LummaC2 Malware and Harmful Chrome Extension Distributed through DLL Files

Short Summary:

The eSentire Threat Response Unit (TRU) reported a case involving LummaC2 stealer malware and a malicious Chrome extension that manipulates browser activities and facilitates data theft. The incident highlights the importance of endpoint security and user education against sophisticated threats.

Key Points:

• eSentire operates 24/7 SOCs with elite threat hunters and cyber analysts.
• Recent investigation revealed LummaC2 stealer malware and a malicious Chrome extension.
• The malware was delivered via a drive-by download of a ZIP file containing an MSI application.
• The MSI file executed a DLL side-loading technique to load the malicious payload.
• The malicious Chrome extension can manipulate web content and capture sensitive user data.
• eSentire’s TRU team isolated the affected host and assisted the customer in remediation.
• Recommendations emphasize the need for robust endpoint security and user education.

MITRE ATT&CK TTPs – created by AI

• DLL Side-Loading (T1574.002)
  • Utilized a legitimate executable “rnpkeys.exe” to load the malicious “rnp.dll” payload.

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In August 2024, the eSentire Threat Response Unit (TRU) observed a case of LummaC2 stealer malware and the malicious Google Chrome browser infections involving a drive-by download that delivered a malicious ZIP archive named “x64~x32~installer___.zip” containing an MSI app packaging file.

The MSI file contacts the C2 server at get-license2[.]com to retrieve the password needed to extract the malicious DLL “rnp.dll” (MD5: 1825d0310bf5029899f42004c4a1ef83) from the RAR archive “nijboq.rar” (MD5: 63efe86838e7196cedd93d7c10ac40e6). It uses the legitimate executable “rnpkeys.exe”, associated with the RNP library – a set of cryptographic tools that implement the OpenPGP (Pretty Good Privacy) standards and commonly used by Thunderbird.

This executable is located under “AppDataRoamingTroxbox PublishTroxApp” and is leveraged to load the malicious “rnp.dll” payload through a DLL side-loading technique (T1574.002). Researchers at Trellix provided analysis of a similar sample.

The malicious DLL led to the loader execution which eventually retrieved LummaC2 stealer and the PowerShell base64-encoded command that is responsible for retrieving the next-stage payload “02074.bs64” (MD5: 3b97f0f4f5a616d19d919c359ebd3086) from the C2 server at two-root[.]com/02074.bs64 and decrypting it using two rounds of XOR operations (Figure 1).

Upon the execution of the PowerShell script, the malicious Chrome extension named “Save to Google Drive” will be installed.

The malicious extension handles requests to set and get all balances of Facebook, Coinbase and Google Pay accounts and possibly execute financial transactions such as withdrawals of cryptocurrency funds. This involves sending JSON structured data that could include amounts, account identifiers, and other transaction-specific details provided below:

• exchange/create-account
• exchange/set-all-balances
• exchange/set-balance
• exchange/get-address
• exchange/set-withdraw

The extension also gathers device information including fetching hardware and system data (Figure 3), details about the current extension and any installed extensions as well as collects the browser’s user agent and all cookies and generates the unique UUID for the machine. All the collected data is then sent to the C2 server.

The extension also contains the code that manipulates browser behavior within “getInjections” function by opening specific URLs fetched from the C2 in nearly invisible popup windows and monitoring these for predefined content that contains payments.google, consent.youtube.com, accounts.google.com, and adsmanager.facebook.com.

By monitoring this content, the script can potentially intercept or manipulate sensitive user interactions, such as capturing user input or manipulating the content displayed.

The malicious extension also targets users of popular email platforms like Outlook, Gmail, and Yahoo Mail, where it dynamically injects and manipulates web content based on configurations fetched from chrome.storage.local. The extension can alter email contents (Figure 4), potentially to steal sensitive information such as verification codes sent during two-factor authentication processes.

The script “proxy.js” located in the extension folder appears to be the CursedChrome implant, a Chrome extension that converts compromised Chrome browsers into HTTP proxies, which enables web browsing authenticated as the victims across all their websites.

The “makeScreenShot” function captures a screenshot of the currently visible tab in a Chrome browser. It returns the screenshot data as a base64-encoded image. The screenshot is then sent to the C2 server (Figure 5).

The C2 addresses are extracted and then Base58-decoded from a Blockchain and mempool URLs, which is structured to return data in JSON format about the Bitcoin address “bc1qvkvzfla6wrem2uf4ejkuja8yp3c6f3xf72kyc9”

In conclusion, the incident showcased an interesting delivery chain that leveraged DLL side-loading to execute the loader that delivered LummaC2 stealer and a malicious Chrome extension to manipulate browser activities and facilitate data theft.

What did we do?

• Our team of 24/7 SOC Cyber Analysts isolated the affected host to contain the infection.
• We alerted the customer of the incident and supported them through the remediation process.

What can you learn from this TRU Positive?

• The case showcases the importance of endpoint security solutions, such as Endpoint Detection and Response (EDR), and the implementation of security training programs to educate users about such sophisticated threats.
• The malware’s capability to dynamically manipulate web content, especially within email platforms like Outlook, Gmail, and Yahoo Mail, underscores the need to secure web browsers and email clients. This involves vigilant monitoring for malicious browser extensions and implementing strict controls to prevent unauthorized script executions.
• By leveraging legitimate software and processes like rnpkeys.exe from the RNP library, attackers can bypass traditional security measures. This tactic emphasizes the importance of monitoring and securing trusted applications.

Recommendations from the Threat Response Unit (TRU):

Indicators of Compromise

You can access the indicators of compromise here.

References

Source: Original Post