599 lines
No EOL
29 KiB
JSON
599 lines
No EOL
29 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2022-11-21",
|
|
"extends_uuid": "",
|
|
"info": "Is Hagga Threat Actor (ab)using FSociety framework ?",
|
|
"publish_timestamp": "1683878282",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1683878227",
|
|
"uuid": "f07207d5-e6f7-4369-9a9d-a1390b83aaeb",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:clear",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"local": false,
|
|
"name": "osint:lifetime=\"perpetual\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"local": false,
|
|
"name": "osint:certainty=\"50\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1683876737",
|
|
"to_ids": false,
|
|
"type": "ip-dst",
|
|
"uuid": "936d6d4b-5c93-4478-ad04-c139b861550e",
|
|
"value": "4.204.233.44"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1683876713",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "4c5b66ef-5fd3-43e1-b907-7f85521e29e7",
|
|
"value": "69.174.99.181"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1683876720",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "e8ee6df7-d699-4858-bcb4-0aaf9ecc7ce8",
|
|
"value": "103.151.123.121"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "Drop and Execute",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1683876806",
|
|
"uuid": "1bbdf5d0-ceba-44bb-85ed-921915c4cb78",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1683876770",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "c8d63a2b-06ae-4444-be1d-04dec2f6f129",
|
|
"value": "9ea4eebd9cf2a5d4e6343cb559d8c996fae6bf0f3bd7ffada0567053c08acc31"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1683876782",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "cffaa0a6-994b-4925-abc4-e9679b1c7f62",
|
|
"value": "update.js"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Drop, evasion and Memory Invoke",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1683877360",
|
|
"uuid": "d1d886cd-6f9a-4e31-8d22-4842f52ae41a",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1683877340",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "75e4d5e3-caeb-4f63-8a53-0260ade21603",
|
|
"value": "ab5b1989ddf6113fcb50d06234dbef65d871e41ce8d76d5fb5cc72055c1b28ba"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1683877352",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "8b652706-21c9-4910-b2fa-35412a27cadc",
|
|
"value": "Dll.ppam"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1683877461",
|
|
"uuid": "634c18f3-7cfb-4bde-87c7-9b5d14f89fb5",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1683877421",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "53330085-d563-4851-852b-67099f6d0743",
|
|
"value": "20a53f17071f377d50ad9de30fdddd320d54d00b597bf96565a2b41c15649f76"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1683877461",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "d4a0238f-f1e4-4cde-b360-d132418d67de",
|
|
"value": "Rump.xls"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "post exploitation tool, C2 communication decoded",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "24",
|
|
"timestamp": "1683877608",
|
|
"uuid": "5087add7-e405-41cf-a3f1-1cb7d189c368",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1683877578",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "abc82e6e-e3e7-4a97-83f7-adfe3f1acb54",
|
|
"value": "5d910ee5697116faa3f4efe230a9d06f6e3f80a7ad2cf8e122546b10e34a0088"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1683877608",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "4054e8dc-aeca-4c17-9b46-bcf43a6c60ed",
|
|
"value": "Rump.xls.inverted.charsReplaced.decoded"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "x509 object describing a X.509 certificate",
|
|
"meta-category": "network",
|
|
"name": "x509",
|
|
"template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c",
|
|
"template_version": "13",
|
|
"timestamp": "1683877767",
|
|
"uuid": "323e3caf-fb86-4910-82af-819b6bdf84df",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "x509-fingerprint-sha1",
|
|
"timestamp": "1683877767",
|
|
"to_ids": true,
|
|
"type": "x509-fingerprint-sha1",
|
|
"uuid": "4bd1f1a1-f059-4ac8-af74-bb28f73c6569",
|
|
"value": "970f993ad1a289620b5f5033ff5e0b5c4491bb2b"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "subject",
|
|
"timestamp": "1683877767",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "93f4f406-8e73-4a6b-9f11-b376eb00197f",
|
|
"value": "servidor"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "serial-number",
|
|
"timestamp": "1683877767",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "a3cbf6ec-5083-43f6-acaf-3ff8b1600e35",
|
|
"value": "136234453590953102797263558291395548452"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "is_ca",
|
|
"timestamp": "1683877767",
|
|
"to_ids": false,
|
|
"type": "boolean",
|
|
"uuid": "3a43a493-bcda-4a83-901f-f177914b74bb",
|
|
"value": "0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "x509 object describing a X.509 certificate",
|
|
"meta-category": "network",
|
|
"name": "x509",
|
|
"template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c",
|
|
"template_version": "13",
|
|
"timestamp": "1683877818",
|
|
"uuid": "bbc87ea8-1024-4443-bbad-662afeafc4db",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "x509-fingerprint-sha1",
|
|
"timestamp": "1683877818",
|
|
"to_ids": true,
|
|
"type": "x509-fingerprint-sha1",
|
|
"uuid": "22aafc24-d52a-4177-9571-1919e52eded9",
|
|
"value": "b0238c547a905bfa119c4e8baccaeacf36491ff6"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "subject",
