Article Content The OilRig group continues to adapt their tactics and bolster their toolset with newly developed tools The OilRig group (AKA APT34, Helix Kitten) is an adversary motivated by espionage primarily operating in the Middle East region We first discovered this group in mid-2016, although it is possible their operations extends earlier than that time frame They have shown themselves to be an extremely persistent adversary that shows no signs of slowing down Examining their past behaviors with current events only seems to indicate that the OilRig group’s operations are likely to accelerate even further in the near future Between May and June 2018, Unit 42 observed multiple attacks by the OilRig group appearing to originate from a government agency in the Middle East Based on previously observed tactics, it is highly likely the OilRig group leveraged credential harvesting and compromised accounts to use the government agency as a launching platform for their true attacks The targets in these attacks included a technology services provider as well as another government entity Both these targets were in the same nation-state Further, the attacks against these targets were made to appear to have originated from other entities in the same country However, the actual attackers themselves were outside this country and likely used stolen credentials from the intermediary organization to carry out their attacks The attacks delivered a PowerShell backdoor called QUADAGENT, a tool attributed to the OilRig group by both ClearSky Cyber Security and FireEye In our own analysis, we were able to also confirm the attribution of this tool to the OilRig group by examining specific artifacts that were reused from tools previously used by the OilRig group in addition to tactics reused from previous attacks as well The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented However, packaging these scripts into a portable executable (PE) file is not a tactic we have seen the OilRig group use frequently Detailed analysis of QUADAGENT and its ties to Oilrig is the appendix at the end of this blog QUADAGENT is the 12th custom built tool that Unit 42 has documented the OilRig group using for their attacks Our analysis revealed the two QUADAGENT PE files we obtained were slightly different from each other Primarily, one used a Microsoft .NET Framework-based dropper that also opens a decoy dialog box, which can be seen in Figure 1 The other sample was a PE file generated via a bat2exe tool QUADAGENT PE Files The QUADAGENT backdoors dropped onto the hosts were nearly identical to each other, with the only differences being the command and control server (C2) and randomized obfuscation We were also able to locate a third delivery package of the QUADAGENT backdoor as reported by ClearSky Cyber Security In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic Attack Details This latest attack consisted of three waves between May and June 2018 All three waves involved a single spear phishing email that appeared to originate from a government agency based in the Middle East Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft In the two waves (May 30 and June 3) against the technology services provider, the victim email addresses were not easily discoverable via common search engines, indicating the targets were likely part of a previously collected target list, or possibly known associates of the compromised account used to send the attack emails The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename <redacted> Technical Services.exe Its sole purpose here is to install the QUADAGENT backdoor and execute it This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1 Figure 1 Decoy dialog box The tactic of using a decoy dialog box is commonly used by multiple adversaries and is generally deployed as a method to reduce suspicion by the victim In comparison to being silently run, a victim may be less suspicious of a dialog/error message because they are provided what appears to be a legitimate error response when attempting to open the attachment When a file is silently run, because there is no response to the user’s action, a victim may be more suspicious or curious on what actually happened The C2 techniques remained identical, with the only change being the server which became cpuproc[.]com Using rdppath[.]com as a pivot point, we collected an additional QUADAGENT sample also communicating to this C2 (SHA256: d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de), which was first reported by ClearSky Cyber Security The use of malicious macro delivery documents is a tactic we have observed the OilRig group use repeatedly over the three years we’ve been tracking them The actual QUADAGENT script payload used in the ClearSky sample was exactly the same as the one we found in the bat2exe version used against the aforementioned technical services provider The delivery document also used a filename that could be related to other technology services or media organizations within that same nation state, although it is inconclusive Unlike many other delivery documents used by this group, there was no additional decoy content after the macro was enabled Figure 2 Lure image used to entice users to enable macros Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis “{1}{0}” -f ‘bar’,’foo’) During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis.  