Pierluigi Paganini March 17, 2020

Malware researchers from Cybaze-Yoroi ZLab have uncovered a new Ursnif campaign that is targeting Italy with a new infection chain.

Introduction

Ursnif is one of the most and widespread common threats today delivered through malspam campaigns. It appeared on the threat landscape about 13 years ago and gained its popularity since 2014 when its source code was leaked online giving the opportunity to several threat actors to develop their own version.

For months, Italian users have been targeted by Ursnif malicious campaigns and Cybaze-Yoroi Zlab have closely observed these campaigns in order to track the evolution of TTPs and the sophistication of the infection chains. In almost all the campaigns identified by the researchers it is possible to notice a massive usage of powershell as  dropper stagers,

This time, Cybaze-Yoroi ZLab intercepted a new Ursnif campaign targeting Italian users that relies on an Italian compromised website that acts as a DropUrl, it also shows a novelty usage of Javascript, batch files and SFX archives, refining the malware’s infection chain.

Figure 1: Ursnif Infection Chain

Technical Analysis

This brand new Ursnif campaign is delivered as a malicious mail containing a password protected document:

Table 1. Sample information

Once the Microsoft Word document is opened, it will ask for a password to enable the opening of the document:

Figure 2: Request of the password inside the document

This technique to protect the document with a password continues to be a very effective method to evade detection of AVs. In fact, at the time of writing, the AV score is zero.

Figure 3: VirusTotal detection rate

Once provided the correct password, the document proceeds with the sophisticated infection chain. Then the  malware enables the execution of an initial batch file:

Figure 4: Piece of the BAT file

The batch file is easy to read, also with the junk numbers placed inside the code. After cleaning the script looks like this:

Code snippet 1

The script creates a new file named “pinumber.vbs” and starts filling it with the instructions through the “echo” function appending the strings to the next vbs stage. The instructions will be commented on in the next stage of the malware infection.

Then the Visual Basic script will be stored in that unusual path:

•  C:\DiskDrive\1\Volume\BackFiles\pinumber.vbs

Code Snippet 2

Another relevant element to notice in “Code Snippet 1”, is the presence of the DropURL provided as an argument to the “Code snippet 2” and used to download the next stages.

• hxxp://tealex.]it/colorex/somatrex.]php

In order to use a VBS script to download the next stage, the malware loads two Objects, “WinHttp.WinHttpRequest.5.1” and “ADODB.Stream” which allow the script to download the required component from the DropURL. This time the DropURL is an Italian compromised law-themed website. The crooks have previously hacked the website and leveraged it to install a webshell on it and finally spread malware. An evidence about the presence of the malicious file hosted on the legit website is shown in the following figure:

Figure 5: Communication with the DropUrl

The SFX module

The downloaded file, as previously mentioned, is a Self Extracting Archive (SFX/SEA). Basic information about the sample are provided below: 

Table 2. Sample information about the ursnif SFX Packer

Exploring the SFX, it is possible to see its content. In the archive, five files with different extensions are stored. Once executed, the first file that  runs is “Dwsil23j.vbs”, as described in the archive configuration on the right of the following figure.  

Figure 6: Content of The SFX file

The content of the VBS script previously mentioned is very trivial: its only purpose is to run “setcong.bat”, a batch script even contained in the SFX archive.  

Code Snippet 3

The content of “setcong.bat” batch file is the following: 

Code Snippet 4

In the figure 6 is reported the content of the SFX archive, we can also notice the presence of the file “driver3213.sys which appears as a driver, but that hides a different content. The file is immediately renamed into “plugin.rar” and extracted through the “lsassc.exe” utility, which is actually a legit routine aimed at extracting other components. The “plugin.rar” is extracted using the password “Control” in this way:

Figure 7: Extraction and content of “plugin.rar” file

The “plugin.rar” archive content

At this point, the script shown in Code Snippet 4 launches the “silent.vbs” script contained inside the “plugin.rar” archive, the script is able to cover tracks deleting some files no longer useful.

The content of the “silent.vbs” archive is the following:

Code Snippet 5

Using the same technique shown in Code Snippet 3, “silent.vbs” script has the only purpose to launch the “data.bat” file just extracted from “plugin.rar” archive:

Code Snippet 6

The bat script executes the “javagh.js” stager after forcing the kill of the previous “.rar” archive and finally removes all the traces through the deletion of all files contained in the folder at “C:\ASPNET\Terminaled\” path. 

The content of the JS script is reported below:

Code snippet 7

This is the last stage of the infection chain. The JS module has got two embedded payloads encoded in Base64 without any type of encryption and any type of obfuscation. The variable named “server” is not referenced by the other code inside the script. However, we decided to take a look inside the executable. The executable is written in .NET and, through a static analysis we discovered a fake Office Update, as shown in the following screen:

Figure 8: Screen of the server.exe file

As previously mentioned, the .exe is never called in the code, so we put our attention on the second payload contained in the variable named “picture”. Once executed, the program has been renamed in “scvhoster.exe” which is nothing but the Ursnif payload already described in other our report. It performs the classic injection technique through “rundll32.exe”, using “iexplore” as host process. After that, all the information about compromised machine are sent over the HTTP protocol using a GET method:

Figure 9: Example of communication with the C2

Unfortunately, at the time of the analysis, the C2 did not correctly respond and the payload does not send to the C2 the configuration about the infection on the victim machine. However, digging inside the memory process, we found the key “fiwDZ5p05nCx1JSA” used to encrypt the configuration string:

Figure 10: Key of the configuration string of Ursnif version

After the decryption phase, as masterfully explained by Fortinet Labs,the string containing all the parameters sent in clear mode looks like following:

Code Snippet 8

Conclusion

In one of our previous analyses, we published a comparative table that tracks the evolution of the TTPs used to spread and deliver the malware. We observed the constant presence of heavily obfuscated Powershell scripts, but this campaign appears different because operators abandoned it in favour of VBS and JS scripts. Our threat intelligence and threat hunting activities confirm this new trend, attackers use javascripts as a multistage loader.

The changes in the TTPs could be caused by:

• The continuous enhancement of the AMSI engine used by Microsoft to scan the powershell scripts;
• The introduction of the events log of the latest versions of the Powershell engine;
• The efficiency and the low AV detection rate of the BAT – SFX – JS chain already observed in campaigns attributed to the Gamaredon cyberespionage group. 

Our constant threat monitoring intelligence aims at tracking the evolution of the modus operandi of these Cyber Threats and at providing the best protection to our clients. 

Figure 11: Update of the comparative table of the Ursnif TTPs

Technical details, including Indicators of Compromise (IoCs) and Yara rules are reported in the analysis published by researchers from Cybaze – Yoroi ZLab:

Pierluigi Paganini

(SecurityAffairs – Ursnif malware, cybercrime)

[adrotate banner=”5″]

[adrotate banner=”13″]