di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

Introduction to the Framework

Cobalt Strike (CS) is a paid penetration testing toolkit that allows an attacker to deploy a component named Beacon o

11.jpg

Introduction to the Framework
<a href="https://www.cobaltstrike.com/">Cobalt Strike</a> (CS) is a paid penetration testing toolkit that allows an attacker to deploy a component named Beacon on a victim’s machine. The simplicity, reliability, and versatility of CS make it very popular among threat actors—and there are plenty of cracked versions of CS available on the dark web<a href="#_ftn1" name="_ftnref1">[1]</a>. Given this reality, it’s been used frequently in recent cyber-attacks<a href="#_ftn2" name="_ftnref2">[2]</a>.
CS provides a wealth of functionality to the attacker, including command execution, key logging<a href="#_ftn3" name="_ftnref3">[3]</a>, file transfer, privilege escalation, port scanning, lateral movement, and more. The framework is split into two components: client and server. The server module, aka team server, is the controller of the Beacon payload. By using this module the attacker can track and execute commands on an infected host and utilize all of the framework capabilities.
Cobalt Strike Beacon
The Beacon, which is the main component being used to target accounts, allows its operators to execute commands, log keystrokes, drop files, and communicate with targeted systems. CS is primarily used as a post-exploitation tool; leveraged by attackers after they have a foothold in a system and want to remain hidden.
Deploying a Beacon and making sure its communication will stay hidden from cybersecurity products and teams is a critical task for adversaries. The Beacon has several communication methods<a href="#_ftn4" name="_ftnref4">[4]</a> to make this happen, including HTTP, HTTPS, DNS, and SMB. By default, the Beacon will reach out to its C2 periodically, sending meta-data back and gathering any commands issued by the operator. The Beacon console allows the attacker to monitor which tasks were issued to a Beacon and track their status, check the output of commands, and find additional information on targets.
How Attackers Use Cobalt Strike
Even though CS is a paid penetration testing product, it is incredibly popular due to its wealth of capabilities and its ability to add new features and modify existing ones. This flexibility allows attackers to implement their own tools, use built-in tools, or integrate other penetration testing tools such as the <a href="https://www.metasploit.com/">Metasploit framework</a> and Mimikatz. By design the main use of CS is to act as a post-exploitation tool that allows attackers to gather information, harvest credentials, and deploy other payloads on an infected host. That also means that is not designed to gain initial access to a system, even though it does have components that can help to gain access such as its VBA macros and Windows-executable generators.
CS provides the attacker a wide set of tools; we will cover some of the framework capabilities from an attack-chain point of view. The full list of capabilities is available in the <a href="https://attack.mitre.org/software/S0154/">MITRE matrix</a><a href="#_ftn5" name="_ftnref5">[5]</a>.
Initial Access
<ul>
<li>System Profiler: A honeypot used as a reconnaissance tool to collect information about a target. It is designed to collect information on systems or users that visit CS-controlled servers and provide a list of applications and plug-ins discovered (it is not designed to infect a host).</li>
<li>MS-Macros Generator: CS can generate VBA code to embed in Office documents.</li>
<li>Website Clone Tool: This tool can create a local copy of a website with some code added to fix links and images so they work as they should. An attacker can lure a victim to enter the cloned website to collect information about the victim’s network.</li>
<li>Windows Loaders and Payload Generator: CS can generate a Windows executable, a script (e.g., PowerShell, HTA), or a raw blob of position-independent code that contains a Beacon. CS provides an internal kit for building shellcode and executables. The kit can be easily modified to suit attacker’s needs.</li>
<li>Phishing: The CS phishing module helps an attacker replace links and text to build a convincing phish in an email template, which it can send to multiple recipients and track who entered them. This module can be used along with the website clone tool to lure a victim into CS-owned websites.</li>
