Pierluigi Paganini June 11, 2019

For months the Italian users have been targeted by waves of malspam delivering infamous Ursnif variants, Yoroi-Cybaze ZLab detailed its evolution.

Introduction

For months the Italian users have been targeted by waves of malspam delivering infamous Ursnif variants. Yoroi-Cybaze ZLab closely observed these campaigns and analyzed them to track the evolution of the techniques and the underlined infection chain, noticing an increasing sophistication. For instance, the latest waves increased their target selectivity abilities by implementing various country-checks and their anti-analysis capabilities through heavy code obfuscation.

In our previous post, we enumerated the delivery methods and the principal TTPs of the attackers behind the Ursnif mlaware threat. Indeed, in this report we’ll describe the increasing complexity of more recent infection chains, counting more than ten level of obfuscation in addition to a new steganography technique designed for Windows 10 machines.

Technical Analysis

Table 1: Static info about the Ursnif Dropper

The attackers are still leveraging malicious Excel documents to lure their targets to start  the infection chain, which are required to enable the macro code hidden inside these kind of vectors.

Once opened, a fake obfuscated image invites the victim to enable the content in order to start the malicious macro (as shown in Figure 1 on the left). However, moving the blurred  figure away reveals the cell A1 contains hidden code: its content is a Base64 encoded script.

As shown, the macro retrieves the content from the first cell of the document and it subsequently concatenates it with the content of the six rows below the first one. Its execution starts the “powershell stage” of the infection: a long series of multi-layered obfuscated scripts.

Code Snippet 1

The Powershell Stage

In the first layer we noticed the declaration of the variable “$j”, used in the next step of the obfuscation to delay the execution of the script through Sleep library function invocations:

Code snippet 2

The interesting peculiarity of this stage is the check for Windows version installed on the victim machine. The highlighted code shows an “if” condition to choose which branch of the infection chain should be executed. If the target version is not Windows 10, the malware runs the content of “OBFUSCATED PAYLOAD ONE” (the other branch is discussed on “The Windows 10 Branch” section) . Digging into the “payload one” branch, the next step is:

Code snippet 3

Resulting in the following snippet:

Code Snippet 4

This piece of code is quite familiar in the ursnif infection chains, it is responsible to download a particular PNG image from image sharing platforms, such as “imgbox.com”. The image contains further powershell code hidden through the LSB steganography techniques we already described.

The hidden code inside this apparently harmless picture is the following:

Code Snippet 5

Closely observing the first line of code, is possible to notice this code will be executed only if a particular condition is met: it retrieves the current date, extracting the month field, in this case is May (“Maggio” in Italian) and compares it to the regular expression “*gg*”. This check ensures the target user is Italian and the sample is run according to the campaign timespan. Once the condition is met, the “OBFUSCATED PAYLOAD THREE” is executed revealing another obfuscated layer.

Code Snippet 6

This fourth payload is substantially hex encoded with the addition of other particular chars and can be reconstructed using the “[Convert]::ToInt16()” function, unveiling another layer:

Code snippet 7

Fifth payload is a compressed Base64-encoded string immediately decompressed and executed, enabling even a sixth step:

Code Snippet 8

This layer is quite different because it contains a junk-char enriched hexadecimal code, actually XOR encrypted with the 0x52 key. Its result is:

Code Snippet 9

At this point, the code is almost in clear. We noticed some additional replace operations to obfuscate the code, so we headed into the last step of the obfuscation:

Code Snippet 10

This is the last step, at least for the “powershell stage”. In fact, this step shows the purpose is to download a PE32 payload from a very hidden drop-site location, move it into %TEMP% path and run it.

The Loader

At this point, we analyzed an incredibly tricky series of obfuscated powershell snippets, but we don’t have to forget the PE32 payload.

Table 2: Static info about Ursnif Loader

This sample is the classic Ursnif DLL loader able to inject malicious code into the “explorer.exe” process. This particular sample has been downloaded from “loaidifds[.club” server.

The final payload is simply a base64-encoded Portable Executable file: the dll to be injected into the “explorer.exe” process.

The Payload

Table 3: Static information about the Ursnif malicious DLL

This is a typical Ursnif malware payload. In order to extract some interesting data, we manually analyzed it.

Inspecting the dll, we noticed it embeds three C2 reference on its configuration. During the analysis, the first two C2s, filomilalno[.club and fileneopolo[.online, were still active. Moreover, analyzing the DLL we identified some other interesting configuration strings, which will be reported in the Configuration strings section.

The Windows 10 Branch

Back in “Code Snippet 2” we described the check about the Windows OS version installed. But this time, we proceed with the analysis of the other control-flow branch, the Windows 10 one:

Code Snippet 11

The structure of the instructions is quite easy: the PAYLOAD TWO actually is a sequence of decimal numbers immediately replaced with other chars. When the replacement is over, the payload is executed thanks to the following command:

[Reflection.Assembly]::Load([byte[]]$y)

This means, the content of the variable “$y” actually is a .NET Dynamic Linked Library. It has the following static information:

The purpose of this DLL is to download another PNG image containing a series of commands, hidden through steganography techniques. Interestingly, the Library has no exported functions and the loaded code is directly invoked by the powershell command “([SA.Sii]::pf())“, in “Code Snippet 11”, retrieving class “Sii” inside namespace “SA” and invoking the static method “pf”:

The pf() method is designed to download the PNG image in Figure 8 from the legit “postimg[.cc” platform. In this case, the steganography technique is not the same as the one seen in the other branch, in fact the malware also uses a layer of the AES encryption. An avid readers could also notice the peculiarity of the encryption schema used in the DLL: the encryption not only provides confidentiality against on-the-wire steganalysis, but also provides an additional country-check to ensure the victim is one of the designed target. In fact, the decryption key is generated starting from the LCID property of the current “CultureInfo“, data structure providing information about calendar,language and locale in use on the machine.

The return value of the “pf()” function is the payload hidden inside the figure above. Obviously, it is an obfuscated powershell script. As in the previous branch, the payload contains various heavily obfuscated layers, this time six.

The sixth powershell stage of this branch contains  not only one country check, but two.

The first check is for the “HKCU:\Control Panel\Desktop” registry key, which must have  a “Preferred Languages” matching the “It” string, and the second one looks for the result of the powershell command “${host}.CurrentCulture” that have to match the substring “*ali*”, clearly referencing the Italian one.

Code snippet 12

After that, we retrieved the same payload described in section “The Loader”.

Conclusion

Cybaze-Yoroi ZLAB team analyzed many Ursnif related attacks in the past months, the recent ones are showing evidence of an increasing sophistication and complexity, especially in the weaponization phase of the attack killchain, in the preparation of such multi-layered and highly obfuscated infection chain to deliver the Ursnif payload.

Considering the volume and the insistence of this malware threat against the Italian panorama is clear the Threat Groups behind these attacks are strongly leveraging an automated weaponization of the attacks, investing resources, time and money to prepare these complex and geo-located infection chains. Indicating Italy is persistently targeted by cyber-crime actors who reached some degree of organizational maturity and keeps evolving their attack techniques, implying an increased risk for Italian Companies and Organizations.

Technical details, including IoCs and Yara Rules, are available in the analysis published in the Yoroi blog.

https://blog.yoroi.company/research/how-ursnif-evolves-to-keep-threatening-italy/

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Ursnif, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]