Article Content Research By: Eli Salem In 2018, we saw a dramatic increase in cyber crimes in Brazil and, separately, the abuse of legitimate native Windows OS processes for malicious intent Cyber attackers used living off the land binaries (LOLbins) to hide their malicious activity and operate stealthily in target systems Using native, legitimate operating system tools, attackers were able to infiltrate and gain remote access to devices without any malware For organizations with limited visibility into their environment, this type of attack can be fatal In this research, we explain one of the most recent and unique campaigns involving the Astaroth trojan This Trojan and information stealer was recognized in Europe and chiefly affected Brazil through the abuse of native OS processes and the exploitation of security-related products Brazil is constantly being hit with cybercrime To read about another pervasive attack in Brazil, check out our blog post.  Pervasive Brazilian Financial Malware Targets Bank Customers in Latin America and Europe The Cybereason Platform was able to detect this new variant of the Astaroth Trojan in a massive spam campaign that targeted Brazil and parts of Europe Our Active Hunting Service team was able to analyze the campaign and identify that it maliciously took advantage of legitimate tools like the BITSAdmin utility and the WMIC utility to interact with a C2 server and download a payload With a sophisticated attack such as this, it is critical for your security team to have a clear understanding of your environment so they can swiftly detect malicious activity and respond effectively.  Unique Aspects to this Latest Version of the Astaroth Trojan Campaign The Astaroth Trojan campaign is a phishing-based campaign that gained momentum towards the end of 2018 and was identified in thousands of incidents Early versions differed significantly from later versions as the adversaries advanced and optimized their attack This version contrasted significantly from previous versions in four key ways This version maliciously used BITSAdmin to download the attackers payload This differed from early versions of the campaign that used certutil As Avast is the most common antivirus software in the world, this is an effective evasive strategy This trusted process is prevalent on Brazilian machines To the best of our knowledge, no other versions of the malware used this process This version used a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and help hide the code it is initiating Earlier versions did not use this method A Breakdown of the Latest Astaroth Trojan Spam Campaign  As with many traditional spam campaigns, this campaign begins with a .7zip file This file gets downloaded to a user machine through a mail attachment or a mistakenly-pressed hyperlink This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw) It is often used by attackers for lateral movement, reconnaissance, and basic code invocation By using a trusted, native utility, the attackers can hide the scope of the full attack and evade detection The initial attack vector as detected by the Cybereason Platform wmic.exe creates a .txt file with information about the domain that stores the remote XSL script It identifies the location of the infected machine, including country, city, and other information Once this information is gathered, it sends location data about the infected machine to the remote XSL script Phase one: An Analysis of the Remote XSL The remote XSL script that wmic.exe sends information to contains highly obfuscated JScript code that will execute additional steps of the malicious activity Initially, the XSL script defines several variables for command execution and data storage It also creates several ActiveX objects These variables are used to invoke legitimate Windows OS processes for malicious activities, and serve as a bridge between the remote domain that stores the script and the infected machine.     Malicious script variables The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating In particular, the script uses this function to hide information related to process names To the best of our knowledge, this method was not used in early versions of the spam campaign The script uses the function radador(), which returns a randomized integer In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign.     String.fromCharCode() usage in the XSL script.   The random number generator function radador() These two obfuscation techniques are used to bypass antivirus defenses and make security researcher investigations more challenging Choosing a C2 Server The XSL script contains variable xparis() that holds the C2 domain the malicious files will be downloaded from pingadori() is a random integer between one and twelve, which decides which domain xparis() is assigned The C2 domain selection mechanism One of the most used functions in the XSL script is Bxaki() Bxaki() takes a URL and a file as arguments In previous iterations, the Astaroth Trojan campaign used cerutil to download files In order to hide this process, it was renamed certis In this iteration, they have replaced certutil with BITSAdmin Bxaki deobfuscated function In order to gain access to the infected computer’s file system, the XSL script uses the variable fso with FileSystemObject capabilities This variable is created using an ActiveX object Within these twelve files are the Astaroth Trojan modules, several additional files the Trojan may use to extend its capabilities, and an r1.log file In earlier variants, upon detecting Avast, the XSL script would simply quit Instead, it now uses Avast to execute malicious actions.  Similar to earlier versions of the Astaroth Trojan campaign, the XSL script searches for Avast on the infected machine, and specifically targets a certain process of Avast aswrundll.exe It uses three variables stem1, stem2, and stem3 that, when combined, form a specific path (C:\Program Files\AVAST Software\AVAST\aswRunDll.exe) to aswRundll.exe It obfuscates this path using the fromCharCode() function aswrundll.exe is the Avast Software Runtime Dynamic Link Library that is responsible for running modules for Avast If aswrundll.exe exists at this path, Avast exists on the machine The use of aswrundll.exe as a LOLbin has been mentioned in the past year Stem variables presented as unicode strings Stem variables decoded to ASCII Manipulating Avast Once the XSL script has identified that Avast is installed on the machine, it loads a malicious module Irdsnhrxxxfery64 from its location on disk In order to load this module, it uses an ActiveX Object ShA created with Shell.Application capabilities The object uses ShellExecute() to create an aswrundll.exe process instance and loads Irdsnhrxxxfery64 Information pertaining to lrdsnhxxfery64.~ This module has to be investigated in a dynamic way to fully understand the malware and the role the module played during execution Information pertaining to lrdsnhrxxfery64_Unpacked.dll Throughout the malware execution, Irdsnhrxxxfery64.~ acts as the main malware controller The module initiates the malicious activity once the payload download is complete If Irdsnhrxxxfery64 is loaded using aswrundll.exe, the module will continue to target aswrundll.exe It will create new instances and continue to inject malicious content to it unins000.exe is a process developed by GAS Tecnologia that is common on Brazilian machines If unins000.exe does not exist, it will target Syswow64\userinit.exe userinit.exe is a native Windows process that specifies the program that Winlogon runs when a user logs on to their computer Similarly, if unins000.exe and Syswow64\userinit.exe do not exist, it will target System32\userinit.exe The malware searches for targeted processes This new process is in a suspended state so the malware can unmap its memory and write its contents to the new, allocated space Once this is complete, it will resume the suspended process Astaroth module creates a process in a suspended state (dwCreationFlags set to 4) Unmapping process memory Writing content and resuming the process Irdsnhrxxxfery98 information collecting capabilities In addition to its own information stealing capabilities, the Astaroth Trojan campaign also uses an external feature NetPass NetPass is one of the downloaded payload files renamed to lrdsnhrxxferyb.jpg Passwords of mail accounts on an exchange server stored by Microsoft Outlook Passwords of MSN Messenger and Windows Messenger accounts Internet Explorer 7.x and 8.x passwords from password-protected web sites that include Basic Authentication or Digest Access Authentication The item name of Internet Explorer 7 passwords that always begin with Microsoft_WinInet prefix The passwords stored by Remote Desktop 6.    NetPass usage The malware executes malicious activity in a small period of time through the target process, deletes itself, and then repeats This occurs periodically and is persistent The malware’s different functionality Once the targeted processes are infected by the malicious modules, they begin communicating with the payload C2 server and exfiltrating information saved to the r1.log file The malicious use of GAS Tecnologia security process unins000.exe.   Data exfiltration from unins000.exe to a malicious IP.  Conclusion Our Active Hunting Service was able to detect both the malicious use of the BITSAdmin utility and the WMIC utility Our customer immediately stopped the attack using the remediation section of our platform and prevented any exfiltration of data From there, our hunting team identified the rest of the attack and completed a thorough analysis We were able to detect and evaluate an evasive infection technique used to spread a variant of the Astaroth Trojan as part of a large, Brazilian-based spam campaign In our discovery, we highlighted the use of legitimate, built-in Windows OS processes used to perform malicious activities to deliver a payload without being detected, as well as how the Astaroth Trojan operates and installs multiple modules covertly We also showed its use of well-known tools and antivirus products to expand its capabilities As we enter 2019, we anticipate that the use of LOLbins will likely increase Because of the great potential for malicious exploitation inherent in the use of native processes, it is very likely that many other information stealers will adopt this method to deliver their payload into targeted machines As a result of this detection, the customer was able to contain an advanced attack before any damage was done The Astaroth Trojan was controlled, WMIC was disabled, and the attack was halted in its tracks Part of the difficulty identifying this attack is in how it evades detection It is difficult to catch, even for security teams aware of the complications ensuring a secure system, as with our customer above LOLbins are deceptive because their execution seems benign at first, or even sometimes safe, as with the malicious use of antivirus software As the use of LOLbins becomes more commonplace, we suspect this complex method of attack will become more common as well The potential for damage will grow as attackers will look to other more destructive payloads
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Research By: Eli Salem In 2018, we saw a dramatic increase in cyber crimes in Brazil and, separately, the abuse of legitimate native Windows OS processes for malicious intent Cyber attackers used living off the land binaries (LOLbins) to hide their malicious activity and operate stealthily in target systems Using native, legitimate operating system tools, attackers were able to infiltrate and gain remote access to devices without any malware For organizations with limited visibility into their environment, this type of attack can be fatal In this research, we explain one of the most recent and unique campaigns involving the Astaroth trojan This Trojan and information stealer was recognized in Europe and chiefly affected Brazil through the abuse of native OS processes and the exploitation of security-related products Brazil is constantly being hit with cybercrime To read about another pervasive attack in Brazil, check out our blog post.  Pervasive Brazilian Financial Malware Targets Bank Customers in Latin America and Europe The Cybereason Platform was able to detect this new variant of the Astaroth Trojan in a massive spam campaign that targeted Brazil and parts of Europe Our Active Hunting Service team was able to analyze the campaign and identify that it maliciously took advantage of legitimate tools like the BITSAdmin utility and the WMIC utility to interact with a C2 server and download a payload With a sophisticated attack such as this, it is critical for your security team to have a clear understanding of your environment so they can swiftly detect malicious activity and respond effectively.  Unique Aspects to this Latest Version of the Astaroth Trojan Campaign The Astaroth Trojan campaign is a phishing-based campaign that gained momentum towards the end of 2018 and was identified in thousands of incidents Early versions differed significantly from later versions as the adversaries advanced and optimized their attack This version contrasted significantly from previous versions in four key ways This version maliciously used BITSAdmin to download the attackers payload This differed from early versions of the campaign that used certutil As Avast is the most common antivirus software in the world, this is an effective evasive strategy This trusted process is prevalent on Brazilian machines To the best of our knowledge, no other versions of the malware used this process This version used a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and help hide the code it is initiating Earlier versions did not use this method A Breakdown of the Latest Astaroth Trojan Spam Campaign  As with many traditional spam campaigns, this campaign begins with a .7zip file This file gets downloaded to a user machine through a mail attachment or a mistakenly-pressed hyperlink This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw) It is often used by attackers for lateral movement, reconnaissance, and basic code invocation By using a trusted, native utility, the attackers can hide the scope of the full attack and evade detection The initial attack vector as detected by the Cybereason Platform wmic.exe creates a .txt file with information about the domain that stores the remote XSL script It identifies the location of the infected machine, including country, city, and other information Once this information is gathered, it sends location data about the infected machine to the remote XSL script Phase one: An Analysis of the Remote XSL The remote XSL script that wmic.exe sends information to contains highly obfuscated JScript code that will execute additional steps of the malicious activity Initially, the XSL script defines several variables for command execution and data storage It also creates several ActiveX objects These variables are used to invoke legitimate Windows OS processes for malicious activities, and serve as a bridge between the remote domain that stores the script and the infected machine.     Malicious script variables The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating In particular, the script uses this function to hide information related to process names To the best of our knowledge, this method was not used in early versions of the spam campaign The script uses the function radador(), which returns a randomized integer In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign.     String.fromCharCode() usage in the XSL script.   The random number generator function radador() These two obfuscation techniques are used to bypass antivirus defenses and make security researcher investigations more challenging Choosing a C2 Server The XSL script contains variable xparis() that holds the C2 domain the malicious files will be downloaded from pingadori() is a random integer between one and twelve, which decides which domain xparis() is assigned The C2 domain selection mechanism One of the most used functions in the XSL script is Bxaki() Bxaki() takes a URL and a file as arguments In previous iterations, the Astaroth Trojan campaign used cerutil to download files In order to hide this process, it was renamed certis In this iteration, they have replaced certutil with BITSAdmin Bxaki deobfuscated function In order to gain access to the infected computer’s file system, the XSL script uses the variable fso with FileSystemObject capabilities This variable is created using an ActiveX object Within these twelve files are the Astaroth Trojan modules, several additional files the Trojan may use to extend its capabilities, and an r1.log file In earlier variants, upon detecting Avast, the XSL script would simply quit Instead, it now uses Avast to execute malicious actions.  