Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
Building on the insights from our previous
exploration of finance-themed cybersecurity threats during the tax season, it’s evident that digital dangers are vast and evolving.
This time, our 24/7 SOC Analysts notified our Threat Response Unit (TRU) about the tax-themed threat delivering XWorm as the final payload. We assess that it is almost certain the initial infection vector is via the phishing email, as suggested by the infection chain (Figure 1).
We were able to track that the malicious attachment was downloaded from the compromised site hxxps://spnmandalawangi.banten.polri.go[.]id/Tax_docs_2023.htm. The downloaded file is a JavaScript file named “Tax-docs-2023.pdf .js” (MD5: 5706efd7e0254105261057a82308ed72).
When clicked by the victim, the JS file executes under Windows script host (wscript.exe) which retrieves and executes the atom.xml file (MD5: c1614e86b6808df891c5d7310d089211) from 91.92.243[.]28/poom/atom.xml
(Figure 2).
The retrieved file is a PowerShell script responsible for:
- Terminating running processes like RegSvcs, mshta, wscript, and msbuild (Figure 3). It is highly probable that the threat actors aim to terminate other existing malware processes as well.
- Dropping and opening a PDF decoy file. The decoy PDF file renamed to “James_Charles_Tax_2023.pdf” (Figure 4) (MD5: 7b47ca0383d2409fdc4ae629308bf4bc) is retrieved from MediaFire (a file hosting service).
- Injecting the final payload into Msbuild.exe and RegSvcs.exe processes.
- Adding a list of file extensions, paths, and processes to the Windows Defender exclusions list (Figure 5).
- Setting preferences and disabling Windows Defender security features (Figure 6).
- Disabling UAC, meaning that applications can run with elevated privileges without prompting the user for confirmation or an administrator password.
- Disabling the Windows Firewall with command “netsh advfirewall set allprofiles state off -ErrorAction SilentlyContinue”.
- Setting up the persistence via Scheduled Tasks.
- Setting up the persistence via Registry Run Key, two tasks are getting created:
- “loratask” which is then renamed to “intuiteupdater” – triggers the immediate execution of a scheduled task named “intuiteupdater” with the command “schtasks /run /tn intuiteupdater”
- “tasklorraalman” which is then renamed to “Drakeupdater” – leverages mshta to execute a script that downloads and executes PowerShell commands from an external source pdfdatamanage.serveftp[.]com/docs.pdf (The URL is offline at the moment of analysis) (Figure 7).
The ultimate payload delivered is XWorm v5.2, a Remote Access Trojan (RAT) (MD5: fc422800144383ef6e2e0eee37e7d6ba), for which cracked versions are publicly accessible.
XWorm configuration:
C2: 91.92.243[.]28 Port: 4444 Aes key: <123456789> Install file: USB.exe Version: XWorm V5.2
What can you learn from this TRU Positive?
- The initial infection vector for the observed XWorm malware is a phishing email, highlighting the continuing effectiveness of this method for cybercriminals.
- This reinforces the need for ongoing vigilance and education regarding the dangers of phishing and the importance of scrutinizing email attachments and links, even those that appear tax-related during tax season.
- The attack involves terminating certain processes and modifying Windows Defender’s settings to evade detection.
- This indicates a preparation by attackers to ensure their malware remains undetected for as long as possible, underscoring the necessity for multi-layered security approaches that do not rely solely on one form of defense.
- The use of decoy documents is a clever trick to make the victim believe the file is legitimate.
- This tactic shows the psychological manipulation involved in phishing attacks, where the aim is to reduce suspicion and increase the likelihood of the malware executing successfully.
- The malware’s capability to disable key security features (like UAC and Windows Firewall) and establish persistence through Scheduled Tasks and Registry Run Keys can give attackers long-term access to compromised systems, highlighting the importance of regular system audits and the prompt application of security updates.
- The ultimate delivery of the XWorm RAT underscores the goal of gaining remote access to the victim’s system for further malicious activities.
- The accessibility of cracked versions of such sophisticated malware on public forums increases the risk and potential impact of these attacks, necessitating comprehensive security measures, including network monitoring and endpoint protection.
What did we do?
Our 24/7 SOC Cyber Analysts investigated the suspicious activities, notified the client, and isolated the affected device.
Recommendations from our Threat Response Unit (TRU) Team:
- We recommend modifying the default ‘open-with’ settings for script files, ensuring they open with a basic text editor like Notepad instead of executing.
Detection Rules
You can access the Yara rule for XWorm here.
Indicators of Compromise
You can access the indicators of compromise here.
References
Source: Original Post