Article Content In the summer of 2018, Unit 42 released reporting regarding activity in the Middle East surrounding a cluster of activity using similar tactics, tools, and procedures (TTPs) in which we named the adversary group DarkHydrus Since that initial reporting, we had not observed new activity from DarkHydrus until recently, when 360TIC published a tweet and subsequent research discussing delivery documents that appeared to be attributed to DarkHydrus In the process of analyzing the delivery documents, we were able to collect additional associated samples, uncover additional functionality of the payloads including the use of Google Drive API, and confirm the strong likelihood of attribution to DarkHydrus We have notified Google of our findings Delivery Document We collected a total of three DarkHydrus delivery documents installing a new variant of the RogueRobin trojan These three documents were extremely similar to each other and are all macro enabled Excel documents with .xlsm file extensions While we cannot confirm the delivery mechanism, it is likely that the instructions to click the Enable Content button were provided during delivery, such as in the body of a spear-phishing email Figure 1 DarkHydrus’ delivery document does not have a lure image or message Without the delivery mechanism we cannot confirm the exact time these delivery documents were used in an attack; however, the observed timestamps within these three delivery documents gives us an idea when the DarkHydrus actors created them While the creation times were timestomped to a default time of 2006-09-16 00:00:00Z commonly observed in malicious documents, the Last Modified times were still available and suggest that DarkHydrus created these documents in December 2018 and January 2019 Table 1 shows the breakdown of timestamps and their associated sample hashes SHA256 Last Modified   e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022  2018-12-15T05:14:32Z    4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8     2018-12-23T05:45:43Z   513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8  2019-01-08T06:51:21Z     Table 1 Timestamps of delivery documents The macro executes immediately after pressing the Enable Content button thanks to the  Workbook_Open sub-function, which will call the actor created New_Macro function The New_Macro function starts by concatenating several strings to create a PowerShell script that it will write to the file %TEMP%\WINDOWSTEMP.ps1 While .sct files are used by a multitude of applications, in this instance it is being used as a Windows Script Component file The WINDOWSTEMP.ps1 script is a dropper that decodes an embedded executable using base64 and decompresses it with the System.IO.Compression.GzipStream object The WindowsTemplate.exe executable is a new variant of RogueRobin written in C# RogueRobin .NET Payload In our original blog on DarkHydrus, we analyzed a PowerShell-based payload we named RogueRobin The similarities between the PowerShell and C# variants of RogueRobin suggests that the DarkHydrus group ported their code to a compiled variant The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger gwmi -query “Select TotalPhysicalMemory from Win32_ComputerSystem” Uses this query to check to see if the total physical memory is less than 2,900,000,000 bytes gwmi -Class win32_Processor | select NumberOfCores Uses this query to check to see if the total number of CPU cores is less than 1 The domain is legitimate and owned by Google This DNS query likely exists as a note to researchers or possibly as an anti-analysis measure, as it will only trigger if the researcher has already patched the initial debugger check to move onto the C2 function Figure 2 shows the code responsible for detecting the attached debugger and issuing the corresponding DNS request Figure 3 shows the RogueRobin payload issuing DNS requests to resolve custom crafted subdomains of its C2 domains using TXT, SOA, MX, CNAME, SRV, A and AAAA query types Figure 3 RogueRobin testing various DNS query types The domains in the test queries, such as aqhpc.akdns[.]live have subdomains that are generated by substituting the digits in the Trojan’s process ID with characters seen in Table 4 (for example qhp for the PID 908) and surrounding these characters with the static characters a and c The C2 server can respond to any of the query types to provide a unique identifier value that the Trojan will store in a variable and use in future DNS requests The Trojan checks the response to this query using the regular expressions in Table 3 If it received a non-cancelling response, the Trojan will extract data from the DNS responses and treat it as commands Table 5 shows the commands that the C# variant of RogueRobin can handle, which is extremely similar to the previously analyzed PowerShell variant Regex   Description   ^kill Kills a thread running in Trojan based on a provided thread name   ^\$fileDownload Uploads a file to the C2 server via the DNS tunnel   ^\$importModule Runs a provided PowerShell command and adds it to a list called ‘modules’   ^\$x_mode Turns on the alternative mode of ‘x_mode’ on to use the alternative C2 channel If preceded by “OFF”, it turns ‘x_mode’ off, otherwise the command is newline delimited with settings to use this alternative C2 functionality ^\$ClearModules Clears the previously run ‘modules’ list   ^\$fileUpload This command should be followed by a string that will be used as a path to save a new file to the system This command will then reach out to the C2 server to obtain the data to save to this file path ^changeConfig Allows the C2 to set values within the Trojan’s configuration via pipe delimited (“|”) string In x_mode, RogueRobin uploads a file to the Google Drive account and continually checks the file’s modification time to see if the actor has made any changes to it The actor will first modify the file to include a unique identifier that the Trojan will use for future communications The Trojan will treat all subsequent changes to the file made by the actor as jobs and will treat them as commands, which it will handle with the same command handler seen in Table 5 Figure 4 shows the code in RogueRobin that handles the x_mode command, specifically splitting the command data on newlines and using the resulting array to set variables used as x_mode settings As seen in Figure 5, the values for these fields are set to variables initially set upon issuing of the x_mode command To upload a file, the Trojan first creates an HTTP POST request to the URL stored in gduu to send the following JSON data to the Google Drive account: { “name” : “<process ID of Trojan>.txt” } Google Drive will respond to this request with an HTTP response whose header contains a Location field The Trojan will write <process ID of Trojan> to a second file stored on the Google Drive instance named <process ID of Trojan>-U.txt The Trojan processes the downloaded data the same way it would for a unique identifier as if the data was obtained via the DNS tunneling protocol using the TXT query mode, specifically by searching the data using the following regular expression: \”(\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>).\” With the unique identifier value obtained from the file on Google Drive, the Trojan will attempt to obtain jobs using the Google Drive communications channel It will use the data after the separator as the string that it will subject to the command handler seen in Table 5 Infrastructure The initial list of C2 domains released by 360TIC associated with 513813af15… appeared thematically very similar to previous DarkHydrus activity, using domain names visually similar to well-known technology vendors or service providers This list was further expanded upon by ClearSky Security (here, here and here) in a series of tweets that provided additional similar domain names also likely linked to DarkHydrus To better understand how these domains are related to DarkHydrus, we began visually mapping the relationships between the list of domains, which can be seen in Figure 7 The diagram shows the DarkHydrus group using a consistent naming schema and structure in their infrastructure They register a multitude of domains and set up nameservers to use as their primary DNS for their C2 domains Figure 7 Relational diagram of DarkHydrus infrastructure For this campaign, we are able to cluster the adversary infrastructure via the specific nameservers that were deployed for C2s The brackets in Figure 7 shows the distinct clustering of infrastructure into three groups We were able to retrieve live payloads associated with two of the clusters A third cluster was also shared by ClearSky Security, but we were unable to associate a live payload to them Although the third cluster does not appear to have any direct relationships to the other two clusters, it is still highly probable that this cluster is related to the two other clusters via the structuring of domains with custom nameservers In addition, the domain names themselves were extremely similar, with some examples being exactly the same but on a different top level domain The two sets of nameservers we were able to associate with the retrieved payloads were tbs1/tbs2.microsoftonline.services and tvs1/tvs2.trafficmanager.live The distribution of C2 domains and their nameservers can be seen in Table 7 Each of the domains appeared to have rotated through the six nameservers but oddly, one of the nameservers that several of the domains had rotated through did not appear to be currently registered Conclusion The DarkHydrus group continues their operations and adds new techniques to their playbook Recent DarkHydrus delivery documents revealed the group abusing open-source penetration testing techniques such as the AppLocker bypass The payloads installed by these delivery documents show that the DarkHydrus actors ported their previous PowerShell-based RogueRobin code to an executable variant, which is behavior that has been commonly observed with other adversary groups operating in the Middle East, such as OilRig
