Attackers use sophisticated malware to attack Russian businesses

Since the end of last year, we have begun monitoring a new malicious campaign to spread a banking Trojan. The attackers focused on compromising Russian companies, i.e. corporate users. The malicious campaign was active for at least a year, and in addition to the banking Trojan, the attackers resorted to using various other software tools. These include a special bootloader packaged using NSIS, and spyware that is disguised as the well-known legitimate Yandex Punto software. As soon as the attackers managed to compromise the victim's computer, they install a backdoor there, and then a banking Trojan.

For their malware, the attackers used several valid (at the time) digital certificates and special methods to bypass AV products. The malicious campaign was targeted at a large number of Russian banks and is of particular interest because the attackers used methods that are often used in targeted attacks, i.e. attacks not motivated by purely financial fraud. One can note some similarities between this malicious campaign and a major incident that received much publicity earlier. We are talking about a cybercriminal group that used a banking Trojan Anunak/Carbanak.

Злоумышленники устанавливали вредоносное ПО только на те компьютеры, которые использовали русский язык в Windows (локализация) по умолчанию. Основным вектором распространения трояна был документ Word с эксплойтом CVE-2012-0158, which was sent as an attachment to the document. The screenshots below show the appearance of such fake documents. The first document is entitled “Account No. 522375-FLORL-14-115.doc”, and the second “kontrakt87.doc”, it is a copy of the contract for the provision of telecommunications services by the mobile operator Megafon.

Rice. 1. Phishing document.

Rice. 2. Another modification of the phishing document.

The following facts indicate that the attackers were targeting Russian business:

• distribution of malicious software using fake documents of the specified subject;
• tactics of attackers and the malicious tools they use;
• links to business applications in some executable modules;
• names of malicious domains that were used in this campaign.

Специальные программные инструменты, которые злоумышленники устанавливают в скомпрометированной системе, позволяют им получать удаленный контроль за системой и отслеживать деятельность пользователя. Для выполнения этих функций они устанавливают бэкдор, а также пытаются получить пароль от аккаунта учетной записи Windows или создать новый аккаунт. Злоумышленники также прибегают к услугам кейлоггера (клавиатурного шпиона), похитителя информации из буфера обмена Windows (clipboard stealer), а также специального ПО для работы со смарт-картами. Эта группа пыталась скомпрометировать и другие компьютеры, которые находились в той же локальной сети что и компьютер жертвы.

Our ESET LiveGrid telemetry system, which allows you to quickly track malware distribution statistics, provided us with interesting geographical statistics on the distribution of malware used by attackers in the mentioned campaign.

Rice. 3. Statistics on the geographical distribution of the malware that was used in this malicious campaign.

Malware installation

После открытия пользователем вредоносного документа с эксплойтом на уязвимой системе, туда будет загружен и исполнен специальный загрузчик (downloader), упакованный с помощью NSIS. В начале своей работы программа проверяет окружение Windows на предмет присутствия там отладчиков или запуска в контексте виртуальной машины. Она также проверяет локализацию Windows и посещал ли пользователь ниже перечисленные в таблице URL-адреса в браузере. Для этого используются API FindFirst/NextUrlCacheEntry and the SoftwareMicrosoftInternet ExplorerTypedURLs registry key.

The bootloader checks for the presence of the following applications on the system.

The list of processes is really impressive and, as you can see, there are not only banking applications in it. For example, the executable file named "scardsvr.exe" refers to the smart card software (Microsoft SmartCard reader). The banking trojan itself includes the ability to work with smart cards.

Rice. 4. General scheme of the malware installation process.

В случае успешного выполнения всех проверок, загрузчик скачивает с удаленного сервера специальный файл (архив), который содержит все вредоносные исполняемые модули, используемые злоумышленниками. Интересно отметить, что в зависимости от выполнения вышеперечисленных проверок, скачиваемые с удаленного C&C-сервера архивы могут различаться. Архив может быть вредоносный и нет. В случае не вредоносного, он устанавливает пользователю Windows Live Toolbar. Скорее всего, злоумышленники пошли на подобные ухищрения для обмана автоматических систем анализа файлов и виртуальных машин, на которых исполняются подозрительные файлы.

The file downloaded by the NSIS loader is a 7z archive that contains various malware modules. The figure below shows the entire installation process of this malware and its various modules.

Rice. 5. General scheme of malware operation.

