Ursnif and Gandcrab Campaign with the Macro-Enabled Documents
Total Page：16
File Type：pdf, Size：1020Kb
Ursnif and GandCrab campaign with the macro-enabled documents Prepared for: LIFARS, LLC and its Subsidiaries Prepared by: Ladislav Bačo Date: 11/02/2019 This document and its content represent confidential information between LIFARS, LLC and company. As such, this document may not be shared with any outside party without the expressed consent of LIFARS, LLC and the company. 1 Ursnif and GandCrab campaign with the macro-enabled documents Overview During the first half of February 2019 there was an increase in occurrences of the Spam messages containing attached documents with the names in the form “Request” followed by the number, like “Request15.doc”. These documents contain slightly obfuscated macros which lead to execution of the PowerShell downloader. This PowerShell downloader connects to the domains registered in Russian Federation and resolved to the Russian IP addresses. It seems that on these servers are hosted malicious content, in many cases detected as the Ursnif malware. Macro-enabled documents The spam messages may contain the password-protected zipped Word document (with password “1234567” written in the email body), or only the document itself. Usually the document is with blue background with text with suggestion to enable macros, or enable editing and content, as we can see on the next pictures: Fig. 1: Documents with request for enabling macros Each type of document contains the specific macro code, in the first case, executed on document open (AutoOpen), in the second case, executed on document close (AutoClose), see Figure 2: 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 2 Fig. 2: Olevba tool output, AutoOpen and AutoClose macro execution The macros can be extracted with the olevba tool, it is quite obfuscated, in the first case with multiple junk functions and select statements, in the second case with multiple junk variables. These two types of obfuscation are presented below: Fig. 3: First type of obfuscation Fig. 4: Second type of obfuscation These macros lead after deobfuscation to running powershell with base64-encoded command. In the first type it will execute powershell directly, in the second type it will first execute the shell with the command taken from AlternativeText of one Shape. This alternative 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 3 text contains the command for execution of powershell (in some cases the command first run the ‘cmd.exe’ and then ‘powershell’): Fig. 5: First type macro deobfuscated Fig. 6: Second type macro deobfuscated Fig. 7: Second type macro deobfuscated: shape with powershell command PowerShell downloaders Decoding of the base64 encoding reveal that the first PowerShell command is obfuscated (see Fig. 8), but after quick deobfuscation it is clear that this is the PowerShell downloader. It checks if the downloaded executable file has at least 40kB and if yes, it will execute it (Fig. 9). 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 4 Fig. 8: Obfuscated PowerShell downloader Fig. 9: Debfuscated PowerShell downloader Decoding of the PowerShell command from the second document will result to the another downloader, which is not obfuscated in this case. It will try two approaches, first, download string and invoke it as the PowerShell command. Second, download executable file and run it via ShellExecute. 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 5 Fig. 10: PowerShell downloader from the second document Ursnif campaign Unfortunately, the downloaded content was not present during our analysis and it was not available even during the analysis on Any.Run. But using the VirusTotal domain information we can see that multiple executable files have been downloaded from this domain and most of them has been identified as the Ursnif spyware. Fig. 11: VirusTotal domain information 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 6 Fig. 12: VirusTotal detections It seems that there are more domains involved in this campaign, with more “ReqeustXX.doc” documents. Also, on the Any.Run it is possible to see the increase in the number of submissions with these filenames and tagged as the Ursnif. These samples have been submitted since 05th February 2019 until now, and it seems that the campaign still continue, but with decreasing intensity. Fig. 13: Any.Run public submissions From these public submissions we can extract multiple contacted domains by PowerShell downloaders. We can find even more samples with filenames like “Request15.doc” by using the search engines (e.g. Google) targeted on the sites related to malware analysis (e.g. VirusTotal, Hybrid-Analysis,…). With set of these domains and samples, it is possible to reveal even more IOCs of this campaign, like contacted URLs, documents with PowerShell downloaders, downloaded executable files, etc. VirusTotal Graph is very useful tool for visualization of 