最后更新于2024年6月28日星期五18:00:03 GMT
The following Rapid7 analysts contributed to this research: Leo Gutierrez, 泰勒麦格劳, 莎拉•李, 托马斯·埃尔金斯.
执行概要
周二, 6月18日, 2024, Rapid7 initiated an investigation into suspicious activity in a customer environment. Our investigation identified that the suspicious behavior was emanating from the installation of Notezilla, a program that allows for the creation of sticky notes on a Windows desktop. Notezilla的安装程序, 以及RecentX和Copywhiz等工具, are distributed by the India-based company Conceptworld at the official domain conceptworld [.]com
. After analyzing the installation packages for all three programs, Rapid7 discovered that the installers had been trojanized to execute information-stealing malware that has the capability to download and execute additional payloads.
信息披露
On Monday, June 24th, 2024, Rapid7 contacted Conceptworld to disclose the backdoored installers being hosted on conceptworld [.]com
根据… Rapid7的漏洞披露策略. 12小时内, Conceptworld confirmed and remediated the issue by removing the malicious installers from conceptworld [.]com
把它们换成合法的,有签名的副本. Rapid7 is grateful to Conceptworld for their prompt action on this issue.
Overview
Conceptworld is an India-based company offering three different software products: Notezilla, which allows users to create sticky notes on a Windows desktop; RecentX, which stores recently used files/applications/clipboard data; and Copywhiz, 这改进了文件复制和备份操作. 官方提供免费试用下载 conceptworld [.]com
每个软件包的站点.
所提供的安装包 conceptworld [.]com
在调查的时候, however, 与合法安装程序一起执行恶意软件, 没有签名, 并且与下载页面上声明的文件大小不匹配. The differences in the file sizes are due to the malware and its dependencies, which increases the size of the compromised installation packages.
Filename | SHA256散列 | Filesize | Notes |
---|---|---|---|
NotezillaSetup.exe | 6f49756749d175058f15d5f3c80c8a7d46e80ec3e5eb9fb31f4346abdb72a0e7 | 17.07 MB | Trojanized. |
NotezillaSetup.exe | 51243990ef8b82865492f0156ebbb23397173647c02a0d83cf3e3dfb4ef8a6bc | 15.19 MB | 合法,由Conceptworld签署. |
RecentXSetup.exe | 4df9b7da9590990230ed2ab9b4c3d399cf770ed7f6c36a8a10285375fd5a292f | 15.79 MB | Trojanized. |
RecentXSetup.exe | a6ad6492e88bdb833d34ac122c266f1fadd9509ecfe0246e283728e4af49f433 | 13.92 MB | 合法,由Conceptworld签署. |
CopywhizSetup.exe | 2eae4f06f2c376c6206c632ac93f4e8c4b3e0e63eca3118e883f8ac479b2f852 | 14.14 MB | Trojanized. |
CopywhizSetup.exe | fd8d13123218f48c6ab38bf61d94113b4d97095e59fb415e6aa5d9ada012206e | 12.27 MB | 合法,由Conceptworld签署. |
The malware Rapid7 observed contains the functionality to steal browser credentials and crypto currency wallet information, 记录剪贴板内容和按键, 下载并执行额外的有效载荷. 感染系统后, the malware persists via a scheduled task that executes the primary payload every three hours.
基于提交给VirusTotal的文件, the malicious copies of the installers have existed since early June of 2024. 木马安装程序提供的恶意软件有效载荷, however, seem to belong to a nameless malware family that has been in distribution since at least January of 2024. Rapid7内部将这个恶意软件家族称为 dllFake because of the naming scheme used for several of the malware payloads.
恶意安装程序名称 | VirusTotal首次提交 |
---|---|
NotezillaSetup.exe | 2014-06-10 06:43:34 utc |
RecentXSetup.exe | 2014-06-07 21:38:11 utc |
CopywhizSetup.exe | 2014-06-08 07:25:17 utc |
技术分析
要深入了解恶意软件的有效载荷, we will analyze the malicious installer that was served for Notezilla.
首次访问
Rapid7 determined that trojanized installers for the 32-bit and 64-bit versions of Notezilla, Copywhiz, 和RecentX是, 在调查的时候, 由官方网站提供服务 conceptworld [.]com
. Any users searching for this software via a popular search engine at the time were most likely to find the official domain as the first result, 然后引导他们下载恶意软件吗.
执行
下面提供的安装程序 conceptworld [.]com
在调查的时候Notezilla是 NotezillaSetup.exe
, which, based on static analysis, is packed using software called 智能安装制造商(5.04)
.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure1.png)
Figure 1. 软件属性 NotezillaSetup.exe
.
使用 sim_unpacker
该工具的插件 UniExtract2, we were able to unpack and acquire most of the contents of the installation package, 例如嵌入的文件和配置信息. The configuration file contains references to the legitimate software installer for Notezilla, 它被放入 %TEMP%
在执行期间, and multiple files that are dropped into the installation directory (i.e.(staging文件夹) % LOCALAPPDATA % \ WindowsApps \ \微软
在执行期间.
安装文件 |
---|
curl.exe |
7z.exe |
dllBus.bat |
dllBus32.exe |
dllCrt.bat |
dllCrt.xml |
dllCrt32.exe |
dll_apps.txt |
dll_srv.txt |
dll_updt.txt |
NotezillaSetup.exe |
![](http://blog.aliveinlondon.com/content/images/2024/06/figure2.png)
Figure 2. 使用sim-unpacker工具输出.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure3.png)
Figure 3. 的内容 installer.config
.
一旦执行, NotezillaSetup.exe
然后执行该文件吗 dllCrt32.exe
从暂存目录 % LOCALAPPDATA % \ WindowsApps \ \微软
通过WINAPI调用 ShellExecuteA
和动词搭配 open
. 然后再打一个电话给 ShellExecuteA
执行文件 NotezillaSetup.exe
,合法安装程序的副本,来自 %TEMP%
. 结果是, the only thing seen by the end user after initial execution is the installation window pop-up for the legitimate installer, prompting the user to proceed with the installation process for Notezilla.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure4.png)
Figure 4. Typical Process Tree for Initial 执行 of the Trojanized Installer.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure5.png)
Figure 5. The User’s View after the Infection has Already Begun in the Background.
The file dllCrt32.exe
is a relatively small (~10KB) program that only serves as a wrapper to call CreateProcessA
执行文件 dllCrt.bat
.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure6.png)
Figure 6. 的内容 dllCrt.bat
.
批处理文件 dllCrt.bat
然后创建一个名为?的隐藏计划任务 检查dllHourly32
using schtasks.exe
and an XML file that was previously dropped into the staging directory at % LOCALAPPDATA % \ \ WindowsApps \ dllCrt微软.xml
. 计划任务 检查dllHourly32
然后执行该文件吗 % LOCALAPPDATA % \ \ WindowsApps \ dllBus32微软.exe
最初创建后每三小时一次, which means that the primary malware payload will not be executed until at least three hours after the user originally executed the trojanized installer.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure7.png)
Figure 7. 内部命令行组装 dllBus32.exe
.
When dllBus32.exe
执行时,它还用作调用 CreateProcessA
, though it initially retrieves several important command line parameters. 首先,调用CRT库函数 sprintf
连接一个硬编码的IPv4地址. 然后,第二个电话 sprintf
concatenates the assembled IPv4 address with several other arguments to be passed to the batch file dllBus.bat
. Finally, CreateProcessA
用完全组装的命令行调用.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure8.png)
Figure 8. 的开头几行 dllBus.bat
.
的命令行参数 dllBus.bat
via dllBus32.exe
包含IPv4地址, SFTP端口, ZIP存档有效负载的密码, 两组SFTP凭据, and the staging directory where the majority of the malware’s files are located.
参数# | Purpose | Value | Notes |
---|---|---|---|
1 | C2 IPv4地址 | 212.70.149[.]210 | 存储在dlbus32中.exe. |
2 | SFTP港口 | 2265 | 用于所有curl请求,与IPv4地址无关. |
3 | 邮政密码 | MnX!8fsGt0@ | 用于解密/解压缩下载的归档文件. |
4 | SFTP用户名 | phn_sys | 上传被盗数据时使用的SFTP凭证. |
5 | SFTP密码 | phn_sys的密码. | |
6 | SFTP用户名 | phn_prj | 用于下载有效载荷的SFTP凭据. |
7 | SFTP密码 | phn_prj的密码 |
批处理文件 dllBus.bat
contains functionality to facilitate the theft of information from 谷歌Chrome, Mozilla Firefox, 以及多种加密货币钱包. 的副本 curl.exe
dropped by the installer is also used to connect to a list of command-and-control (C2) addresses hosting SFTP servers. The curl commands are used to download an updated list of C2 addresses, 以明文形式存储在文件中 dll_srv.txt
, and to download and execute additional payloads saved within encrypted ZIP archives named Updt.zip
, Apps.zip
, and BB.zip
. The batch script will also attempt to compress all files on the infected system that have specific file extensions and exist in directories that are not on a hardcoded blacklist (for exfiltration). 所有被盗数据最终都使用 7z.exe
并使用curl直接上传到所选的C2 SFTP服务器.
有针对性的浏览器 |
---|
Mozilla Firefox |
谷歌Chrome |
目标加密钱包 |
---|
Atomic |
Exodus |
Jaxx自由 |
Guarda |
Electrum |
Coinomi |
目标文件扩展名 | 列入黑名单的文件路径字符串 |
---|---|
txt,医生,jpg, png | “*微软*”,“* indows *”,“* otoshop *”,“* *”程序文件,“* rogramData”,“所有用户”,"AppData","Default","Public" |
的有效载荷 Apps.zip
and Updt.zip
创建的可执行文件 PyInstaller, which means the original Python script used to create the executables can be recovered trivially using a 公开可用的提取器. 的有效载荷 dllChrome32.exe
,包含在 Updt.zip
, is used to facilitate theft of credentials from 谷歌Chrome’s database that are then saved into the file %临时% \ chrm.txt
格式为:URL,用户名,密码.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure9.png)
Figure 9. 的主要功能 dllChrome32.exe.
的有效载荷 dllTemp32.exe
and dllCache32.exe
存储在 Apps.zip
contain a clipboard stealer and a keylogger, where the results are saved to the files cl.txt
and kl.txt
,分别在暂存目录at % LOCALAPPDATA % \ WindowsApps \ \微软
.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure10.png)
Figure 10. 复制到剪贴板的所有数据被转储到 cl.txt
when dllTemp32.exe
正在运行.
![](http://blog.aliveinlondon.com/content/images/2024/06/figure11.png)
Figure 11. dllCache32.exe
日志按键到 kl.txt
运行时.
Rapid7 did not observe any of the identified SFTP servers hosting the third payload, BB.zip
,在写作的时候,虽然内容 dllBus.bat
指示它包含可执行文件 srvBus32.exe
and srvCrt32.exe
,其功能未知.
缓解指导
Rapid7 recommends verifying the file integrity of freely available software. Check that the file hash and properties of the downloaded file(s) match those provided by the official distributor and/or that they contain a valid and relevant signature. The malicious installers observed in this case are unsigned and have a file size that is inconsistent with copies of the legitimate installer, 就像官方下载页面上写的那样.
如果是Notezilla安装程序, RecentX, Copywhiz在一个月内在一个系统上执行过, Rapid7 recommends checking for signs of compromise due to the malicious installers detailed in this blog. The primary indicators of infection include the hidden scheduled task 检查dllHourly32
and a persistent running instance of the Windows Command Prompt, cmd.exe
,使出站网络连接通过 curl.exe
.
如果发现妥协的证据, Rapid7 recommends re-imaging affected systems to a known good baseline to eradicate any changes made by the malware.
Rapid7客户
InsightIDR, 管理检测和响应, and pg电子 customers have existing detection coverage through Rapid7's expansive library of detection rules. Rapid7 recommends installing the Insight agent on all applicable hosts to ensure visibility into suspicious processes and proper detection coverage. Below is a non-exhaustive list of detections that are deployed and will alert on behavior related to this activity:
检测 |
---|
持久性 - SchTasks Creating A Task Pointed At Users Temp Or Roaming Directory |
攻击者-提取7zip档案与密码 |
可疑进程- 7zip从用户目录执行 |
Suspicious Process - TaskKill Executed Successively In Short Time Period |
Attacker Technique - Curl or Wget To Public IP Address With Non Standard Port |
斜接丙氨酸&CK技术
Tactic | Technique | Procedure |
---|---|---|
资源开发 | T1584.004基础设施:服务器 | The threat actor gained access to the official domain responsible for serving software downloads. |
首次访问 | T1195.002:供应链妥协:妥协软件供应链 | The threat actor trojanized copies of the legitimate installers being served on the official website, 执行恶意软件. |
执行 | T1204.002:用户执行:恶意文件 | Users are tricked into executing the malicious installer as it is served from the official website. |
执行 | T1059.003命令和脚本解释器:Windows命令Shell | Much of the malware’s functionality is facilitated through batch script files. |