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content In the summer of 2018, Unit 42 released reporting regarding activity in the Middle East surrounding a cluster of activity using similar tactics, tools, and procedures (TTPs) in which we named the adversary group DarkHydrus Since that initial reporting, we had not observed new activity from DarkHydrus until recently, when 360TIC published a tweet and subsequent research discussing delivery documents that appeared to be attributed to DarkHydrus In the process of analyzing the delivery documents, we were able to collect additional associated samples, uncover additional functionality of the payloads including the use of Google Drive API, and confirm the strong likelihood of attribution to DarkHydrus We have notified Google of our findings Delivery Document We collected a total of three DarkHydrus delivery documents installing a new variant of the RogueRobin trojan These three documents were extremely similar to each other and are all macro enabled Excel documents with .xlsm file extensions While we cannot confirm the delivery mechanism, it is likely that the instructions to click the Enable Content button were provided during delivery, such as in the body of a spear-phishing email Figure 1 DarkHydrus’ delivery document does not have a lure image or message Without the delivery mechanism we cannot confirm the exact time these delivery documents were used in an attack; however, the observed timestamps within these three delivery documents gives us an idea when the DarkHydrus actors created them While the creation times were timestomped to a default time of 2006-09-16 00:00:00Z commonly observed in malicious documents, the Last Modified times were still available and suggest that DarkHydrus created these documents in December 2018 and January 2019 Table 1 shows the breakdown of timestamps and their associated sample hashes SHA256 Last Modified   e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022  2018-12-15T05:14:32Z    4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8     2018-12-23T05:45:43Z   513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8  2019-01-08T06:51:21Z     Table 1 Timestamps of delivery documents The macro executes immediately after pressing the Enable Content button thanks to the  Workbook_Open sub-function, which will call the actor created New_Macro function The New_Macro function starts by concatenating several strings to create a PowerShell script that it will write to the file %TEMP%\WINDOWSTEMP.ps1 While .sct files are used by a multitude of applications, in this instance it is being used as a Windows Script Component file The WINDOWSTEMP.ps1 script is a dropper that decodes an embedded executable using base64 and decompresses it with the System.IO.Compression.GzipStream object The WindowsTemplate.exe executable is a new variant of RogueRobin written in C# RogueRobin .NET Payload In our original blog on DarkHydrus, we analyzed a PowerShell-based payload we named RogueRobin The similarities between the PowerShell and C# variants of RogueRobin suggests that the DarkHydrus group ported their code to a compiled variant The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger gwmi -query “Select TotalPhysicalMemory from Win32_ComputerSystem” Uses this query to check to see if the total physical memory is less than 2,900,000,000 bytes gwmi -Class win32_Processor | select NumberOfCores Uses this query to check to see if the total number of CPU cores is less than 1 The domain is legitimate and owned by Google This DNS query likely exists as a note to researchers or possibly as an anti-analysis measure, as it will only trigger if the researcher has already patched the initial debugger check to move onto the C2 function Figure 2 shows the code responsible for detecting the attached debugger and issuing the corresponding DNS request Figure 3 shows the RogueRobin payload issuing DNS requests to resolve custom crafted subdomains of its C2 domains using TXT, SOA, MX, CNAME, SRV, A and AAAA query types Figure 3 RogueRobin testing various DNS query types The domains in the test queries, such as aqhpc.akdns[.]live have subdomains that are generated by substituting the digits in the Trojan’s process ID with characters seen in Table 4 (for example qhp for the PID 908) and surrounding these characters with the static characters a and c The C2 server can respond to any of the query types to provide a unique identifier value that the Trojan will store in a variable and use in future DNS requests The Trojan checks the response to this query using the regular expressions in Table 3 If it received a non-cancelling response, the Trojan will extract data from the DNS responses and treat it as commands Table 5 shows the commands that the C# variant of RogueRobin can handle, which is extremely similar to the previously analyzed PowerShell variant Regex   Description   ^kill Kills a thread running in Trojan based on a provided thread name   ^\$fileDownload Uploads a file to the C2 server via the DNS tunnel   ^\$importModule Runs a provided PowerShell