Rewterz Threat Alert – North Korea’s Lazarus Resurfaces With Fresh Campaigns

Severity

High

Analysis Summary

The campaign consists of dropping PDF file documents and Microsoft word documents with embedded macros.

The main infection flow consists of the following three main steps.

1. A ZIP file which contains two documents, a benign decoy PDF document and a malicious Word document with macros.
2. The malicious macro downloads a VBS script from a Dropbox URL, followed by the VBS script execution.
3. The VBS script downloads a CAB file from the dropzone sever, extracts the embedded EXE file (backdoor) using3. Windows’ “expand.exe” utility, and finally executes it.

The attackers lured the users with multiple images to “Enable Content” button so that the document can trigger the malicious macro code.

Attackers used an excel as well to drop the malicious macro code to infect the users.

An interesting part of the download stage in one of the documents, is the unexplained usage of a Dropbox “Host” field in the HTTP request header. Upon further analysis, researchers found that Dropbox was the original source for the second stage of the infection, during this campaign.

The final payload in this campaign is downloaded from a compromised server in the form of a CAB file, which is later expanded into the KEYMARBLE backdoor. It is important to note the CAB file is disguised as a JPEG image on the compromised host (http[:]//37.238.135[.]70/img/anan.jpg).

All of the malicious documents downloaded KEYMARBLE, compressed inside a CAB file, which successfully evaded detection and reduced detection from five vendors of Virus Total to just 2 of them.

Impact
Successful Lazarus Attack

Indicators of Compromise

URLs

hxxp[:]//37[.]238[.]135[.]70/img/anan[.]jpg

Filename

LosAngeles_Court_report.doc

Serial_Numbers.xls

2018.11.2~2019.1.26_ErrorDetail.doc

Malware Hash (MD5/SHA1/SH256)

• 088c6157d2bb4238f92ef6818b9b1ffe44109347
• 2b4fb64c13c55aa549815ec6b2d066a75ccd248e
• 4cd5a4782dbed5b8e337ee402f1ef748b5035709
• a5b2c704c5cff550e6c47454b75393add46f156f
• d1410d073a6df8979712dd1b6122983f66d5bef8
• e89458183cb855118539373177c6737f80e6ba3f

Remediation

• Block the threat indicators at their respective controls.
• Do not download files received in emails from unknown sources.
• Never enable macros or ‘enable content’ if a file is not from a trusted source, no matter how interesting it looks.
• Closely monitor all network traffic.