We used the two previously mentioned obfuscation options within Invoke-Obfuscation on this QUADAGENT sample, which resulted in the generation of a very similar script as the Office365DCOMCheck.ps1 and SystemDiskClean.ps1 payloads delivered in the attacks discussed in this blog We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack Figure 3 Possible steps carried out in Invoke-Obfuscation on the QUADAGENT sample Conclusion The OilRig group continues to be a persistent adversary group in the Middle East region While their delivery techniques are fairly simple, the various tools we have attributed as part of their arsenal reveal sophistication In this instance, they illustrated a typical behavior of adversary groups, wherein the same tool was reused in multiple attacks, but each had enough modifications via infrastructure change, additional obfuscation, and repackaging that each sample may appear different enough to bypass security controls A key component to always remember is that for these type of adversary groups, they will follow the path of least resistance in their attacks, as long as their mission directive is accomplished Palo Alto Networks customers may learn more and are protected via the following ways:  WildFire classifies QUADAGENT samples as malicious QUADAGENT C2 Domains have been classified as malicious AutoFocus customers can track QUADAGENT via its corresponding tag    IOCs SHA256 Hashes QUADAGENT d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520 d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63   ThreeDollars 1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c 119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc   Domains rdppath[.]com cpuproc[.]com acrobatverify[.]com   Filenames Office365DCOMCheck.ps1 Office365DCOMCheck.vbs SystemDiskClean.ps1 SystemDiskClean.vbs AdobeAcrobatLicenseVerify.ps1 c:\Users\<username>\AppData\Roaming\Out.jpg   Appendix  QUADAGENT Relationship to Other OilRig Tools During our regular data gathering functions several months ago, we collected a delivery document (SHA256: 1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c) that contained an at-the-time an unknown payload which would be revealed to be QUADAGENT While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame In addition, the delivery document shared metadata artifacts with the ThreeDollars delivery document (SHA256: 119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc) that OilRig used to deliver the ISMAgent payload in a targeted attack In January 2018 on a government entity in the Middle East The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2 Examining the subdomains for acrobatverify[.]com reveals three subdomains, www, resolve, and dns The passive DNS data for the subdomains shows an IP resolution of 185.162.235[.]121 from December 2017 through January 2018 Prior to this time period, we see several subdomains of msoffice-cdn[.]com, ns1, ns2, and www also resolving to this IP This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers We provide more on the specific usage of these protocols as we discuss the inner workings of this malware in this section The downloader will use the filename of the script (ex The task itself is fairly simple, calling the VBScript file which contains a PowerShell one-liner as an argument to run the QUADAGENT payload (ex Office365DCOMCheck or SystemDiskClean), such as the following:   HKCU\Office365DCOMCheck   The payload uses this registry key to store a session identifier unique to the compromised system, as well as a pre-shared key used for encrypting and decrypting communications between the system and the C2 server This registry key is empty upon the first execution of the payload To trigger this, if the HTTPS requests do not work, the payload attempts to cause an exception by dividing 1 by 0 If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain:   mail.<random number between 100000 and 999999>.<c2 name>   This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake The payload will issue a DNS query to the following domain to notify the C2 that it is about to send it data (session ID value) to it in a subsequent query:   ns1.<random number between 100000 and 999999>.<c2 name> The payload does nothing with the C2 server’s response to the query The type field specifies the command that the payload will handle This specific variant of the payload can only handle one command type, x The batch script will then rename Out.jpg to Office365DCOMCheck.ps1 and execute it with the following command:       @shift /0rename Out.jpg Office365DCOMCheck.ps1PowerShell -exec bypass -File .\Office365DCOMCheck.ps1     The .NET variant (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) is even simpler This dropper starts by displaying the dialog box in Figure 1, previously shown and discussed with the following command:       Interaction.MsgBox("An error occurred while processing your request It will then execute it as a shell object:       cmd.exe /c powershell -exec bypass -file "C:\Users\Administrator\AppData\Local\Temp\SystemDiskClean.ps1"     In the malicious macro attack, the same Office365DCOMCheck.ps1 script that was used in the PE version is used as the payload When the document is opened, a lure image as shown as seen in Figure 2 is displayed in an attempt to coerce the victim to enable macros The creator of the delivery document was able to visually hide the PowerShell script in the header by setting the text to a font size of 2 and font color of white, as seen in Figure 4 Figure 4 Hidden PowerShell script within the document’s header using a small white font This technique of hiding malicious content by using a small white font is not unique to this threat group, as we recently observed the Sofacy group use this technique to hide DDE instructions within one of their delivery documents 