执行 | T1059.006命令和脚本解释器:Python | 使用PyInstaller创建了几个第二阶段的有效载荷. |
执行 | T1053.005:定时任务/Job:定时任务 | Initial execution of the primary batch script is delayed by at least 3 hours by the creation of a scheduled task. |
持久性 | T1053.005:定时任务/Job:定时任务 | The malware is executed every 3 hours and will persist through reboots. |
凭据访问 | T1555.003: Credentials from Password Stores: Credentials from Web Browsers | The malware decrypts and dumps credentials from 谷歌Chrome and Mozilla Firefox. |
集合 | T1560.001存档收集的数据:存档通过实用程序 | 被盗数据通过7z存档.exe. |
集合 | T1115:剪贴板数据 | A second stage malware payload dumps all clipboard data to disk. |
集合 | T1005:本地系统数据 | The malware compresses and steals files according to a file extension list and directory path strings blacklist. |
集合 | T1056.001:输入捕获:键盘记录 | 第二阶段的恶意软件有效载荷将击键记录到磁盘上. |
指挥与控制 | T1571:非标准端口 | The threat actor uses port 2265 for SFTP instead of the default: 22. |
漏出 | T1048:通过替代协议进行泄漏 | The malware uploads stolen data to C2 servers using SFTP via curl. |
妥协指标
网络指标(nbi)
域/ IPv4地址 | Notes |
---|---|
conceptworld [.]com | 服务恶意安装程序的官方域名. |
5.180.185[.]42 | C2存放SFTP服务器的IPv4地址. |
50.2.108[.]102 | C2存放SFTP服务器的IPv4地址. |
50.2.191[.]154 | C2存放SFTP服务器的IPv4地址. |
104.140.17[.]242 | C2存放SFTP服务器的IPv4地址. |
104.206.2[.]18 | C2存放SFTP服务器的IPv4地址. |
104.206.57[.]117 | C2存放SFTP服务器的IPv4地址. |
104.206.95[.]146 | C2存放SFTP服务器的IPv4地址. |
104.206.220[.]113 | C2存放SFTP服务器的IPv4地址. |
170.130.34[.]114 | C2存放SFTP服务器的IPv4地址. |
185.137.137[.]74 | C2存放SFTP服务器的IPv4地址. |
212.70.149[.]210 | C2存放SFTP服务器的IPv4地址. |
hbi (Host-Based Indicators)
File | SHA256 | Notes |
---|---|---|
NotezillaSetup.exe | 6F49756749D175058F15D5F3C80C8A7D46E80EC3E5EB9FB31F4346ABDB72A0E7 | 木马化的安装程序包. |
NotezillaSetup32.exe | BFA99C41AECC814DE5B9EB8397A27E516C8B0A4E31EDD9ED1304DA6C996B4AAA | 木马化的安装程序包. |
CopywhizSetup.exe | 2EAE4F06F2C376C6206C632AC93F4E8C4B3E0E63ECA3118E883F8AC479B2F852 | 木马化的安装程序包. |
CopywhizSetup32.exe | 048CAE10558CDDFB2CF0ADE25F1101909BBA58D0A448E0D78590CC5E64E95127 | 木马化的安装程序包. |
RecentXSetup.exe | 4DF9B7DA9590990230ED2AB9B4C3D399CF770ED7F6C36A8A10285375FD5A292F | 木马化的安装程序包. |
RecentXSetup32.exe | EBF2B84ED64629242F8D0ABFCA73344736205249539474E8F57D1D3DBE8CCC41 | 木马化的安装程序包. |
dllBus.bat | 1FA84B696B055F614CCD4640B724D90CCAD4AFC035358822224A02A9E2C12846 | Batch script that coordinates execution of other payloads and performs exfiltration of stolen data. |
dllCrt.xml | CDC1F2430681E9278B3F738ED74954C4366B8EFF52C937F185D760C1BBBA2F1D | 用于创建持久化的计划任务. |
dllCrt32.exe | FDC84CB0845F87A39B29027D6433F4A1BBD8C5B808280235CF867A6B0B7A91EB | 执行dllCrt.bat. |
dllCrt.bat | A89953915EABE5C4897E414E73F28C300472298A6A8C055FCC956C61C875FD96 | 使用dllCrt创建计划任务.xml. |
dllBus32.exe | 70BCE9C228AACBDADAAF18596C0EB308C102382D04632B01B826E9DB96210093 | 执行dllBus.使用多个命令行参数. |
Apps.zip | CA6FF18EE006E7AB3CB42FC541B08CE4231DADFAB0CCE57B1C126DB3DF9F1297 | 包含有效负载dllTemp32的加密归档文件.dllCache32 . exe.exe. |
dllTemp32.exe | 33E4D5EED3527C269467EEC2AC57AE94AE34FD1D0A145505A29C51CF8E83F1B9 | 在执行期间从剪贴板窃取数据. |
dllCache32.exe | 03761D9FD24A2530B386C07BF886350AE497E693440A9319903072B93A30C82D | 在执行过程中记录击键. |
Updt.zip | 6487A0DC9DFBBAA6557AF096178A1361E49762A41500AA03F17DF5D3B159BF4E | 包含dllChrome32的加密归档文件.exe. |
dllChrome32.exe | DE4E03288071CDEBE5C26913888B135FB2424132856CC892BAEA9792D6C66249 | Decrypts and dumps credentials from the 谷歌Chrome database if present. |