Rewterz Threat Alert – DNS Infrastructure Hijacking Campaign

Severity

High

Analysis Summary

A new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on the research It’s clear that this adversary spent time understanding the victims’ network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks.

The attackers’ first attempt to compromise the user involved two malicious websites that mimicked legitimate sites that host job listings:

• hr-wipro[.]com (with a redirection to wipro.com)

• hr-suncor[.]com (with a redirection to suncor.com)

These sites hosted a malicious Microsoft Office document: hxxp://hr-suncor[.]com/Suncor_employment_form[.]doc.

The document is a copy of a legitimate file available on the website for Suncor Energy, a Canadian sustainable energy company, and contains a malicious macro.

Upon opening the first Office document, the user receives a message that says “Content Mode Available:”

The macros of the analysed samples can be divided into two steps:

When the document is opened, the macro will decode a PE file encoded with base64 and will drop it in %UserProfile%.oracleServices\svshost_serv.doc
When the document is closed, the macro will rename the file “svshost_serv.doc” to “svshost_serv.exe.” Then, the macro creates a scheduled task named “chromium updater v 37.5.0” in order to execute the binary. The scheduled task is executed immediately and repeatedly every minute.
The purpose of these two steps is to avoid sandbox detection.

The payload is executed when Microsoft Office is closed, meaning it requires human interaction to deploy it. The macros, while available through analysis, are also password-protected in Microsoft Word to stop the victim from exploring the macro code via Microsoft Office.

Additionally, the macro uses classical string obfuscation in order to avoid strings detection.

Impact

Alters DNS records

Indicators of Compromise

IP(s) / Hostname(s)

• 185[.].20[.].184[.].138
• 185[.].20[.].187[.].8
• 185[.].161[.].211[.].72

URLs

• hr-wipro[.]com
• hr-suncor[.]com
• 0ffice36o[.]com

Malware Hash (MD5/SHA1/SH256)

• 9ea577a4b3faaf04a3bddbfcb934c9752bed0d0fc579f2152751c5f6923f7e14
• 15fe5dbcd31be15f98aa9ba18755ee6264a26f5ea0877730b00ca0646d0f25fa
• 2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec
• 82285b6743cc5e3545d8e67740a4d04c5aed138d9f31d7c16bd11188a2042969
• 45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff

Remediation

• Update the passwords for all accounts that can change organizations’ DNS records.
• Implement multifactor authentication on domain registrar accounts, or on other systems used to modify DNS records.