|
|
"timestamp": "1683877818",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "151e965b-c01b-4afc-8274-6481f763993f",
|
|
"value": "localhost"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "serial-number",
|
|
"timestamp": "1683877818",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "2c8b782f-8a6a-4665-b0e4-61bde985ee8d",
|
|
"value": "13098529066745705731"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "is_ca",
|
|
"timestamp": "1683877818",
|
|
"to_ids": false,
|
|
"type": "boolean",
|
|
"uuid": "4512d937-abd4-4464-85ef-39a9421f1b07",
|
|
"value": "0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Command And Control",
|
|
"deleted": false,
|
|
"description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
|
|
"meta-category": "network",
|
|
"name": "ip-port",
|
|
"template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
|
|
"template_version": "9",
|
|
"timestamp": "1683877880",
|
|
"uuid": "1fea7ac2-60dd-4d59-92ad-f6222e849ecc",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "dst-port",
|
|
"timestamp": "1683877880",
|
|
"to_ids": false,
|
|
"type": "port",
|
|
"uuid": "353d33d0-31ce-4e2a-8a27-dc6488bdf3c9",
|
|
"value": "8895"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "ip",
|
|
"timestamp": "1683877880",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5a5cb715-8354-4ed3-8e99-0a869c860632",
|
|
"value": "103.151.123.121"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Enriched via the url_import module",
|
|
"deleted": false,
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
|
"meta-category": "network",
|
|
"name": "url",
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
|
"template_version": "9",
|
|
"timestamp": "1683878027",
|
|
"uuid": "7aa855f7-2a9d-45d0-809c-fe0d8ba6f7a7",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "url",
|
|
"timestamp": "1683878027",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "31ea9b34-2665-4ce6-bb9d-4920b2740b31",
|
|
"value": "http://4.204.233.44/Rump/Rump.xls"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "resource_path",
|
|
"timestamp": "1683878027",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "d078b4e6-9fbb-4109-aa74-98189eb315eb",
|
|
"value": "/Rump/Rump.xls"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "host",
|
|
"timestamp": "1683878027",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "7d2fd83f-e64b-4f97-b03c-337bf8e145c2",
|
|
"value": "4.204.233.44"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain_without_tld",
|
|
"timestamp": "1683878027",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "263e0337-c4f5-4415-ad22-57773ed16bb7",
|
|
"value": "4.204.233.44"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1683878027",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c5e4ff15-901f-4128-9cd8-1d2a07a3b017",
|
|
"value": "4.204.233.44"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "Enriched via the url_import module",
|
|
"deleted": false,
|
|
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
|
|
"meta-category": "network",
|
|
"name": "url",
|
|
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
|
|
"template_version": "9",
|
|
"timestamp": "1683878052",
|
|
"uuid": "6a06a7cd-0263-4586-b96c-8e7a78f36a79",
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "url",
|
|
"timestamp": "1683878052",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "bfb6560b-4ecc-43a3-8f62-52492387ffbd",
|
|
"value": "http://4.204.233.44/Dll/Dll.ppam"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "resource_path",
|
|
"timestamp": "1683878052",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "ac9aa721-375f-4d75-acc9-471cfa190d6b",
|
|
"value": "/Dll/Dll.ppam"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "host",
|
|
"timestamp": "1683878052",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "7cee22c3-fcc8-40b0-9b2f-ca384b4fc416",
|
|
"value": "4.204.233.44"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain_without_tld",
|
|
"timestamp": "1683878052",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "7e68d3f0-afec-4b1d-af1c-4f8a1be0191b",
|
|
"value": "4.204.233.44"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "domain",
|
|
"timestamp": "1683878052",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8bd3ae68-9ecb-45c7-926c-1684e029bfea",
|
|
"value": "4.204.233.44"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "Metadata used to generate an executive level report",
|
|
"meta-category": "misc",
|
|
"name": "report",
|
|
"template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
|
|
"template_version": "7",
|
|
"timestamp": "1683878227",
|
|
"uuid": "57ec3f12-e191-472f-bd94-59d2800107c6",
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "link",
|
|
"timestamp": "1683878227",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "0ba5d25e-9241-414e-9ed0-0ad883981643",
|
|
"value": "https://marcoramilli.com/2022/11/21/is-hagga-threat-actor-abusing-fsociety-framework/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "summary",
|
|
"timestamp": "1683878227",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b316f57d-4c28-47b8-97d3-fcf3f5860352",
|
|
"value": "Is Hagga Threat Actor (ab)using FSociety framework ?\r\napt cybersecurity malwareNovember 21, 2022\r\nIntroduction\r\n\r\nToday I\u2019d like to share a quick analysis initiated during a threat hunting process. The first observable was found during hunting process over OSINT sources, the entire infrastructure was still up and running during the analyses as well as malicious payload were downloadable."
