Article Content Unit 42 has been tracking a series of attacks using a remote backdoor malware family named Comnie, which have been observed targeting organizations in the East Asia region The Comnie malware family is notable in that it leverages online blogs and third-party services to obtain command and control (C2) information Recent instances of the malware have been observed leveraging github.com, tumbler.com, and blogspot.com These decoys documents pertain to various subject matters that the targets would be likely to be interested in The contents of these documents suggest that the main interests of threat actor likely included the organizations in the following industries, located in Taiwan:  Telecommunication Defense Government High Tech  The most recent attacks, in November 2017, likely targeted organizations in the following industries, located in South Korea:  Aerospace Defense  Additionally, while researching this campaign, we identified historical attacks that appear to target the Taiwan government, an IT service vendor based in Asia, and a journalist of a Tibetan radio station Activities Involving Comnie Beginning in mid of 2015, we observed the Comnie malware family delivered via malicious macros with various file names and decoy subject matters Original file names, as well as information revealed within the decoy documents used by these samples provide clues as to who the targets may be In the most recent attacks in November 2017, the information suggests that these attacks have most likely taken place against Aerospace and Defense industry targets in South Korea Original File Name Translation Decoy Location Most Likely Target   관계기관번호.xls Affiliate numbers.xls Affiliate phone numbers for a South Korean international airport KR Aerospace   PBCS_관련_현황_보고.doc PBCS_related_status_report.doc Report on the status of Performance-Based Communication and Surveillance (PBCS) KR Aerospace Defense      The following decoy contents are only shown to the victim after macros have been enabled:    Figure 1 Decoy document discussing an airport contact list in Korean  Figure 2 Decoy document discussing Performance Based Communication and Surveillance (PBCS)   Before the attacks against South Korean targets, the same malicious macros were used to deliver the Comnie malware family to targets in Taiwan as early as 2015 Again, based on the original file names and the decoy contents, the most commonly witnessed targets in attacks that occurred in 2017 included those involving the Telecommunication, Defense, and High-Tech industries in Taiwan Executes the newly created wscript.exe payload   Figure 7 Example macro used to delivery Comnie An interesting discovery was made when examining the macros used to deliver Comnie Based on evidence gleaned from both the macro and other data collected from the samples, it appears that the threat actor did not generate these documents from scratch Instead, they appear to have been created based on an existing sample available via public sample repositories The existing sample in question was created by a red team penetration tester at a financial institution for internal testing The following image shows a comparison of macro code extracted from Comnie dropper and financial institution’s penetration test sample Figure 8 Comparison of macros extracted from Comnie dropper versus a pentest sample used by a financial organization  Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication Additionally, the malware looks for multiple security products on victim machines and sometimes alters its behavior depending on the products present More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix These security products included those that are known to be most widely used within South Korea and Taiwan When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory Unit 42 has observed a total of two variants of Comnie One of the ways the variants differ is in how they obtain their command and control (C2) information Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications However, the obfuscation mechanism varies slightly In older variants, Comnie was found to look for the ‘++a++’ markers Newer Comnie variants, such as the ones witnessed in the most recent attacks, instead look for the ‘magnet:/’ and ‘?’ markers, such as in the following recent example:  Figure 10 New Comnie variants determining their C2 information via a GitHub profile Comnie will upload information about the victim It also allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL) More detailed information about how C2 information is decoded and additional technical analysis of Comnie may be found in the Appendix Conclusion Comnie is far from a new threat, however, it continues to remain active In the past year, we have observed multiple low volume attacks in various regions of East Asia Based on clues provided by the malware’s original file names, as well as the decoy content embedded within these samples, we can make a reasonable estimation that these attacks targeted organizations in Taiwan in the Telecommunication, Defense, Government, and High-Tech industries Additionally, those same estimations may be made for attacks in South Korea targeting the Aerospace and Defense industries While we have witnessed modifications to the attacker’s toolsets, the overall architecture and operations of the Comnie malware family have remained consistent, suggesting that the attackers have been able to stay below the radar of the security community The Comnie malware family is notable in that it leverages third-party online services to download and parse C2 information Because these third-party online services are legitimate, it allows Comnie to circumvent a number of security preventions that may be present in the environment This overall technique has previously been referred to as using a “Dead