</ul>
Privilege Escalation and Lateral Movement
<ul>
<li>Mimikatz: An open-source tool that allows users to view and save credentials, extract plaintext passwords, hash, PIN codes, and Kerberos tickets from the systems memory. Mimikatz is fully supported in CS. Attackers can run and execute Mimikatz commands directly from the CS command-line interface.</li>
<li>User-Account-Contraol (UAC) Bypass<a href="#_ftn6" name="_ftnref6">[6]</a>: CS can bypass UAC by utilizing a method called reflective DLL injection.</li>
<li>Antimalware Scan Interface (AMSI) Bypass: CS can bypass AMSI by patching OS functions that limit AMSI’s capabilities.</li>
</ul>
Commands Execution
<ul>
<li>Aggressor Script: CS has its own scripting language which allows its users to modify and extend the Beacons functionality.</li>
<li>Running Commands: CS uses a command-line interface to interact with infected systems. The commands may run via cmd.exe<a href="#_ftn7" name="_ftnref7">[7]</a>, powershell.exe<a href="#_ftn8" name="_ftnref8">[8]</a>, psinject<a href="#_ftn9" name="_ftnref9">[9]</a>, Powerpick<a href="#_ftn10" name="_ftnref10">[10]</a>, and more.</li>
<li>Native API<a href="#_ftn11" name="_ftnref11">[11]</a>: Beacon can run shell commands without cmd.exe or powershell.exe by directly calling the OS API functions or by using <a href="https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick">Powerpick</a>, which is a program that allows the execution of Powershell without the use of Powershell.exe.</li>
</ul>
Command and Control Communication
<ul>
<li>Web Protocols: CS uses its own command-and-control communication protocol that can be encapsulated by HTTP/HTTPS/DNS.</li>
<li>SMB (Server Message Block): CS can conduct P2P communication over Windows-named pipes encapsulated in the SMB protocol.</li>
</ul>
Protection from Cobalt Strike
Deep Instinct prevents the CS framework and its components at all attack stages. The first possible attack vector is loaders. Whether they are Windows executables or Office documents, we prevent them and stop the attack chain at the earliest possible stage by using Deep-Learning based static analysis.
In the event that an attacker has already gained access into a victim’s system and is trying to deploy a Beacon, our behavioral capabilities can spot in-memory actions such as DLL injection and shellcode execution and prevent these post-exploitation attempts from running. In addition, our PowerShell Deep Learning-based static analysis and behavioral analysis will prevent all malicious PowerShell activities.
Summary
Cobalt Strike is a paid penetration testing product that is in continual development and its team builds the framework with the most advanced and up-to-date security features and capabilities. Since CS is being used by both security teams and threat actors for the same purposes it poses a serious and ongoing threat for security products, organizations, and individuals.
Using our advanced Deep Learning-based static analysis and behavioral capabilities, customers of Deep Instinct can be rest assured that they have protection against Cobalt Strike and its capabilities as the attack is detected and prevented in a matter of milliseconds.
To see our capabilities for yourself, request a demo via our <a href="https://www.deepinstinct.com/contact-us/">contact us form</a>.
----------------------------------------
<a href="#_ftnref1" name="_ftn1">[1]</a> https://www.bleepingcomputer.com/news/security/alleged-source-code-of-cobalt-strike-toolkit-shared-online/
<a href="#_ftnref2" name="_ftn2">[2]</a> https://www.bleepingcomputer.com/news/security/solarwinds-hackers-used-7-zip-code-to-hide-raindrop-cobalt-strike-loader/
<a href="#_ftnref3" name="_ftn3">[3]</a> https://attack.mitre.org/techniques/T1056/001
<a href="#_ftnref4" name="_ftn4">[4]</a> https://attack.mitre.org/techniques/T1071/001/
<a href="#_ftnref5" name="_ftn5">[5]</a> <a href="https://attack.mitre.org/software/S0154/">https://attack.mitre.org/software/S0154/</a>
<a href="#_ftnref6" name="_ftn6">[6]</a> https://attack.mitre.org/techniques/T1548/002/
<a href="#_ftnref7" name="_ftn7">[7]</a> https://attack.mitre.org/techniques/T1059/003/
<a href="#_ftnref8" name="_ftn8">[8]</a> https://attack.mitre.org/techniques/T1059/001
<a href="#_ftnref9" name="_ftn9">[9]</a> https://github.com/EmpireProject/PSInject
<a href="#_ftnref10" name="_ftn10">[10]</a> https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerPick
<a href="#_ftnref11" name="_ftn11">[11]</a> https://attack.mitre.org/techniques/T1106