Although the downloaded modules serve different purposes for attackers, they are packaged in the same way and many of them have been signed with valid digital certificates. We found four such certificates that the attackers have been using since the beginning of the campaign. After our complaint, these certificates were revoked. It is interesting to note that all certificates were issued to companies registered in Moscow.

Rice. 6. The digital certificate that was used to sign the malware.

The following table lists the digital certificates that the attackers used in this malicious campaign.

Almost all malicious modules used by attackers have an identical installation procedure. They are self-extracting 7zip archives that are password protected.

Rice. 7. Fragment of the batch file install.cmd.

The batch .cmd file is responsible for installing malware into the system and launching various malicious tools. If the execution requires missing administrator rights, the malicious code uses several methods to obtain them (bypassing UAC). To implement the first method, two executable files named l1.exe and cc1.exe are involved, which specialize in bypassing UAC with a mechanism from leaked source code for Carberp. Another way is based on the exploitation of the CVE-2013-3660 vulnerability. Each malware module that requires privilege escalation contains both a 32-bit and a 64-bit version of the exploit.

During the tracking of this campaign, we analyzed several archives downloaded by the uploader. The contents of the archives varied, i.e. the attackers could adapt the malicious modules for different purposes.

User compromise

Как мы упоминали выше, злоумышленники используют специальные инструменты для компрометации компьютеров пользователей. К таким инструментам относятся программы с названиями исполняемых файлов mimi.exe and xtm.exe. Они помогают злоумышленникам установить контроль за компьютером жертвы и специализируются на выполнении следующих задач: получение/восстановление паролей к аккаунтам учетных записей Windows, включение сервиса RDP, создание нового аккаунта (учетной записи) в ОС.

The executable file mimi.exe includes a modified version of a well-known open source tool Mimikatz. Этот инструмент позволяет получать пароли аккаунтов пользователей Windows. Злоумышленники удалили из Mimikatz ту часть, которая отвечает за взаимодействие с пользователем. Исполняемый код был также модифицирован таким образом, чтобы при запуске Mimikatz запускался с командами privilege::debug и sekurlsa:logonPasswords.

Another executable file, xtm.exe, launches special scripts that turn on the RDP service in the system, try to create a new account in the OS, and also change system settings in such a way as to allow multiple users to simultaneously connect to the compromised computer via RDP. Obviously, these steps are necessary to gain complete control over the compromised system.

Rice. 8. Commands executed by xtm.exe in the system.

Attackers use another executable file called impack.exe, which installs special software on the system. This software is called LiteManager and is used by attackers as a backdoor.

Rice. 9. LiteManager interface.

Once installed on a user's system, LiteManager allows attackers to directly connect to that system and control it remotely. This software has special command-line options for installing it behind the scenes, creating special firewall rules, and running its module. All parameters are used by attackers.

The last module of the malware bundle used by the attackers is a banking malware (banker) with the executable file name pn_pack.exe. She specializes in spying on the user and is responsible for interacting with the controlling C&C server. The banker is launched using legitimate Yandex Punto software. Punto is used by attackers to launch a malicious DLL library (DLL Side-Loading method). The malware itself can perform the following functions:

• track keystrokes on the keyboard and the contents of the clipboard for their subsequent transfer to a remote server;
• list all smart cards that are present in the system;
• interact with a remote C&C server.

The malware module that is responsible for performing all these tasks is an encrypted DLL. It is decrypted and loaded into memory during Punto execution. To perform the above tasks, the executable DLL code starts three threads.

The fact that the attackers chose the Punto software for their purposes is not a surprise: some Russian forums openly provide detailed information on such a topic as using flaws in legitimate software to compromise users.

The malicious library uses the RC4 algorithm to encrypt its strings, as well as during network interaction with the C&C server. It contacts the server every two minutes and transfers there all the data that was collected on the compromised system during this period of time.

Rice. 10. A fragment of the network interaction between the bot and the server.

The following are some of the C&C server instructions that the library can receive.

In response to receiving instructions from the C&C server, the malware responds with a status code. It is interesting to note that all of the banker modules we have analyzed (the most recent with a compilation date of January 18th) contain the string "TEST_BOTNET" that is sent in every message to the C&C server.

Conclusion

In order to compromise corporate users, attackers at the first stage compromise one employee of the company by sending a phishing message with an exploit. Further, as soon as the malware is installed in the system, they will use software tools that will help them significantly increase the authority in the system and perform additional tasks on it: compromise other computers on the corporate network and spy on the user, as well as on bank transactions that he performs.

Source: habr.com