Drop Resolver” or DDR Palo Alto Networks customers are protected from this threat in the following ways:  All identified samples have been flagged as malicious by WildFire and Traps Customers may track this threat using the ‘Comnie’ AutoFocus tag Traps appropriately catches the macro execution from the malware and prevents it  Additionally, blogspot, tumblr, and github have been alerted to the malicious activity discovered Appendix  Comnie Technical Analysis For the analysis of the Comnie malware family, we investigated the following sample:    SHA256 18ec68e1bd9b11f22e481d48c415f8d80edb76e9032ba4e1d31d87e16eed9959    When the sample is initially executed, it will attempt to create a mutex with a name of ‘tmutexabc’ to ensure only a single instance of Comnie is running at a given time Should this mutex already be found to exist, the malware will immediately exit After these functions are loaded, Comnie determines if it is running within the %TEMP% directory of the victim machine In the event it is not running within this directory, it will copy itself to %TEMP% and execute this newly created file with an argument of the original file’s path It is unclear how this file is used exactly, as it does not appear to ever be written during runtime by Comnie Comnie continue to enter its installation routine With a few exceptions, Comnie will perform the following actions regardless of what security product, if any, is discovered:  Convert itself to a temporary DLL with a default export of ‘Dm’ in the %TEMP% directory In such a scenario, Comnie will drop a temporary VBS script to write the ‘Conime.lnk’ file After the installation routine, the malware will decrypt an embedded blob of data using RC4 with an embedded 8-byte static key of ‘\x11\xcc\xd1\x32\x61\x21\xd1\xe2’ The first 64 bytes are used as the key The next 4 bytes represent the underlying data’s length, and the remaining data is the C2 data Data is sent via HTTP, and is encrypted against using the RC4 algorithm Data is provided first via the ‘pid’ GET parameter initially, and via the ‘iid’ GET parameter when POST requests are made by Comnie Initially, Comnie will send the following request:  Figure 15 Comnie initial beacon In order to decrypt the data provided within the ‘pid’ parameter, a key is generated using the SessionID information, which is randomly generated This particular data is decoded from hex and bytes at offsets 0, 2, 4, 6, 8, 10, 12, and 14 are used to form an 8-byte RC4 key In this case, the instruction is asking for information that is to be written to a temporary BAT file within the %TEMP% directory The following example information is provided by the remote C2 server:       [MISSION]Id=2017Crc=201701[BAT]Num=1FileName1=gethostinfo.batCrc1=2017011ResultFile1=info.dat       This INI file is parsed to determine what Comnie should do The results of this BAT script are uploaded to the remote C2 server
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Unit 42 has been tracking a series of attacks using a remote backdoor malware family named Comnie, which have been observed targeting organizations in the East Asia region The Comnie malware family is notable in that it leverages online blogs and third-party services to obtain command and control (C2) information Recent instances of the malware have been observed leveraging github.com, tumbler.com, and blogspot.com These decoys documents pertain to various subject matters that the targets would be likely to be interested in The contents of these documents suggest that the main interests of threat actor likely included the organizations in the following industries, located in Taiwan:  Telecommunication Defense Government High Tech  The most recent attacks, in November 2017, likely targeted organizations in the following industries, located in South Korea:  Aerospace Defense  Additionally, while researching this campaign, we identified historical attacks that appear to target the Taiwan government, an IT service vendor based in Asia, and a journalist of a Tibetan radio station Activities Involving Comnie Beginning in mid of 2015, we observed the Comnie malware family delivered via malicious macros with various file names and decoy subject matters Original file names, as well as information revealed within the decoy documents used by these samples provide clues as to who the targets may be In the most recent attacks in November 2017, the information suggests that these attacks have most likely taken place against Aerospace and Defense industry targets in South Korea Original File Name Translation Decoy Location Most Likely Target   관계기관번호.xls Affiliate numbers.xls Affiliate phone numbers for a South Korean international airport KR Aerospace   PBCS_관련_현황_보고.doc PBCS_related_status_report.doc Report on the status of Performance-Based Communication and Surveillance (PBCS) KR Aerospace Defense      The following decoy contents are only shown to the victim after macros have been enabled:    Figure 1 Decoy document discussing an airport contact list in Korean  Figure 2 Decoy document discussing Performance Based Communication and Surveillance (PBCS)   Before the attacks against South Korean targets, the same malicious macros were used to deliver the Comnie malware family to targets in Taiwan as early as 2015 Again, based on the original file names and the decoy contents, the most commonly witnessed targets in attacks that occurred in 2017 included those involving the Telecommunication, Defense, and High-Tech industries in Taiwan Executes the newly created wscript.exe payload   Figure 7 Example macro used to delivery Comnie An interesting discovery was made when examining the macros used to deliver Comnie Based on evidence gleaned from both the macro and other data collected from the samples, it appears that the threat actor did not generate these documents from scratch