Security researchers uncovered a malicious campaign that used Windows event logs to store malware, a technique which enabled the threat actors to plant fileless malware in the file system.
The method which has not been previously documented publicly for attacks in the wild includes various techniques and modules designed to keep the activity as stealthy as possible.
Kaspersky researchers collected a sample of the malware as they identified it as a threat on a customer’s computer. After investigation it was revealed that the malware was part of a “very targeted” campaign and relied on a large set of tools, both custom and commercially available.
In this method, the shellcode payloads is injected into Windows event logs for the Key Management Services (KMS), an action completed by a custom malware dropper.
According to Denis Legezo, lead security researcher at Kaspersky, this method has been used for the first time ‘in the wild’ during the malicious campaign.
The dropper copies the legitimate OS error handling file WerFault.exe to ‘C:\Windows\Tasks’ and then drops an encrypted binary resource to the ‘wer.dll’ (Windows Error Reporting) in the same location, for DLL search order hijacking to load malicious code.
DLL hijacking is a hacking technique that exploits legitimate programs with insufficient checks to load into memory a malicious Dynamic Link Library (DLL) from an arbitrary path.
Legezo says that the main aim of the dropper is to loader on the disk for the side-loading process and to look for particular records in the event logs (category 0x4142 – ‘AB’ in ASCII). If no such record is found, it writes 8KB chunks of encrypted shellcode, which are later combined to form the code for the next stager.
Legezo notes that various techniques and modules (pen-testing suites, custom anti-detection wrappers, final stage trojans) were used in the campaign. He believes that the threat actor is highly skilled or has a good set of quite profound commercial tools.
Among the tools used in the attack are the commercial penetration testing frameworks Cobalt Strike and NetSPI (the former SilentBreak).
Some modules in the attack seem to be custom made, but there are parts of the NetSPI platform, for which a commercial license was unavailable for testing.
The investigation tracked the initial stage of the attack to September 2021 when the victim was tricked into downloading a RAR archive from the file sharing service file.io.
The threat actor then spread the Cobalt Strike module, which was signed with a certificate from a company named Fast Invest ApS. The certificate was used to sign 15 files which were not legitimate.
The researchers believe that the main purpose of the targeted malware might be to get data from the victims. However, Kaspersky did not find any similarities with previous campaigns associated with a known threat actor. So the researchers track the new activity as SilentBreak, after the name of the tool most used in the attack.
Comments