command and adds it to a list called ‘modules’   ^\$x_mode Turns on the alternative mode of ‘x_mode’ on to use the alternative C2 channel If preceded by “OFF”, it turns ‘x_mode’ off, otherwise the command is newline delimited with settings to use this alternative C2 functionality ^\$ClearModules Clears the previously run ‘modules’ list   ^\$fileUpload This command should be followed by a string that will be used as a path to save a new file to the system This command will then reach out to the C2 server to obtain the data to save to this file path ^changeConfig Allows the C2 to set values within the Trojan’s configuration via pipe delimited (“|”) string In x_mode, RogueRobin uploads a file to the Google Drive account and continually checks the file’s modification time to see if the actor has made any changes to it The actor will first modify the file to include a unique identifier that the Trojan will use for future communications The Trojan will treat all subsequent changes to the file made by the actor as jobs and will treat them as commands, which it will handle with the same command handler seen in Table 5 Figure 4 shows the code in RogueRobin that handles the x_mode command, specifically splitting the command data on newlines and using the resulting array to set variables used as x_mode settings As seen in Figure 5, the values for these fields are set to variables initially set upon issuing of the x_mode command To upload a file, the Trojan first creates an HTTP POST request to the URL stored in gduu to send the following JSON data to the Google Drive account: { “name” : “<process ID of Trojan>.txt” } Google Drive will respond to this request with an HTTP response whose header contains a Location field The Trojan will write <process ID of Trojan> to a second file stored on the Google Drive instance named <process ID of Trojan>-U.txt The Trojan processes the downloaded data the same way it would for a unique identifier as if the data was obtained via the DNS tunneling protocol using the TXT query mode, specifically by searching the data using the following regular expression: \”(\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>).\” With the unique identifier value obtained from the file on Google Drive, the Trojan will attempt to obtain jobs using the Google Drive communications channel It will use the data after the separator as the string that it will subject to the command handler seen in Table 5 Infrastructure The initial list of C2 domains released by 360TIC associated with 513813af15… appeared thematically very similar to previous DarkHydrus activity, using domain names visually similar to well-known technology vendors or service providers This list was further expanded upon by ClearSky Security (here, here and here) in a series of tweets that provided additional similar domain names also likely linked to DarkHydrus To better understand how these domains are related to DarkHydrus, we began visually mapping the relationships between the list of domains, which can be seen in Figure 7 The diagram shows the DarkHydrus group using a consistent naming schema and structure in their infrastructure They register a multitude of domains and set up nameservers to use as their primary DNS for their C2 domains Figure 7 Relational diagram of DarkHydrus infrastructure For this campaign, we are able to cluster the adversary infrastructure via the specific nameservers that were deployed for C2s The brackets in Figure 7 shows the distinct clustering of infrastructure into three groups We were able to retrieve live payloads associated with two of the clusters A third cluster was also shared by ClearSky Security, but we were unable to associate a live payload to them Although the third cluster does not appear to have any direct relationships to the other two clusters, it is still highly probable that this cluster is related to the two other clusters via the structuring of domains with custom nameservers In addition, the domain names themselves were extremely similar, with some examples being exactly the same but on a different top level domain The two sets of nameservers we were able to associate with the retrieved payloads were tbs1/tbs2.microsoftonline.services and tvs1/tvs2.trafficmanager.live The distribution of C2 domains and their nameservers can be seen in Table 7 Each of the domains appeared to have rotated through the six nameservers but oddly, one of the nameservers that several of the domains had rotated through did not appear to be currently registered Conclusion The DarkHydrus group continues their operations and adds new techniques to their playbook Recent DarkHydrus delivery documents revealed the group abusing open-source penetration testing techniques such as the AppLocker bypass The payloads installed by these delivery documents show that the DarkHydrus actors ported their previous PowerShell-based RogueRobin code to an executable variant, which is behavior that has been commonly observed with other adversary groups operating in the Middle East, such as OilRig ### Response: .