Cobalt Strike – Post-Exploitation Attackers Toolkit

In the past months since the Covid-19 outbreak, we have seen an enormous rise in mal-spam campaigns where hackers abuse the pandemic to try and claim 

Aggah.jpg

In the past months since the Covid-19 outbreak, we have seen an enormous rise in mal-spam campaigns where hackers abuse the pandemic to try and claim victims. One such campaign that we spotted is a new variant of a unique malware loader named ‘Aggah’.
Aggah is a <a href="https://www.deepinstinct.com/2018/06/27/be-fearless-when-it-comes-to-file-less-malware-attacks/" target="_blank" rel="noopener noreferrer">fileless multi-stage malware</a> loader which utilizes dual-use tools along with free and open web hosting services such as Bitly and Pastebin to hold its resources. Most of these resources hold HTA scripts with embedded PowerShell scripts that run one after the other, until the drop of the final payload which in our case was one of the following spyware strains:
<ul>
<li>Agent Tesla</li>
<li>Remcos RAT</li>
<li>NanoCore RAT</li>
</ul>
A previous campaign, with similar characteristics, was recently <a href="https://blog.talosintelligence.com/2020/04/upgraded-aggah-malspam-campaign.html" target="_blank" rel="noopener noreferrer">published by Talos</a> in April where they observed a malspam campaign that was used to distribute remote access trojans (RATs). In their discovery they noted that the infection chain was highly versatile and could be adapted towards different malware payloads. The attackers were also using publicly available infrastructure, like Bitly and Pastebin to direct and host the attack components.
Highlights
The use of Pastebin URLs to store the resources of the malware is used as a fileless technique. Almost all Aggah’s PowerShell scripts will be written into the registry as MSHTA commands with a Pastebin URL. This means that during the attack sequence there are no malicious binaries written to the disk, making the attack fully fileless.
In this new variant of Aggah, we have seen some interesting behavior not only from a technical point of view but what appears to be a veiled attempt at self-expression. Strings extracted from analyzed files reveal traces of the malware author. It seems the author of Aggah is trying to provoke security researchers by leaving conspicuous code variables and strings such as:
` iwannajoinuiwannaleavedsshit`, `iwannaleftsellingtools`, `iamreasearcher`
<img class="alignnone wp-image-7015 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/05/extracted-strings-1000x62.jpg" alt="" width="1000" height="62" />
<pre>Image: Extracted strings from Aggah</pre>
&nbsp;
The following section of the blog will describe in detail the infection flow of the malware.
&nbsp;
<img class="alignnone wp-image-7021 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcd5c6609863ea57b/611a7c390f2526164975293d/Full-infection-chain.jpg" alt="" width="600" height="441" />
<pre>Image: Full infection chain</pre>
&nbsp;
Stage 1:
Aggah is distributed by Microsoft Office documents with malicious VBA macros in them. In this campaign we have seen several PowerPoint presentations, some with <a href="https://www.deepinstinct.com/2020/03/26/attackers-abuse-the-covid-19-pandemic-to-spread-malware/" target="_blank" rel="noopener noreferrer">Covid-19 related names</a>, and others are invoices. The presentations are usually empty of content, besides a short and simple VBA macro that uses a StrReverse function to evade basic detection by AV products. Once opened it downloads the next stage of the malware via the “Shell” command.
<img class="alignnone wp-image-7010 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbdbc218cf938274d/611a7c3dbf98451666a132fe/VBA-code-embedded-in-the-ppt.jpg" alt="" width="830" height="120" />
<pre>Image: VBA code embedded in the ppt
</pre>
&nbsp;
Stage 2:
The Bitly URL at stage one will redirect to a Pastebin page which holds a VBScript, the second stage of the infection.
The second stage is carried out as follows:
1) Runs stage three of the malware by the command: (its role will be mentioned as ‘Stage 3’)
<img class="alignnone wp-image-7017 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd6e8c667e81409b3/611a7c383661bc1698fda42a/MSHTA-command-that-will-execute-the-VBScript-from-Pastebin-content.jpg" alt="" width="812" height="28" />
<pre>Image: MSHTA command that will execute the VBScript from Pastebin content