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 7 relationships between malware-related entities. Create an overview of the samples, scope of the campaign, country attribution can be matter of several minutes. In this case, our investigation has resulted in the following graph with malicious domains, URLs, documents and executable files: Fig. 14: VirusTotal Graph of IOCs associated with the Ursnif campaign The domains from the above examples have been resolved to the Russian IP addresses from the start of the attack (the US-one is the exception, the domain pgarfielduozzelda.band has been resolved to it only since 21th February, and the black flags are also the Russian IP address regarding to whois), and also the most of these domains have been registered in Russian Federation. 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 8 PowerShell downloader leading to GandCrab ransomware During our analysis the downloaded content was not present on the involved servers and also in the most cases it was not available even during the analysis on sandboxes like Any.Run or Hybrid- Analysis. But after a while, we were able to found at least one analysis at Any.Run, in which the PowerShell downloader successfully downloaded the malicious content. The second document from the first part of our analysis is actually the one sample mentioned above, which Any.Run report contains the downloaded data. Recall from the previous text, the analyzed document contains macros, which lead to execution of the encoded PowerShell command. After decoding we can see the following PowerShell downloader: Fig. 15: Decoded PowerShell downloader The first URL hxxp://89.223.92.190/704e.php (which is supplied to the method DownloadString) was active during the execution at Any.Run, so we can see the downloaded content, which is then invoked as an PowerShell expression (IEX from the picture above is the alias to the commandlet Invoke-Expression). 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 9 Fig. 16: Captured communication with malicious URL Fig. 17: Downloaded end executed content from the malicious URL It is not obfuscated, and it is clear that this piece of PowerShell script download and execute string again, but this time, the content is downloaded from Pastebin. However, during the campaign only the 8 AV engines detected this unobfuscated 2nd stage of PowerShell downloader: 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 10 Fig. 18: VirusTotal detections of 2nd PowerShell downloader Moreover, the downloaded content from Pastebin has even less detection ratio, with the score 1/69 only: Fig. 19: VirusTotal detections of pastebin content Before we can proceed with this content from Pastebin, it is useful to remind the behavior of the 2nd PowerShell downloader: download and execute script from hxxps://pastebin.com/raw/9see7UfF execute function Invoke-HQLAPCCSDIGBUMKZIHEIZPFSX (probably defined in the content downloaded from Pastebin) 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 11 PowerShell injector from Pastebin Now, let’s continue with Pastebin’s content. It is mostly unobfuscated PowerShell script, too. It seems that only two function names are partially mangled: Invoke-HSOAWYAZUAGTMWM and Invoke-HQLAPCCSDIGBUMKZIHEIZPFSX mentioned above. Also the parameters of these functions are readable, and we can found names like PEBytes, ExeArgs, ProcName and ProcId, which give us the sense of what this script is probably able to do. Fig. 20: PowerShell script from Pastebin Scrolling down the script, we found the code related to the structure of PE files like headers, sections, imports and exports, and code for accessing the Win32 API functions often uses for code injection, like VirtualProtect, WriteProcessMemory, CreateRemoteThread. 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 12 Fig. 21: PowerShell code related to the structure of PE files Fig. 22: PowerShell code related to the Win32 API functions used for code-injection This code is pretty-formatted and easily readable with meaningful variable and function names, unlike the macros and PowerShell from the first part of analysis. It is a reason for assumption that this code is copy-pastes from some publicly known tool. Trying to search for code snippets will bring us to the PowerSploit’s Invoke-ReflectivePEInjection. Yes, its name is self-describing, this script performs reflective injection of PE file (DLL library) into desired process and also loads all of the dependencies of the injected PE file. This PowerSploit’s Invoke-ReflectivePEInjection looks very similar to our Pastebin’s content, with one big difference at the end of our sample: the function Invoke- HQLAPCCSDIGBUMKZIHEIZPFSX containing Base64-encoded data used as the PEBytes argument of the function Invoke-HSOAWYAZUAGTMWM, which is the renamed function Invoke-ReflectivePEInjection from the PowerSploit: 244 Fifth Avenue, Suite 2035, New York, NY 10001 LIFARS.com (212) 222-7061 [email protected] 13 Fig.