Rewterz Threat Advisory – SAP NetWeaver Business Client Unspecified Vulnerabilities
February 21, 2019Rewterz Threat Advisory – CVE-2019-8956 – Linux Kernel “sctp_sendmsg()” Use-After-Free Vulnerability
February 21, 2019Rewterz Threat Advisory – SAP NetWeaver Business Client Unspecified Vulnerabilities
February 21, 2019Rewterz Threat Advisory – CVE-2019-8956 – Linux Kernel “sctp_sendmsg()” Use-After-Free Vulnerability
February 21, 2019Severity
High
Analysis Summary
The campaign consists of dropping PDF file documents and Microsoft word documents with embedded macros.
The main infection flow consists of the following three main steps.
- A ZIP file which contains two documents, a benign decoy PDF document and a malicious Word document with macros.
- The malicious macro downloads a VBS script from a Dropbox URL, followed by the VBS script execution.
- The VBS script downloads a CAB file from the dropzone sever, extracts the embedded EXE file (backdoor) using3. Windows’ “expand.exe” utility, and finally executes it.
The attackers lured the users with multiple images to “Enable Content” button so that the document can trigger the malicious macro code.
Attackers used an excel as well to drop the malicious macro code to infect the users.
An interesting part of the download stage in one of the documents, is the unexplained usage of a Dropbox “Host” field in the HTTP request header. Upon further analysis, researchers found that Dropbox was the original source for the second stage of the infection, during this campaign.
The final payload in this campaign is downloaded from a compromised server in the form of a CAB file, which is later expanded into the KEYMARBLE backdoor. It is important to note the CAB file is disguised as a JPEG image on the compromised host (http[:]//37.238.135[.]70/img/anan.jpg).
All of the malicious documents downloaded KEYMARBLE, compressed inside a CAB file, which successfully evaded detection and reduced detection from five vendors of Virus Total to just 2 of them.
Impact
Successful Lazarus Attack
Indicators of Compromise
URLs
hxxp[:]//37[.]238[.]135[.]70/img/anan[.]jpg
Filename
LosAngeles_Court_report.doc
Serial_Numbers.xls
2018.11.2~2019.1.26_ErrorDetail.doc
Malware Hash (MD5/SHA1/SH256)
- 088c6157d2bb4238f92ef6818b9b1ffe44109347
- 2b4fb64c13c55aa549815ec6b2d066a75ccd248e
- 4cd5a4782dbed5b8e337ee402f1ef748b5035709
- a5b2c704c5cff550e6c47454b75393add46f156f
- d1410d073a6df8979712dd1b6122983f66d5bef8
- e89458183cb855118539373177c6737f80e6ba3f
Remediation
- Block the threat indicators at their respective controls.
- Do not download files received in emails from unknown sources.
- Never enable macros or ‘enable content’ if a file is not from a trusted source, no matter how interesting it looks.
- Closely monitor all network traffic.