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content The OilRig group continues to adapt their tactics and bolster their toolset with newly developed tools The OilRig group (AKA APT34, Helix Kitten) is an adversary motivated by espionage primarily operating in the Middle East region We first discovered this group in mid-2016, although it is possible their operations extends earlier than that time frame They have shown themselves to be an extremely persistent adversary that shows no signs of slowing down Examining their past behaviors with current events only seems to indicate that the OilRig group’s operations are likely to accelerate even further in the near future Between May and June 2018, Unit 42 observed multiple attacks by the OilRig group appearing to originate from a government agency in the Middle East Based on previously observed tactics, it is highly likely the OilRig group leveraged credential harvesting and compromised accounts to use the government agency as a launching platform for their true attacks The targets in these attacks included a technology services provider as well as another government entity Both these targets were in the same nation-state Further, the attacks against these targets were made to appear to have originated from other entities in the same country However, the actual attackers themselves were outside this country and likely used stolen credentials from the intermediary organization to carry out their attacks The attacks delivered a PowerShell backdoor called QUADAGENT, a tool attributed to the OilRig group by both ClearSky Cyber Security and FireEye In our own analysis, we were able to also confirm the attribution of this tool to the OilRig group by examining specific artifacts that were reused from tools previously used by the OilRig group in addition to tactics reused from previous attacks as well The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented However, packaging these scripts into a portable executable (PE) file is not a tactic we have seen the OilRig group use frequently Detailed analysis of QUADAGENT and its ties to Oilrig is the appendix at the end of this blog QUADAGENT is the 12th custom built tool that Unit 42 has documented the OilRig group using for their attacks Our analysis revealed the two QUADAGENT PE files we obtained were slightly different from each other Primarily, one used a Microsoft .NET Framework-based dropper that also opens a decoy dialog box, which can be seen in Figure 1 The other sample was a PE file generated via a bat2exe tool QUADAGENT PE Files The QUADAGENT backdoors dropped onto the hosts were nearly identical to each other, with the only differences being the command and control server (C2) and randomized obfuscation We were also able to locate a third delivery package of the QUADAGENT backdoor as reported by ClearSky Cyber Security In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic Attack Details This latest attack consisted of three waves between May and June 2018 All three waves involved a single spear phishing email that appeared to originate from a government agency based in the Middle East Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft In the two waves (May 30 and June 3) against the technology services provider, the victim email addresses were not easily discoverable via common search engines, indicating the targets were likely part of a previously collected target list, or possibly known associates of the compromised account used to send the attack emails The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename <redacted> Technical Services.exe Its sole purpose here is to install the QUADAGENT backdoor and execute it This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1 Figure 1 Decoy dialog box The tactic of using a decoy dialog box is commonly used by multiple adversaries and is generally deployed as a method to reduce suspicion by the victim In comparison to being silently run, a victim may be less suspicious of a dialog/error message because they are provided what appears to be a legitimate error response when attempting to open the attachment When a file is silently run, because there is no response to the user’s action, a victim may be more suspicious or curious on what actually happened The C2 techniques remained identical, with the only change being the server which became cpuproc[.]com Using rdppath[.]com as a pivot point, we collected an additional QUADAGENT sample also communicating to this C2 (SHA256: d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de), which was first reported by ClearSky Cyber Security The use of malicious macro delivery documents is a tactic we have observed the OilRig group use repeatedly over the three years we’ve been tracking them The actual QUADAGENT script payload used in the ClearSky sample was exactly the same as the one we found in the bat2exe version used against the aforementioned technical services provider The delivery document also used a filename that could be related to other technology services or media organizations within that same nation state, although it is inconclusive Unlike many other delivery documents used by this group, there was no additional decoy content after the macro was enabled Figure 2 Lure image used to entice users to enable macros Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis “{1}{0}” -f ‘bar’,’foo’) During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis.  