|
Introduction On Monday 2021-02-01, a fellow researcher posted an Excel spreadsheet to the Hatching Triage sandbox. This Excel spreadsheet has a malicious macro, and it uses an updated GlobalSign template that I hadn't noticed before (link for the sample). This Excel spreadsheet pushed what might be SystemBC malware when I tested it in my lab environment on Monday 2021-02-01. My lab host was part of an Active Directory (AD) environment, and I also saw Cobalt Strike as follow-up activity from this infection. Today's diary reviews this specific instance of (what I think is) SystemBC and Cobalt Strike activity from Monday 2021-02-01.
Infection Path I didn't know where these spreadsheets were coming from when I investigated this activity on Monday 2021-02-01. By Tuesday 2021-02-02, several samples had come into VirusTotal showing at least 20 spreadsheets that were contained in zip archives. These appear to have been attachments using emails as a distribution method. Unfortunately, I couldn't find any emails submitted to VirusTotal yet that contained one of the zip archives.
Spreadsheet macro grabs SystemBC malware Enabling macros on a vulnerable Windows host caused HTTPS traffic to grab a Windows executable (EXE) file for SystemBC malware. This EXE was stored and run from new directory path created under the C:\ drive as shown below.
This EXE file was made persistent on the infected host through a scheduled task.
SystemBC post-infection traffic The first post-infection traffic caused by SystemBC was TCP traffic to 109.234.39[.]169 over port 4001 as shown below.
Next was HTTP traffic to the same IP address over TCP port 80 that returned obfuscated text containing code to start the Cobalt Strike activity.
Cobalt Strike traffic Cobalt strike activity consisted of HTTPS traffic and DNS activity focused on the domain fastonent[.]com.
Indicators of Compromise (IOCs) SHA256 HASHES OF 20 ZIP ARCHIVES WITH THE 20 EXCEL FILES THEY CONTAIN: - 31a04fe64502bfe6f73971f9de9736402dd9a21a66d41d3a4ecea5ee18852f1c documentation-82.zip - ce02ed48d9ab12dfe2202c16f1f272f75e5b1c0b64e48e385ca71608cb686fc8 documentation-17.zip - 4dfb0bb69a07f1cd7b46198b5edf8afebd0cdd02f27eb2c687447f692625fb9f contract-86.zip - c3a38df6f4864d32c10e8ecf063e18cba56c3b1add3404634ea20ea109198620 agreement-92.zip - 3a181036cdc46e088f1cb98acd06062d32a8a11a8ef65fe7544bb22a2fd5c56e information-94.zip - 244625f6627cadadb7faf8a6b526e91aee4f5c1cadfa1c0d4fb996f4cc60a5ae documentation-18.zip - cca4a3c8af9b549b445b7e2bcb2d45b95982890b6ed3b62fc882f0478f512b2f agreement-44.zip - dcff925d51e90586eb624f249e56b6abb7026b364fab84dcfcf44025e84ff7d9 DOCUMENT-30.zip - dc5a3675455d9486e7aa8aaf2463b69ad03c508375eb99b6fb3039d914677a9f information-94.zip - 7d1602138a26c0524b32570f3fb292fd5a7efbc5ed53ae260d7b7f3652a78969 documentation-83.zip - 0fb4d8ac3cdef038bf53c8f4269eef5845704a9e962b7609fd93a9f08cc2fab1 documentation-48.zip - 0cf4fff7f96cf695d3476e7dc66794d067acafbd2980f69526b874fc5b4c08be docs-62.zip - 056911f208c9b475020627b83c8bf3a0151e30ec7f71113cf75abb950a431efc answer-46.zip - 31901336fdfae4fdeac46b937a059c618d5ba3e04d06bb8e95108a307e2c6d94 DOCUMENT-74.zip - e06ee4e0bbe581edc39aecaab76e3fa12a53cb971ec0c106644703b376f5ed24 reaction-32.zip 41 OTHER EXCEL FILES WITH THE SAME DOCUMENT TEMPLATE: - 044494acb6d781e6cc3b9a837b7ebca1e933080fe384a874f5eb9cca1ea76a55 DOCUMENT-99.xls AT LEAST 7 URLS GENERATED BY EXCEL MACROS FOR A MALWARE PAYLOAD: - hxxps://alnujaifi-portal[.]com/ds/3101.gif MALWARE PAYLOAD EXAMPLE (SYSTEMBC EXE): - SHA256 hash: 61499704920ee633ffb2baab36eb8eb70d5e0426bca584f9a4a872e4b930c417 SYSTEMBC TRAFFIC: - 109.234.39.169 over TCP port 4001 - encoded/encrypted data COBALT STRIKE ACTIVITY: - 192.169.6.8 over TCP port 443 - no domain - HTTPS traffic
I'm not 100 percent sure this malware is SystemBC, but HTTP traffic caused by the EXE has /systembc/ in the URL, so I'm calling it SystemBC until someone identifies it as another malware family. When I ran the spreadsheet on a stand-alone host, I only saw SystemBC traffic over TCP port 4001. I didn't see the Cobalt Strike traffic until I infected one of my lab hosts within an AD environment. This reflects a trend I've noticed with at least one another malware family (Hancitor), where Cobalt Strike doesn't appear unless the infected host is running in an AD environment. A pcap of the infection traffic and and malware from the infected Windows host can be found here. --- |
Brad 436 Posts ISC Handler Feb 3rd 2021 |
| Thread locked Subscribe |
Feb 3rd 2021 1 year ago |
|
The same image was in Buerloader https://bazaar.abuse.ch/sample/030af453e0140f45b22c9e2fa1dc1441371e55455e4d207eaed78229800ff6b7/
and there were a similar Usedrange "A1:C63" in BazarLoader https://bazaar.abuse.ch/sample/75de7712c3817911df0973c769c348f24593b996b513c1550260626e69a8a99d/ |
Anonymous |
| Quote |
Feb 3rd 2021 1 year ago |
|
Refering to you diary from yesterday: New Example of XSL Script Processing aka "Mitre T1220"
Labeled with "Dridex" https://bazaar.abuse.ch/sample/ddb6ba574987bb5c09e49ccf8446d63b192b04297a902081a32e57cd86cf5000/ uses the XSL-method as well: the code is in the text of the second form BTW: Thank you for the explanation about XSL |
Anonymous |
| Quote |
Feb 3rd 2021 1 year ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
