2b_final blake2b-ref.c sodium_crit_enter _sodium_malloc /dev/urandom /dev/random ...


cmd ani adv msi msp com nls ocx mpa cpl mod hta prf rtp rdp bin shs wpx bat rom msc spl ics key exe dll ... restore-my-files.txt ... winmd ntldr ntuser.dat.log bootsect.bak autorun.inf thumbs.db iconcache.db Also interesting are the strings related to Windows artifacts (e.g. autorun.inf, ntuser.dat.log, etc…).


This may indicate the ransomware was originally written to target Windows platforms.


This wraps up our triage of the locker_Apple_M1_64 binary.


Time to dive in deeper with our trusty friends: the disassembler and debugger!


Analysis of locker_Apple_M1_64 In this section we’ll more deeply analyze the malicious logic of the locker_Apple_M1_64 binary …which is simplified by the fact that the binary’s symbols aren’t stripped.