We used the two previously mentioned obfuscation options within Invoke-Obfuscation on this QUADAGENT sample, which resulted in the generation of a very similar script as the Office365DCOMCheck.ps1 and SystemDiskClean.ps1 payloads delivered in the attacks discussed in this blog We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack Figure 3 Possible steps carried out in Invoke-Obfuscation on the QUADAGENT sample Conclusion The OilRig group continues to be a persistent adversary group in the Middle East region While their delivery techniques are fairly simple, the various tools we have attributed as part of their arsenal reveal sophistication In this instance, they illustrated a typical behavior of adversary groups, wherein the same tool was reused in multiple attacks, but each had enough modifications via infrastructure change, additional obfuscation, and repackaging that each sample may appear different enough to bypass security controls A key component to always remember is that for these type of adversary groups, they will follow the path of least resistance in their attacks, as long as their mission directive is accomplished Palo Alto Networks customers may learn more and are protected via the following ways:  WildFire classifies QUADAGENT samples as malicious QUADAGENT C2 Domains have been classified as malicious AutoFocus customers can track QUADAGENT via its corresponding tag    IOCs SHA256 Hashes QUADAGENT d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520 d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63   ThreeDollars 1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c 119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc   Domains rdppath[.]com cpuproc[.]com acrobatverify[.]com   Filenames Office365DCOMCheck.ps1 Office365DCOMCheck.vbs SystemDiskClean.ps1 SystemDiskClean.vbs AdobeAcrobatLicenseVerify.ps1 c:\Users\<username>\AppData\Roaming\Out.jpg   Appendix  QUADAGENT Relationship to Other OilRig Tools During our regular data gathering functions several months ago, we collected a delivery document (SHA256: 1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c) that contained an at-the-time an unknown payload which would be revealed to be QUADAGENT While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame In addition, the delivery document shared metadata artifacts with the ThreeDollars delivery document (SHA256: 119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc) that OilRig used to deliver the ISMAgent payload in a targeted attack In January 2018 on a government entity in the Middle East The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2 Examining the subdomains for acrobatverify[.]com reveals three subdomains, www, resolve, and dns The passive DNS data for the subdomains shows an IP resolution of 185.162.235[.]121 from December 2017 through January 2018 Prior to this time period, we see several subdomains of msoffice-cdn[.]com, ns1, ns2, and www also resolving to this IP This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers We provide more on the specific usage of these protocols as we discuss the inner workings of this malware in this section The downloader will use the filename of the script (ex The task itself is fairly simple, calling the VBScript file which contains a PowerShell one-liner as an argument to run the QUADAGENT payload (ex Office365DCOMCheck or SystemDiskClean), such as the following:   HKCU\Office365DCOMCheck   The payload uses this registry key to store a session identifier unique to the compromised system, as well as a pre-shared key used for encrypting and decrypting communications between the system and the C2 server This registry key is empty upon the first execution of the payload To trigger this, if the HTTPS requests do not work, the payload attempts to cause an exception by dividing 1 by 0 If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain:   mail.<random number between 100000 and 999999>.<c2 name>   This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake The payload will issue a DNS query to the following domain to notify the C2 that it is about to send it data (session ID value) to it in a subsequent query:   ns1.<random number between 100000 and 999999>.<c2 name> The payload does nothing with the C2 server’s response to the query The type field specifies the command that the payload will handle This specific variant of the payload can only handle one command type, x The batch script will then rename Out.jpg to Office365DCOMCheck.ps1 and execute it with the following command:       @shift /0rename Out.jpg Office365DCOMCheck.ps1PowerShell -exec bypass -File .\Office365DCOMCheck.ps1     The .NET variant (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) is even simpler This dropper starts by displaying the dialog box in Figure 1, previously shown and discussed with the following command:       Interaction.MsgBox("An error occurred while processing your request It will then execute it as a shell object:       cmd.exe /c powershell -exec bypass -file "C:\Users\Administrator\AppData\Local\Temp\SystemDiskClean.ps1"     In the malicious macro attack, the same Office365DCOMCheck.ps1 script that was used in the PE version is used as the payload When the document is opened, a lure image as shown as seen in Figure 2 is displayed in an attempt to coerce the victim to enable macros The creator of the delivery document was able to visually hide the PowerShell script in the header by setting the text to a font size of 2 and font color of white, as seen in Figure 4 Figure 4 Hidden PowerShell script within the document’s header using a small white font This technique of hiding malicious content by using a small white font is not unique to this threat group, as we recently observed the Sofacy group use this technique to hide DDE instructions within one of their delivery documents  ### Response: .