• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – SAP NetWeaver Business Client Unspecified Vulnerabilities
February 21, 2019
Rewterz Threat Advisory – CVE-2019-8956 – Linux Kernel “sctp_sendmsg()” Use-After-Free Vulnerability
February 21, 2019

Rewterz Threat Alert – North Korea’s Lazarus Resurfaces With Fresh Campaigns

February 21, 2019

Severity

High

Analysis Summary

The campaign consists of dropping PDF file documents and Microsoft word documents with embedded macros.

The main infection flow consists of the following three main steps.

  1. A ZIP file which contains two documents, a benign decoy PDF document and a malicious Word document with macros.
  2. The malicious macro downloads a VBS script from a Dropbox URL, followed by the VBS script execution.
  3. The VBS script downloads a CAB file from the dropzone sever, extracts the embedded EXE file (backdoor) using3. Windows’ “expand.exe” utility, and finally executes it.

The attackers lured the users with multiple images to “Enable Content” button so that the document can trigger the malicious macro code.

Attackers used an excel as well to drop the malicious macro code to infect the users.

An interesting part of the download stage in one of the documents, is the unexplained usage of a Dropbox “Host” field in the HTTP request header. Upon further analysis, researchers found that Dropbox was the original source for the second stage of the infection, during this campaign.

The final payload in this campaign is downloaded from a compromised server in the form of a CAB file, which is later expanded into the KEYMARBLE backdoor. It is important to note the CAB file is disguised as a JPEG image on the compromised host (http[:]//37.238.135[.]70/img/anan.jpg).

All of the malicious documents downloaded KEYMARBLE, compressed inside a CAB file, which successfully evaded detection and reduced detection from five vendors of Virus Total to just 2 of them.

Impact
Successful Lazarus Attack

Indicators of Compromise

URLs

hxxp[:]//37[.]238[.]135[.]70/img/anan[.]jpg

Filename

LosAngeles_Court_report.doc

Serial_Numbers.xls

2018.11.2~2019.1.26_ErrorDetail.doc

Malware Hash (MD5/SHA1/SH256)

  • 088c6157d2bb4238f92ef6818b9b1ffe44109347
  • 2b4fb64c13c55aa549815ec6b2d066a75ccd248e
  • 4cd5a4782dbed5b8e337ee402f1ef748b5035709
  • a5b2c704c5cff550e6c47454b75393add46f156f
  • d1410d073a6df8979712dd1b6122983f66d5bef8
  • e89458183cb855118539373177c6737f80e6ba3f

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download files received in emails from unknown sources.
  • Never enable macros or ‘enable content’ if a file is not from a trusted source, no matter how interesting it looks.
  • Closely monitor all network traffic.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.