• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
A Ransomware called WannaCry
March 16, 2018
Rewterz Threat Advisory – Malicious Callers Spoofing Bank Numbers
June 23, 2018

Rewterz Threat Advisory – CVE-2017–11882 Multi-Layered Infection Attack Installs Betabot Malware

June 19, 2018

This is an advisory on a multi-stage attack installing Betabot Trojan to exploit a 17-year-old vulnerability using malicious office documents.

 

IMPACT:  CRITICAL

PUBLISH DATE:  19-06-2018

OVERVIEW

The Betabot Trojan is a malware having served many purposes for the hackers. It used to be a banking Trojan evolving into a password stealer and later becoming a botnet for distributing ransomware and other malicious programs. The attack involves exploitation of the 17-year-old vulnerability CVE-2017–11882 which was discovered and manually fixed by Microsoft last year.

 

 

BACKGROUND INFORMATION

A vulnerability in the Microsoft’s equation editor (EQNEDT32.EXE) prevalent since November 2000 was identified last year as  CVE-2017–11882 and was patched by Microsoft manually. The bug was not fixed in the source code which is now being  exploited by the Cobalt hackers.

 

The Cobalt hackers specially crafted an RTF file to execute commands on the compromised device. They embedded an OLE  object (inteldriverupd1.sct, task.bat, decoy.doc, exe.exe, and 2nd.bat) into the RTF file which pretend to be authentic software. The security researchers claim that they managed to create an exploit that would work with all Office versions released over the past 17 years, including Office 365, and which would impact all Windows versions, including Windows 10 Creators Update.

 

 

WORK FLOW

The attack is multi-layered and involves many things like remote code execution. The RTF file designed by the Cobalt hackers is  used to contact a remote server and deliver the first payload to the victim’s system. The code is executed using MSHTA.exe which then proceeds to grab another payload from the remote server. The second payload is a script having a final payload embedded in it.

 

This embedded final payload is the Cobalt Strike backdoor often used by the cobalt hackers group in various attacks they’re associated with.The malware is now ready to execute remote commands on the victim’s system.

 

 

IMPACT ANALYSIS

The impact of the Betabot malware is far-reaching as it’s been a tool to attack banks, steal passwords and to deliver ransomware and malware. The multi-purpose Trojan can be used to launch several kinds of damages to a system or organization. The detection of its activity is another complex mechanism as it does not require user interaction to perform its malicious functions. The researchers claim that once the malicious document is opened, the remote code execution will silently  pour its venom into the system without even effecting the user’s activity on Microsoft office.

 

RESOLVE

The only hinderance in the code execution is observed when the user has enabled protected mode. The protected mode  forbids any active content execution (OLE/ActiveX/Macro). However, this resolution can easily be by-passed using social engineering. A hacker can easily manipulate a user into saving the document on cloud (OneDrive, Google Drive). In such cases, the files obtained from remote sources are not labelled with MOTW (Mark Of The Web), and will not be  opened in the protected mode when a user opens them.

 

Therefore, great caution is required against social engineering whenever an employee is dealing with office documents to avoid the Betabot malware from running this multi-layered streak of attack on your system.

 

 

If you think you are a victim of a cyber-security attack. Immediately send an email to info@rewterz.com for a rapid response.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.