CyberThreatIntel/offshore APT organization/Bitter/27-08-19/Malware analysis 31-08-19.md

Malware analysis on Bitter APT campaign (31-08-19)

Table of Contents

• Malware analysis
  • Initial vector
  • ArtraDownloader
• Cyber Threat Intel
• Indicators Of Compromise (IOC)
• References MITRE ATT&CK Matrix
• Links
  • Original Tweet
  • Link Anyrun
  • Documents

Malware-analysis

Initial vector

Use a document with a remote template injection as initial vector. This request http[:]//maq.com.pk/ for be redirected on the next URL.

This second URL (http[:]//maq.com.pk/wehsd) send a RTF exploit.

This exploit execute firstly a request by WebDAV and after by WebClient service for download the backdoor on the final address (http[:]//maq.com.pk/wehs) and execute it.

Here we can see the redirection and the data sended on the victim.

ArtraDownloader

In the first, we can see that launch by the factory option for separate the application of the current Explorer instance for avoid if one crashes the other stays alive (C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding). Secondly, we can note encoded string pushed on a function and the result is moved on another registry as storage for be used by the backdoor.

In observing this function we can resume by the folowing algorithm used for decode these strings : for each byte of the string -> value of the byte -1 -> get Unicode value -> convert to char.

We can edit a script for decode the encoded string.

Now we can see the actions did by the malware.

Once this done, we can see on the entrypoint, this use the startupinfo structure to specify window properties, verify the header of the PE and the get the environment values for create the process. The malware is coded in C++ language.

We can observe that the malware push the persistence by a Run key in the registry. We can note too that use DOS commands with an environment value ("C:\ProgramData\Ntuser\winlgn.exe") for launch the backdoor.

This query the registry for get the version of the OS and proceeds for identify the victim’s machine GUID by the HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid registry key.

This use too , the EncodePointer function for encoding a specified pointer (encoded pointers can be used to provide another layer of protection for pointer values).

After perform the reconnaissance actions, this can send a query as pulse with the informations to the C2.

The data are encoded by the algoritm too, with the script, we can decode the strings and see that the roles and data send to the C2.

Variable	Description
SNI	Computer name
UME	OS Version
OPQ	Account name
IVR	[Computer name]##[Account name]@@[GUID]
st	downloaded file executed successfully ?

Cyber kill chain

This process graph represents the cyber kill chain of Bitter sample.

Cyber Threat Intel

References MITRE ATT&CK Matrix

List of all the references with MITRE ATT&CK Matrix

Enterprise tactics	Technics used	Ref URL
Execution	T1059 - Command-Line Interface T1106 - Execution through API T1170 - Mshta T1086 - PowerShell T1053 - Scheduled Task T1064 - Scripting T1059 - Command-Line Interface	https://attack.mitre.org/techniques/T1059 https://attack.mitre.org/techniques/T1106 https://attack.mitre.org/techniques/T1170 https://attack.mitre.org/techniques/T1086 https://attack.mitre.org/techniques/T1053 https://attack.mitre.org/techniques/T1064 https://attack.mitre.org/techniques/T1059
Persistence	T1060 - Registry Run Keys / Startup Folder T1053 - Scheduled Task	https://attack.mitre.org/techniques/T1060 https://attack.mitre.org/techniques/T1053
Privilege Escalation	T1053 - Scheduled Task	https://attack.mitre.org/techniques/T1053
Defense Evasion	T1170 - Mshta T1064 - Scripting	https://attack.mitre.org/techniques/T1170 https://attack.mitre.org/techniques/T1064
Credential Access	T1081 - Credentials in Files	https://attack.mitre.org/techniques/T1081
Collection	T1113 - Screen Capture T1114 - Email Collection	https://attack.mitre.org/techniques/T1113 https://attack.mitre.org/techniques/T1114

Indicators Of Compromise (IOC)

List of all the Indicators Of Compromise (IOC)

Indicator	Description
Urgent Action.docx]	34b53cd683f60800ac4057d25b24d8f083f759d024d22b4e5f2a464bc85de65a
smss.exe	dcb8531b0879d46949dd63b1ac094f5588c26867805d0795e244f4f9b8077ed1
maq.com.pk	domain requested
203.124.43.227	ip requested
http[:]//maq.com.pk/	HTTP/HTTPS requests
http[:]//maq.com.pk/wehsd	HTTP/HTTPS requests
http[:]//maq.com.pk/wehs	HTTP/HTTPS requests
http[:]//onlinejohnline99.org/kvs06v.php	HTTP/HTTPS requests
onlinejohnline99.org	Domain C2
93.123.73.193	IP C2

This can be exported as JSON format Export in JSON

Links

• Original tweet: https://twitter.com/RedDrip7/status/1164855381052416002
• Anyrun Link:
  • Urgent Action.docx
• Docs :
  • Bitter Analysis by Unit42