Similar to earlier versions of the Astaroth Trojan campaign, the XSL script searches for Avast on the infected machine, and specifically targets a certain process of Avast aswrundll.exe It uses three variables stem1, stem2, and stem3 that, when combined, form a specific path (C:\Program Files\AVAST Software\AVAST\aswRunDll.exe) to aswRundll.exe It obfuscates this path using the fromCharCode() function aswrundll.exe is the Avast Software Runtime Dynamic Link Library that is responsible for running modules for Avast If aswrundll.exe exists at this path, Avast exists on the machine The use of aswrundll.exe as a LOLbin has been mentioned in the past year Stem variables presented as unicode strings Stem variables decoded to ASCII Manipulating Avast Once the XSL script has identified that Avast is installed on the machine, it loads a malicious module Irdsnhrxxxfery64 from its location on disk In order to load this module, it uses an ActiveX Object ShA created with Shell.Application capabilities The object uses ShellExecute() to create an aswrundll.exe process instance and loads Irdsnhrxxxfery64 Information pertaining to lrdsnhxxfery64.~ This module has to be investigated in a dynamic way to fully understand the malware and the role the module played during execution Information pertaining to lrdsnhrxxfery64_Unpacked.dll Throughout the malware execution, Irdsnhrxxxfery64.~ acts as the main malware controller The module initiates the malicious activity once the payload download is complete If Irdsnhrxxxfery64 is loaded using aswrundll.exe, the module will continue to target aswrundll.exe It will create new instances and continue to inject malicious content to it unins000.exe is a process developed by GAS Tecnologia that is common on Brazilian machines If unins000.exe does not exist, it will target Syswow64\userinit.exe userinit.exe is a native Windows process that specifies the program that Winlogon runs when a user logs on to their computer Similarly, if unins000.exe and Syswow64\userinit.exe do not exist, it will target System32\userinit.exe The malware searches for targeted processes This new process is in a suspended state so the malware can unmap its memory and write its contents to the new, allocated space Once this is complete, it will resume the suspended process Astaroth module creates a process in a suspended state (dwCreationFlags set to 4) Unmapping process memory Writing content and resuming the process Irdsnhrxxxfery98 information collecting capabilities In addition to its own information stealing capabilities, the Astaroth Trojan campaign also uses an external feature NetPass NetPass is one of the downloaded payload files renamed to lrdsnhrxxferyb.jpg Passwords of mail accounts on an exchange server stored by Microsoft Outlook Passwords of MSN Messenger and Windows Messenger accounts Internet Explorer 7.x and 8.x passwords from password-protected web sites that include Basic Authentication or Digest Access Authentication The item name of Internet Explorer 7 passwords that always begin with Microsoft_WinInet prefix The passwords stored by Remote Desktop 6.    NetPass usage The malware executes malicious activity in a small period of time through the target process, deletes itself, and then repeats This occurs periodically and is persistent The malware’s different functionality Once the targeted processes are infected by the malicious modules, they begin communicating with the payload C2 server and exfiltrating information saved to the r1.log file The malicious use of GAS Tecnologia security process unins000.exe.   Data exfiltration from unins000.exe to a malicious IP.  Conclusion Our Active Hunting Service was able to detect both the malicious use of the BITSAdmin utility and the WMIC utility Our customer immediately stopped the attack using the remediation section of our platform and prevented any exfiltration of data From there, our hunting team identified the rest of the attack and completed a thorough analysis We were able to detect and evaluate an evasive infection technique used to spread a variant of the Astaroth Trojan as part of a large, Brazilian-based spam campaign In our discovery, we highlighted the use of legitimate, built-in Windows OS processes used to perform malicious activities to deliver a payload without being detected, as well as how the Astaroth Trojan operates and installs multiple modules covertly We also showed its use of well-known tools and antivirus products to expand its capabilities As we enter 2019, we anticipate that the use of LOLbins will likely increase Because of the great potential for malicious exploitation inherent in the use of native processes, it is very likely that many other information stealers will adopt this method to deliver their payload into targeted machines As a result of this detection, the customer was able to contain an advanced attack before any damage was done The Astaroth Trojan was controlled, WMIC was disabled, and the attack was halted in its tracks Part of the difficulty identifying this attack is in how it evades detection It is difficult to catch, even for security teams aware of the complications ensuring a secure system, as with our customer above LOLbins are deceptive because their execution seems benign at first, or even sometimes safe, as with the malicious use of antivirus software As the use of LOLbins becomes more commonplace, we suspect this complex method of attack will become more common as well The potential for damage will grow as attackers will look to other more destructive payloads ### Response: .