</pre>
2) Run a scheduled task that will execute -1- every 80 minutes
3) Set several autorun registry keys by using the command:
<img class="alignnone wp-image-7014 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/05/Example-for-registry-key-that-is-written-1000x44.jpg" alt="" width="1000" height="44" />
<pre>Image: Example of a registry key that is written</pre>
&nbsp;
The registry key’s content point to yet more several different Pastebin pages that hold more VBScripts with the following functionalities:
a) Bitcoin Hijacker
b) WMI object that will run the content of one of the registry keys
c) .NET binary used for elevating privileges (optional)
Bitcoin Hijacker, which has not yet been publicly reported, is a simple clipboard hijacker, which uses regex to search for copied clipboard addresses and replace it with one of four hardcoded bitcoin addresses of the attacker.
<img class="alignnone wp-image-7012 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbed9d8ff7d8e6eb1/611a7c3c23889615ca2c8e6a/Bitcoin-Hijacker-main-function.jpg" alt="" width="868" height="322" />
<pre>Image: Bitcoin Hijacker</pre>
&nbsp;
b) Run one of the registry autorun keys that was set previously via WMI. Usually it is the Bitcoin Hijacker, it varies between different samples and sometimes points to a Pastebin URL with no content at all.
c) .NET binary which uses CMSTP.exe technique. CMSTP.exe is a command-line program that accepts an INF file and installs it as a leveraged service. Aggah uses this technique by extracting an INF file from the binary resources and uses it for privilege escalation and AV evasion. It does so by setting various registry keys and ensuring that the process is running with elevated privileges. Some of its capabilities are:
<ul>
<li>UAC bypass</li>
<li>Disable Microsoft Office security mechanisms</li>
<li>Exclude certain processes from Windows Defender scans</li>
<li>Set Windows Defender preferences</li>
</ul>
<img class="alignnone wp-image-7006 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1383c5ec6cb77479/611a7c43f65bfe1659322d35/NET-binary-which-uses-CMSTP.jpg" alt="" width="940" height="395" />
<pre>Image: .NET binary which uses CMSTP.exe</pre>
<img class="alignnone wp-image-7009 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/05/Set-Windows-Defender-registry-keys--1000x89.jpg" alt="" width="1000" height="89" />
<pre>Image: Set Windows Defender registry keys</pre>
<img class="alignnone wp-image-7008 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5de4d5f3fa5b53e8/611a7c4249650215ea9eb569/Set-MpPrefernce-PowerShell-.jpg" alt="" width="512" height="244" />
<pre>Image: Set MpPrefernce PowerShell command to disable Windows Defender feature</pre>
&nbsp;
Stage 3:
Part -1- at stage two will execute a VBScript which will create a registry key, set its content with a PowerShell script and execute it via WMI. The PowerShell script is responsible for loading three binaries into memory:
1) AMSI (Antimalware Scan Interface) bypass DLL
2) .NET based DLL which loads the RATs payload by its own exported functions
3) Execute the malware payload by Injecting it to a benign process (e.g InstallUtil.exe)
The PowerShell script holds a couple of byte blobs that will get decoded and decompressed to reveal the 2 DLLs. They will be used by the malware for both AV evasion and as the final payload dropper.
<img class="alignnone wp-image-7013 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/05/decompress_function-1000x384.jpg" alt="" width="1000" height="384" />
<pre>Image: Decompress function</pre>
&nbsp;
1) AMSI bypass DLL: AMSI which is a Windows interface that allows applications and services to integrate with any antimalware products present on a machine. After bypassing AMSI the attacker will be able to elevate privileges such as: UAC, PowerShell scripts, VBScripts and more.
2) .NET injector DLL which is used as the main loader of the RAT's payload. The Injector DLL will use its own API to load the RATs payload into a legitimate process after it is being downloaded and decoded, by creating a suspended process and injecting the malware payload to it using process-hollowing. In this campaign we have mainly seen the use of InstallUtil.exe as the benign process that will be hollowed and injected into. InstallUtil.exe is a legitimate Windows software for installing server resources, which is simply used as a host for the malware payload.