Instead, they appear to have been created based on an existing sample available via public sample repositories The existing sample in question was created by a red team penetration tester at a financial institution for internal testing The following image shows a comparison of macro code extracted from Comnie dropper and financial institution’s penetration test sample Figure 8 Comparison of macros extracted from Comnie dropper versus a pentest sample used by a financial organization  Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication Additionally, the malware looks for multiple security products on victim machines and sometimes alters its behavior depending on the products present More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix These security products included those that are known to be most widely used within South Korea and Taiwan When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory Unit 42 has observed a total of two variants of Comnie One of the ways the variants differ is in how they obtain their command and control (C2) information Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications However, the obfuscation mechanism varies slightly In older variants, Comnie was found to look for the ‘++a++’ markers Newer Comnie variants, such as the ones witnessed in the most recent attacks, instead look for the ‘magnet:/’ and ‘?’ markers, such as in the following recent example:  Figure 10 New Comnie variants determining their C2 information via a GitHub profile Comnie will upload information about the victim It also allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL) More detailed information about how C2 information is decoded and additional technical analysis of Comnie may be found in the Appendix Conclusion Comnie is far from a new threat, however, it continues to remain active In the past year, we have observed multiple low volume attacks in various regions of East Asia Based on clues provided by the malware’s original file names, as well as the decoy content embedded within these samples, we can make a reasonable estimation that these attacks targeted organizations in Taiwan in the Telecommunication, Defense, Government, and High-Tech industries Additionally, those same estimations may be made for attacks in South Korea targeting the Aerospace and Defense industries While we have witnessed modifications to the attacker’s toolsets, the overall architecture and operations of the Comnie malware family have remained consistent, suggesting that the attackers have been able to stay below the radar of the security community The Comnie malware family is notable in that it leverages third-party online services to download and parse C2 information Because these third-party online services are legitimate, it allows Comnie to circumvent a number of security preventions that may be present in the environment This overall technique has previously been referred to as using a “Dead Drop Resolver” or DDR Palo Alto Networks customers are protected from this threat in the following ways:  All identified samples have been flagged as malicious by WildFire and Traps Customers may track this threat using the ‘Comnie’ AutoFocus tag Traps appropriately catches the macro execution from the malware and prevents it  Additionally, blogspot, tumblr, and github have been alerted to the malicious activity discovered Appendix  Comnie Technical Analysis For the analysis of the Comnie malware family, we investigated the following sample:    SHA256 18ec68e1bd9b11f22e481d48c415f8d80edb76e9032ba4e1d31d87e16eed9959    When the sample is initially executed, it will attempt to create a mutex with a name of ‘tmutexabc’ to ensure only a single instance of Comnie is running at a given time Should this mutex already be found to exist, the malware will immediately exit After these functions are loaded, Comnie determines if it is running within the %TEMP% directory of the victim machine In the event it is not running within this directory, it will copy itself to %TEMP% and execute this newly created file with an argument of the original file’s path It is unclear how this file is used exactly, as it does not appear to ever be written during runtime by Comnie Comnie continue to enter its installation routine With a few exceptions, Comnie will perform the following actions regardless of what security product, if any, is discovered:  Convert itself to a temporary DLL with a default export of ‘Dm’ in the %TEMP% directory In such a scenario, Comnie will drop a temporary VBS script to write the ‘Conime.lnk’ file After the installation routine, the malware will decrypt an embedded blob of data using RC4 with an embedded 8-byte static key of ‘\x11\xcc\xd1\x32\x61\x21\xd1\xe2’ The first 64 bytes are used as the key The next 4 bytes represent the underlying data’s length, and the remaining data is the C2 data Data is sent via HTTP, and is encrypted against using the RC4 algorithm Data is provided first via the ‘pid’ GET parameter initially, and via the ‘iid’ GET parameter when POST requests are made by Comnie Initially, Comnie will send the following request:  Figure 15 Comnie initial beacon In order to decrypt the data provided within the ‘pid’ parameter, a key is generated using the SessionID information, which is randomly generated This particular data is decoded from hex and bytes at offsets 0, 2, 4, 6, 8, 10, 12, and 14 are used to form an 8-byte RC4 key In this case, the instruction is asking for information that is to be written to a temporary BAT file within the %TEMP% directory The following example information is provided by the remote C2 server:       [MISSION]Id=2017Crc=201701[BAT]Num=1FileName1=gethostinfo.batCrc1=2017011ResultFile1=info.dat       This INI file is parsed to determine what Comnie should do The results of this BAT script are uploaded to the remote C2 server ### Response: .