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "type",
|
|
"timestamp": "1683878227",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "141bd92b-1cf2-4026-af87-3c3af93bebb4",
|
|
"value": "Blog"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"EventReport": [
|
|
{
|
|
"name": "Report from - https://marcoramilli.com/2022/11/21/is-hagga-threat-actor-abusing-fsociety-framework/ (1683876572)",
|
|
"content": "# apt cybersecurity malwareNovember 21, 2022November 21, 2022 .container.container-medium #### Introduction\n\nToday I\u2019d like to share a quick analysis initiated during a threat hunting process. The first observable was found during hunting process over OSINT sources, the entire infrastructure was still up and running during the analyses as well as malicious payload were downloadable. \n\n#### Analysis\n\n My first observable was a zipped text file compressing a simple update.js script. The script was created to avoid automatic analisis tools since the dimension (>9MB) really makes hard to beautify or remove unwanted/funny or added trash code every which happens to be everywhere.\n\nnameupdate.js sha256 9ea4eebd9cf2a5d4e6343cb559d8c996fae6bf0f3bd7ffada0567053c08acc31 type Drop and ExecuteStage 1 The following images show how it looked like at first sight. As many of you are aware, analyzing scripts is just a matter of time or, if you have enough memory on your machine (or time to spend over that task) a computational matter during virtualization. If you are old style (I do like it a lot ) it is a matter of \u201ckeywords\u201d , in other words adding some console.println or whatsoever you like to make debugging quick and easy. Few strings in this update.js reminded me to the use of obfuscator.io tool, but I did not investigate further on this direction, it was quite easy as well to reach the point.\n\n \nFinally its execution was reached. I obtained this status by using some classic and romantic hand working balance to dynamic execution with the always great JSDetox. Finally the real behavior came out. It looks like to be a drop and execute artifact. It takes a file called Dll.ppam from an IP address (please take a look to IoC section to see details on found IoC), it decodes it from base64, and it invoked the method VAI (really interested Italian word to say \u201cGO\u201d, nice coincidence !?) in the Fiber.Home class. It then passes to such a function an interesting address: https://firebasestorage. googleapis. com with some parameters as the following image shows (please reverse the byte order on the right string).\n\nStage1 Drop and execute Lets take a closer look to what Dll.ppam is. First it\u2019s a .NET Portable Executable, so we might have an easy path ahead.\n\n nameDll.ppam sha256 ab5b1989ddf6113fcb50d06234dbef65d871e41ce8d76d5fb5cc72055c1b28ba type Drop, evasion and Memory Invoke The .NET is not packed and the code reading is quite \u201cstraight forward\u201d. An interesting technique that I\u2019d like to highlight (and to track) is in the way the malware developer used to step forward the malware control flow, which reminds me a known threat actor. Many different techniques could be used at this point if you want to make something happening after specific conditions or if you simply want to give an execution order. The most easy and (maybe) quick way to follow could be the adoption of nested functions or, if you are a more sophisticated malware developer, you might decide to use exception handlers or, again, you might decide to switch from function to function in different libraries, or for the shake of example, a simple single flow as a simple unique function. But this malware developer decided to use a quite characteristic way developing an interesting combination of switch/case. In other words it starts by assigning 0 to num variable which it makes case 0 to switch. In each case it updates the num variable to control the switch(num) selector making the flow running in the desired way. The following image shows the VAI function, in where you might appreciate the control flow and additional IoC (such as IP address, dropped url and artifact name, etc..). \n\n Principal routine on Dll.ppam The VAI routing starts by downloading a file called Rump.xls from a remote server. It places the file content into a variable and it reverse its bytes order, later it replaces special characters to the letter A. The resulting decoded file (bytes Inverted, Special Character replaced and base64 decoded) is another PE file written in .NET technology and encoded in base64.\n\n Finally once the Rump.xls file is decoded in memory, Dll.ppam runs it by calling the method Adre inside the Fsociety.Tools library, passing as argument RegAsm.exe.