<img class="alignnone wp-image-7007 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/05/PowerShell-function--1000x196.jpg" alt="" width="1000" height="196" />
<pre>Image: PowerShell function that will drop the DLLs and load Aggah payload rOnAlDo and ChRiS - part of the loader API</pre>
&nbsp;
Stage 4 – Aggah payload:
The payload of Aggah might be any kind of malware, in this campaign Aggah authors use Agent Tesla and Remcos RAT as their final payload. However, it is this versatility that heightens the risk potential of Aggah to organizations, as it can be used to load many different types of malware.
&nbsp;
Evidence of a Hidden Creator
Since Aggha’s emergence in December 2019, it has undergone several updates and changes in its capabilities, the implication being that there is a team behind its development that continues to work on it and improve it. Aggah’s provocation directed to the security community appears to be an attempt to build their presence and gain recognition among hacker forums and Twitter, which has become a significant platform for security researchers and malware authors alike.
Aggah is indeed a complex malware that utilizes several dual-use tools such as PowerShell, MSHTA and CMSTP in order to infiltrate a system, and attack through a fileless attack sequence. This may be a serious threat for organizations as it has successfully bypassed many next-gen security products.
Using its advanced Deep Learning-based static analysis and behavioral capabilities, customers of Deep Instinct can rest assured that they have protection against Aggah as the attack is detected and prevented in a matter of milliseconds.
&nbsp;
IOCs:
Aggah samples:
64b46aeb798cf62e8636e740d5c96d07923b65f62ce9a81faa8e877943a6a57f
b7548ad92bd01edd1aadca4aceb01a8befb1da9146fbf71c698076569566d6a1
f509581a106b34bc73fa6f3caeaa31896cbb9af5f5a3e42fc9cce546aaf2e50d
fe38e708808c0e0b056c87c363b262727cde923a2e4e9e3831975b9c892067bd
263ccf468bdec8392d6601fd9c5546b456fa29976ec77f2fb3fa17ebf4ce664d
d8fd90f98df5d6066dd0fb362f44efe04cab8aa6f2170f60e2c5354bc3e07c7c
8cdc300e6639b8aa39aa7df1a2c281c2037ff1f8bf72dd173c958bcbe90b957e
6395297bafa84cc5d476a73fc5a432b62d9a50fa3ba14daf5eb63a91ddd897df
d62703021426ed717fb6f1bfdb39915a4437f5ff0d41220b1194f560de98732d
7a0fba12023cc29430be6503782e60c51bafe840097e44d1d99bd06a71c80d0c
4e359fd4c6593422398344a7a725630865ab0fc9f43ea9187aeb9e03f8f8d07e
Aggah dropped binaries:
e4d14ba73670184066a00cf5d3361580f6c4fbc5d0862a90278d82e95426faa5
8ed29945294e0ba0ae9d5c94c3871dfb00eb9c32b2c7a7704005b31642977a02
e950a0b3cd1e3d3036bf9fec80fd7ee4956211bb7f98744e9c452b5bd2370507
Malware payloads:
f3bde3186eb77d174654d2fadbad4bb42c7c78733792aebde8ecdb367dc30105
c760293dd5c5ed61fb29ec0fcf42e923753069c53a26654424941914b3c3da21
Pastebin:
hXXp://pastebin[.]com/raw/0GSp2GcJ
hXXp://pastebin[.]com/raw/3h2A07vy
hXXp://pastebin[.]com/raw/6h34bKWK
hXXp://pastebin[.]com/raw/7pSjJrKr
hXXp://pastebin[.]com/raw/9v0Useg7
hXXp://pastebin[.]com/raw/bjFTikhU
hXXp://pastebin[.]com/raw/eyGv9x4B
hXXp://pastebin[.]com/raw/m4mqd11x
hXXp://pastebin[.]com/raw/QVFcMmtc
hXXp://pastebin[.]com/raw/XiQ5QgfA
hXXp://pastebin[.]com/raw/y0AVKEUe
hXXps://pastebin[.]com/raw/dJ67A0nN
hXXps://pastebin[.]com/raw/i0k3LseW
hXXps://pastebin[.]com/raw/K3NdDnJJ
hXXps://pastebin[.]com/raw/QWQN5LFe
hXXps://pastebin[.]com/raw/u3iEpjsH
hXXps://pastebin[.]com/raw/U9DqxNXE
hXXps://pastebin[.]com/raw/X5Yz87MC
hXXp://pastebin[.]com/raw/6h34bKWK
hXXp://pastebin[.]com/raw/0GSp2GcJ
hXXp://pastebin[.]com/raw/bjFTikhU
hXXp://pastebin[.]com/raw/eyGv9x4B
hXXp://pastebin[.]com/raw/7pSjJrKr
hXXps://pastebin[.]com/raw/nGfpeevw
hXXps://pastebin[.]com/raw/GninhSJe
hXXps://pastebin[.]com/raw/UejdtPMX
hXXps://pastebin[.]com/raw/YweJ2HaS
hXXps://pastebin[.]com/raw/eXkmk43b
hXXps://pastebin[.]com/pyu2mbBr
hXXps://pastebin[.]com/B3NGSKK0
Bitly:
hXXps://j[.]mp/fvfkvbfdvifdvndiloawp
hXXps://j[.]mp/oapkcdoapckdadawa
hXXps://j[.]mp/seeinikseenuhcseenuhpssenu
hXXps://j[.]mp/hdjas7dhaskdb
hXXps://j[.]mp/hdjas782hjas
Network Indicators:
asorock11111[.]ddns[.]net
mannyp01[.]duckdns[.]org
&nbsp;

Aghast at Aggah: Teasing Security Controls with Advanced Evasion Techniques

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy