Malicious email .ics attachments

Anurag2 Comments

Recently I have received few random emails attached with calendar invites from random email and unknow email ids in CC. These arrived in my inbox insteas of spam. Though, later I moved them to spam box.

Email Attachment:

File type: Calendar invite

File Extesion: .ICS

I have uploaded the ics attachment to Virus Total but no AV vedor detected it as malicious yet.

I have opened ics file in notepad and can see clearly there is URL direction to domain http: // ngsl7. bemobtrcks. com

When I opened the URL “http: // ngsl7. bemobtrcks. com” in browser, it redirects to “http :// receivepayment[.]fun” website and again redirect to “https: // bitcoinwallet. xyz” to “https: // paysitecash. paywest . net” website. Redirection of websites always changed and may land on different website each time I accessed the main URL.

Below screenshot one of the website it redirects.

When it opens up bitcoinwallet [.] receivepayment [.] xyz. It shows bad potential traffic.

There is bad malicious traffic mentioned by any.run because its using Lets encrypt encryption for for suspicious domain.

These are confirmed phishing emails. Calendar invites may bypass traditional email filters, making it easier for phishing emails using this method to reach users’ inboxes and this is what happening.

Below are the network connections getting established opening .ics file to domains.

  • ngsl7[.]bemobtrcks [.]com
  • receivepayment [.] fun
  • ctldl [.] windowsupdate [.] com
  • bitcoinwallet [.] receivepayment [.] xyz

IOC:

MD5: 264D98086A88D5A57E917EFBCFC36F87

MD5: 4187D230F6D850024E8B678B783F4464

MD5: F1C401645FAD5274AB7B86857E4CAF84

Summary:

  • These are cyrpto related phishing emails.
  • If such emails (.ics attached) from unknow sender, better to ignore.

Reference:

MS Excel Malware Analysis

AnuragLeave a comment

MD5: bcdadfdc16bcf022384c4631849e1396

File Type: Microsoft Excel

File Extension: .xlsm

File Name: BillINV-01364_CLIENT_Schedule.xlsm

File Preview:

Excel File Preview

I am analyzing excel file using OleTools to detect suspicious code and IOCs.

> oleid <FileName>

Oleid will help to know whether file has any embedded OLE/Flash objects,VBA macros

Its clear from the above output of oelid, it has suspicious VBA macro. Now, I am going to get the suspecious keywords using MacroRaptor.

> mraptor <FileName>

MacroRaptor gives information based on keywords, such as read, write, execute.

Command flagged the keywords used in file are AutoExec, Write and Execute which could be, on opening document, it will write files to the system and execute them.

Next, OleVBA which will detects obfuscated strings used, extract IP address, executable file name,

> OleVBA -a <FileName>

OleVBA file output

I was trying to open the excel file to check the VBA code execution in VBA developer tool by dubugging the code, but opening the excel file, it was getting closed immediately due the Application.Quite call. So, first I have disabled the macro and opened Developer tools and commented out the code and save the file and again enabled macro back. This way opening excel file, it wasn’t closing immediately.

During debugging of macro, I found that it loads the VBscript GetObject to download the exe from the remote server (https:// ntro[.] fr /officeclick.png).

procmon captured the mSHta.exe Process starts via shell which executes the command shown in below image.

The URL which is getting accessed, no more responding. To dig in more, I extracted the excel file and look for the text file which reference I got from OLEVBA

The text file dvdsvhufhuierhiu.txt I looked for .exe refence and I found it too. This file has base64 string which is PowerShell script and downloads executable jieifhzo11.exe file and copy it to location

C:\Users\<profile>\AppData\Local\

Base64 string from dvdsvhufhuierhiu.txt file

After deobfuscation of above string, I can see the below PowerShell command.

Obfuscated PowerShell script of above base64 string

Summery:

  • Macro execute on document open
  • mSHta.exe executes command via shell.
  • It reads obfuscated string from dvdsvhufhuierhiu.txt which is PowerShell script which downloads jieifhzo11.exe
  • It downloads it from URL https:// ntro[.] fr /officeclick.png.
  • The URL is no more accessible so unable to download the malicious executable file.

Sample Download:

Word Document Malware Analysis

AnuragLeave a comment

MD5: CA15F9F45971EA442943084547761994

File: Microsoft word document

Word Document Screenshot:

File Properties:

I used OLEVBA.py to extract the VBA code but it was giving error. I used oledump.py tools to analyze the file.

Using oledum.py. I ran the below command to get the complete document streams. 

>>oledump.py <filename>

You can see M at Number 18 and 19 which is the VBA macro as explained by the author of this python script Didier Stevens M denotes VBA macros.

So the next command I am running

>>oledump.py -s 18 <filename>

In below screenshot, it can be seen, the module Lev1daeyfvl calling S_gil0c35zh248.Mei497ecvshp on Document_Open()

After looking into more, I found S_gil0c35zh248.Mei497ecvshp which is being called on opening document is an user form. (refer below screenshot)

S_gil0c35zh248.Mei497ecvshp is user form

I opened word document, and navigate to VBA developer tool (Alt + F11). I saw the VBA code will execute on form execution.

Next I debug the code and analyse the behavior.

The PowerShell script is executed by the WMI process by executing VBA code on document open.

I have extracted the PowerShell script which is encoded in base64. by adding a code to copy PowerShell script in text file. Below is the code to extract the PowerShell script.

M2lujl629fpjn has PowerShell script
Encoded PowerShell Script base64

I have decoded the PowerShell script and got the code below.

To decode PowerShell script, I used below PowerShell script. 

$path_to_b64_string_file= Get-Content -Path "C:\output\output.txt"
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($path_to_b64_string_file))
New-Item "C:\output\decoded_b64.txt"
Set-Content -Path "C:\output\decoded_b64.txt" $decoded_b64_string
Write-Host "Decoded Base64 successfully"
Decoded PowerShell script

I debugged the decoded PowerShell script, during the debugging, I found, it creates a folder at location and file it is going to write will be Ws1uczsw.exe

C:\Users\IEUser\AppData\Local\Temp\Word\2019\Ws1uczsw.exe

and there are multiple remote URL’s it tried to download the malicious file.

All URLs are active.

URLVT Score
http://rickthewelder%5B.%5Dcom/dtbkup20110205/i/8/79
http://stiecgps%5B.%5Dcom%5B.%5D br/cgi-bin/7/0/79
http://tfbauru%5B.%5D com[.] br/cgi-bin/Lhe/14/79
https://paulburkphotography%5B.%5D com/_new_images/F/9/79
http://theeldestgeek%5B.%5D com/error/F55/79
http://uniquewv%5B.%5D com/cgi-bin/OVJ9qY/12/79
http://tuls%5B.%5D pl/cgi-bin/7a99/79

When I executed the PowerShell script, it downloaded Ww1uczsw.exe

Downloaded file details:

MD5: A4513379DAD5233AFA402CC56A8B9222

File Type: Win32 Exe

PEid Packer: Microsoft Visual C++ v7.0

Family: Emotet Trojan

Summary:

  • Word document has VBA macros which executes on document open.
  • PowerShell is encoded in base64 and executes to download Emotet Trojan executable.
  • Multiple sources/URLs have been used in code to download the malware on the system.

Download Sample Link

References:

Crimson RAT Malware Analysis

Anurag1 Comment

Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.

MD5: f940e886a40783deb4e97fe6d842da7a

File Type: MS Excel Spreadsheet

Excel file screenshot

VT Score: 35/62

I am using OLETools to get the property of excel file.

cmd > olemeta.py <file name>

Next OLETool command I am running is to get the OLE details.

cmd > olevba.py -a <filename>

Suspicious Indicators:

  • VBA code will auto execute on opening excel workbook.
  • Create directory on the system.
  • Write a file on the system.
  • Execute shell command.
  • hex string used for obfuscation.

Now, I am extracting VBA from excel file and dumping it to txt file. For that command I am running is

cmd> olevba.py --deofb <filename> > Path\output.exe

From the VBA code, I can see the subroutine creates a folder and drop executable file at location C:\ProgramData\Rlmdias\Rlmdias.exe

I opened excel and navigate to VBAProject by clicking Alt+F11. Porject was password protect. I removed password using GitHub code and check out my previous blog how it can be done. Post password removal, I can see there is a userForm1 which has two text box and has a hex values which are PE files will dropped depends on the OS version of the victim 32bit or 64bit

I debugged the VBA code and it dropped a zip file at location “C:\ProgramData\Rlmdias\drngervia.zip” and unzip it using function unSadozip

Dropped zip file has drngervia.exe file. and Shell command execute the executable file

when Shell executed, it opens Windows features and ask to download and Install .Net Framework 3.5

Due to dependency on .net framework, I have installed above Windows feature.

Dropped File:

MD5: 10F955EF9F398E91CA9AE4F34CECD873

File Type: Win32 EXE

File Name: drngervia.exe

Signature: Microsoft Visual C# v7.0 / Basic .NET

Family: Crimson also knows as SEEDOOR and Scarimson

Type: Trojan

VT Score: 47/72

I have used dnSpy to debug the PE file. Looking at the code, it creates persistence creating a registry entry.

It gets the list of running process on the system

Collecting list of running process.

It looks for antivirus software running on the system.

It searches for the antivirus software from the below list.

  • Bit Defender
  • Quick Heal
  • Microsoft Essentials
  • F-Secure
  • Kaspersky
  • Avira
  • Symantec
  • MacAfee
  • AVG
  • Avast

Capabilities of this RAT observed from code:

  • Get the running process on the system.
  • Get the drives, directories and files on the system.
  • Get the host name, User id.
  • Capture screenshots.
  • Get the data from C2 server.
  • Using custom ports to connect to C2 server.

On execution, drngervia.exe try to establish connection with C2 server which IP and ports are hard coded in the code. IP address is in the form decimal values. C2 server didnt respond.

IP AddressPorts
107.175.64.[251]6286, 4486, 8249, 11447, 16865

I have also found the hard coded IP address, username. Malware never hit to this ip [124.115.201. 118]

Behavior:

  • Excel file dropped PE file.
  • PE has dependency on .net framework 2.0.
  • PE file tried to connect to C2 server but C2 server didn’t respond.

Execution flow:

Download Sample: f940e886a40783deb4e97fe6d842da7a

References: