旧的黑月木马，新的盈利方式

Last updated at Thu, 10 Aug 2023 21:06:28 GMT

Rapid7 is tracking a new, 使用黑月木马的更复杂、更有计划的行动, 似乎起源于2022年11月. The campaign is actively targeting various businesses primarily in the USA and Canada. However, it is not used to steal credentials, instead, it implements different evasion and persistence techniques to drop several unwanted programs and stay in victims’ environment for as long as possible.

Blackmoon，也被称为KRBanker，是一个银行木马 first spotted 2015年9月下旬，它被用来攻击韩国的银行. Back in 2015, it employed a “pharming” technique to steal credentials from targeted victims. This technique involved redirecting traffic to a forged website when a user attempts to access one of the banking sites being targeted by the cyber criminals. The fake site masquerades as the original site and urges visitors to submit their information and credentials.

Stage 1 - Blackmoon

The Blackmoon trojan was named after a debug string “blackmoon,” that is present in its code:

Blackmoon drops a dll into C:\Windows\Logs folder named RunDllExe.dll and implements a Port Monitor persistence technique. 端口监视器与Windows打印假脱机程序服务或 spoolsv.exe. When adding a printer Port Monitor, a user (or the attacker in our case) has the ability to add an arbitrary dll that acts as the monitor. There are two ways to add a Port Monitor: via Windows Registry for persistence or via a AddMonitor API call for immediate dll execution.

Our sample implements both, it calls AddMonitor API to immediately execute RunDllExe.dll:

It also sets a driver value in HKLM \ SYSTEM \ CurrentControlSet \ \印刷\监控\ RunDllExe控制 registry key to the malicious dll path.

Next, the malware adds a shutdown system privilege to the Spooler service by adding SeShutdownPrivilege to the RequiredPrivileges value of HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ \假脱机程序服务 registry key.

恶意软件通过设置禁用Windows Defender HKLM \ SOFTWARE \ \微软\ Windows后卫\ DisableAntiSpyware政策 value to “1”.

It also stops and disables “Lanman” service (the service that allows a computer to share files and printers with other devices on the network).

To block all incoming RPC and SMB communication the malware executes the set of following commands:

netsh ipsec static add policy name=Block
netsh ipsec static add filterlist name=Filter1
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
netsh ipsec static add filteraction name=FilteraAtion1 action=block
netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
netsh ipsec static set policy name=块分配=y

The malware sets two additional values under HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ \ aspnet_staters服务: Work and Mining, both set to “1”.

Next, the malware checks if one of the following services exists on the victim’s computer:

• clr_optimization_v3.0.50727_32
• clr_optimization_v3.0.50727_64
• WinHelpsvcs
• Services
• Help Service
• KuGouMusic
• WinDefender
• Msubridge
• ChromeUpdater
• MicrosoftMysql
• MicrosoftMssql
• Conhost
• MicrosotMaims
• MicrosotMais

如果找到该服务，它将被禁用(通过设置“Start”值在 HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ \服务名 到“4”)或通过使用DeleteService API调用删除.

的组合来枚举正在运行的进程 CreateToolhelp32Snapshot and Process32First and Process32Next 调用API终止服务的进程(如果正在运行).

Finally, a Powershell command is executed to delete the running process’ file and the malware exits.

Stage 2 - RunDllExe.dll - injector

RunDllExe.dll is executed by Spooler service and is responsible for injecting a next stage payload into the newly executed svchost.exe process. The malware implements Process Hollowing injection technique. The injected code is a C++ file downloader.

Stage 3 - File Downloader

下载程序首先检查“Work”和“Mining”值是否存在，并设置在下面 HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ \ aspnet_staters服务 注册表项，如果值不存在，它将创建它们并将它们设置为“1”。.

This part of the attack flow checks if all the necessary downloaded files are present (by using PathFileExistsA API call) on the PC,  if not, 恶意软件会在每次下载前休眠两分钟，然后使用 URLDownloadToFileA API call to download the following files:

• C:\WINDOWS\Temp\MpMgSvc.dll
• C:\WINDOWS\Temp\Hooks.exe
• C:\WINDOWS\Temp\MpMgSvc.exe
• C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe

After the download, all files except MpMgSvc.dll are executed:

Stage 4 - Hook.exe - dropper

Hook.exe 将一个额外的DLL放到用户的漫游文件夹中 C:\Users\Username\AppData\Roaming\ GraphicsPerfSvcs.dll and creates a new service named GraphicsPerfSvcs，在系统启动时自动执行. 服务的名称几乎与命名的合法服务相同 GraphicsPerfSvc，属于图形性能监控服务. Naming services and files similarly to those that exist on the victim’s OS is an evasion technique widely used by threat actors.

The dropper then starts the created service. It creates and executes a .vbs, which is responsible for deleting Hook.exe and the .vbs itself:

Stage 4.1 - MpMgSvc.exe - spreader MpMgSvc.exe first creates a new \BaseNamedObjects\Brute_2022 mutex. 因为它负责传播恶意软件，所以它会下降 Doublepulsar-1.3.1.exe, Eternalblue-2.2.0.exe, Eternalromance-1.4.0.exe 并将所有所需的文件库装入C:\Windows\Temp文件夹.

然后，它扫描网络中打开3306、445、1433端口的PC. If any open ports are found, the spreader will attempt to install a backdoor by using EternalBlue and send shellcode to inject dll with Doublepulsar as implemented in the Eternal-Pulsar github project .

有两个dll被删除，一个用于x64架构，另一个用于x86. When injected by Doublepulsar, it will download the first stage Blackmoon malware and follow the same execution stages described in this analysis.

Stage 4.2 - WmiPrvSER.exe - XMRig miner

WmiPrvSER.exe is a classic XMRig Monero miner. Our sample is the XMRig version 6.18, and it creates a BaseNamedObjects\\Win__Host mutex on the victim’s host. You can find a full report on XMRig here.

Stage 5 - GraphicsPerfSvcs service - dropper

As mentioned in the previous stage, the GraphicsPerfSvcs 服务将在系统启动时自动启动. 每次运行时，它将检查以下两个文件是否存在:

• C:\Windows\TEMP\ctfmoon.exe
• C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
  

如果没有找到，它将删除这两个文件以及执行它们所需的所有dll.

The dropper also creates two new firewall rules that allow all outbound connections from dropped files by executing the following commands:

• netsh advfirewall firewall add rule name=ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
• netsh advfirewall firewall add rule name=traffmonetizer dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  

服务保持正常状态，并不断尝试从URL: http:/ /down读取数据.ftp21[.]cc/Update.txt. At the time of the analysis, this URL was down so we were not able to observe its content. However, following the service code, it seems to read the URL content and check if it contains one of the following commands:

[Delete File], [Kill Proccess], or [Delete Service]，将相应删除文件、终止进程或删除服务.

Stage 6 - Ctfmoon.exe and Traffmonetizer.exe - Traffic Stealers

GraphicsPerfSvcs service executes two dropped files: Ctfmoon.exe and Traffmonetizer.exe, both appeared to be Potentially Unwanted Programs (PUP’s) in the form of traffic stealers. Both are using the “network bandwidth sharing” monetization scheme to make “passive income”.

Ctfmoon.exe is a cli version of the Iproyal Pawns application. It gets the user email address and password as execution parameters to associate the activity and collect the money to the passed account. GraphicsPerfSvcs 执行以下命令行启动Iproyal Pawns: ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos

我们可以看到执行参数中提到的用户已经赚了169美元:

The Traffmonetizer.exe is similar to Ctfmoon.exe, created by Traffmonetizer. It reads the user account data from a settings.json file dropped in users roaming directory. Our .json file contains the following content:

{"Token":"1gUgURMzQiuGFgttIdjeZBS0G6fqFlVvhCKlqzfHd3o=","StartWithWindows":false,"Accepting":true}.

Conclusion

The analysis in this blog reveals the efforts threat actors put into the attack flow, by using several evasion and persistence techniques as well as different approaches to make passive income using victims’ resources.

MITRE ATT&CK Techniques:

IOC’s

References

• http://posts.slayerlabs.com/monitor-persistence/