\n\n Memory invoke of Rump.xls (later fsociety tools) The following table sums up the original and dropped file by Dll.ppam named Rump.xls, while the next table shows details about the .NET PE file resulting from the decoding process.\n\n nameRump.xls (Original)sha256 20a53f17071f377d50ad9de30fdddd320d54d00b597bf96565a2b41c15649f76 typepost exploitation tool, C2 communication nameRump.xls.inverted.charsReplaced.decoded (given name)sha2565d910ee5697116faa3f4efe230a9d06f6e3f80a7ad2cf8e122546b10e34a0088typepost exploitation tool, C2 communication decoded Rump.xls looks like to be an implementation of Fsociety tools, a complete post exploitation framework. This library is able to get system information RtlGetVersion, RtlGetNtProductType, GetSystemTimeAsFileTime and to get the used software policies: \"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"). It also contains the ability to get persistence by \n\"regsvr32.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\" and it might get remote access by using the WmiPrvSE module.\n\n The image above shows an interested detail about the called function Ande, where you might appreciate a similar coding style if compared to the Dll.ppam even if the control flow, this time, is managed by simple nested if. The infinitive loop and the variable names are matching the previous code. However those similarities are way too weak to say anything about the authorship (IMHO), but still indicators to keep tracking.\n\n #### Threat Intelligence\n\n According to Microsoft Threat intelligence the drop server ( @[attribute](936d6d4b-5c93-4478-ad04-c139b861550e)) has been seen with two certificates (please refer to IoC sections for sha1). The first certificate (SN: 136234453590953102797263558291395548452) has been issued on 2022-11-14 with common name servidor (server as in Spanish). On 2022-11-14 the attacker changed the webserver certificate by adding the certificate having as SN: 13098529066745705731 issued on 2009-11-11 and having with common name localhost. This Certificate has been recorded in almost 50k related IPs over the past 13 years. The following image shows what I meant.\n\n From Microsoft Threat Intel One of the 50k IPs in where the same certificate was found, was the same that TeamCymru was able to track, thanks to previously posted IoC from Yoroi Threat Intelligence, back to **Hagga** **Threat Actor**. According to Microsoft researchers: \n\n \n> Team Cymru researchers describe how they were able to pivot in threat telemetry, using IOCs from Yoroi Security\u2019s blog as seeds, to identify several other C2s. From the starting point of an IP address (@[attribute](4c5b66ef-5fd3-43e1-b907-7f85521e29e7)) associated with an Agent Tesla command and control server, it was possible to pivot and identify a backend server hosting a MySQL database operated by the threat actor Hagga. From this point a further pivot led Team Cymru researchers to the identification of additional C2s hosting the Mana Tools C2 panel along with a common certificate that can be used to increase confidence in attributing future infrastructure to this threat actor.\n> \n> #### Conclusions\n\n In this blogpost I shared a personal analysis on an interesting artifact found during threat hunting research. Since the very beginning of the analysis I had some feelings about the designed patterns used on .NET libraries and the modus-oprandi looked familiar to me. What surprised me a lot was to see indicators of FSociety framework embedded on this malware stack, but finally a matching certificate used in the infrastructure pointed my attention on TeamCymru analysis on Hagga Threat Actor (HERE). If a matching certificate and code style (not discussed here, but you might try by yourself to check HERE) are enough to you, I would bet on HAGGA threat actor with a new used post exploitation framework FSociety.tools.\n\n #### IoC\n\n **URL** \nDropper: p://4 .204 .233 .44/Dll/Dll .ppam \nDropper: p://4 .204 .233 .44/Rump/Rump .xls \nCommand And Control: @[attribute](e8ee6df7-d699-4858-bcb4-0aaf9ecc7ce8) port: 8895 \n \n**HASH** (sha256) \n9ea4eebd9cf2a5d4e6343cb559d8c996fae6bf0f3bd7ffada0567053c08acc31 \nab5b1989ddf6113fcb50d06234dbef65d871e41ce8d76d5fb5cc72055c1b28ba \n20a53f17071f377d50ad9de30fdddd320d54d00b597bf96565a2b41c15649f76 (original) \n5d910ee5697116faa3f4efe230a9d06f6e3f80a7ad2cf8e122546b10e34a0088 (decoded)\n\n **CERT** (sha1) \n970f993ad1a289620b5f5033ff5e0b5c4491bb2b (drop webserver Certificate 1) \nb0238c547a905bfa119c4e8baccaeacf36491ff6 (drop webserver Certificate 2)\n\n\n generated 190 seconds ago generated in 0.280 seconds served from batcache in 0.002 seconds expires in 110 seconds",
|
|
"id": "155",
|
|
"event_id": "166779",
|
|
"timestamp": "1683876720",
|
|
"uuid": "4d918891-4c17-48b1-a273-4bde07d916cc",
|
|
"deleted": false
|
|
}
|
|
]
|
|
}
|
|
} |