A41APT case~ Analysis of the Stealth APT Campaign Threatening Japan
Yusuke Niwa / Hajime Yanagishita / Charles Li /Suguru Ishimaru / Motohiko Sato
2020/01/28
Japan Security Analyst Conference 2021

Presenter / Coauthor
Yusuke Niwa
ITOCHU Corporation.

Hajime Yanagishita
Macnica Networks

ITCCERT Cyber Security Researcher

Security Researcher

Charles Li
Team T5

Suguru Ishimaru
Kaspersky

Chief Analyst of TeamT5

GReAT Malware Researcher

Motohiko Sato
ITOCHU Corporation.
ITCCERT Sr. Cyber Security Researcher

2Agenda1. Campaign Overview
2. Malware Analysis
3. Characteristics of Intrusion
4. Threat Actor’s Infrastructure
5. Consideration of Threat Actor’s Attribution
6. Summary3

１．A41APT Campaign Overview

A41APT Campaign Overview
 Period of Activity: March 2019 to January 2021 Present Target: Japan (Japanese companies including overseas branches) Initial Vector: Not Spear phishing But SSL-VPN abuse Malwares: New type of malwares using dll-sideloading（SodaMaster/P8RAT/DESLoader/FYAntiLoader etc.）
 Public Info: Very few [1][2][3][4] Characteristics: Very tough to detect attacker’s intrusion
We call this threat actor A41APT from the hostnamefeature 「DESKTOP-A41UVJV」 that is continuously usedduring the initial intrusion in this campaign.
5

２．Malware Analysis

２． Malware Analysis
1. DESLoader
2. DESLoader Payloads••••

SodaMaster
P8RATUpdate
Stager Shellcode
FYAntiLoader

3. FYAntiLoader

NEW

4. xRATNEW
https://www.lac.co.jp/lacwatch/report/20201201_002363.html
7

2-1．DESLoader
Aka. SigLoader▪ Loader file for DLL Side-Loading
and files contain encrypted
shellcode and payload.

▪ Decrypt multiple PEs andshellcodes sequentially in multiple
stages.
▪ Multiple algorithms are used fordecryption.
▪ Finally, the payload is executed inmemory.
8

Example of DESLoader's payload decoding flow
side-loading

policytool.exe

decodeload
vac.dll

jli.dllreflective
dll injection

stage_1.shellcode

stage_1.dll

load

decodepcasvc.dll

Junk codereflective
dll injection

stage_2.shellcode

P8RAT(payload)

Anti-analysis junk codes arefound using OutputDebugStringA(),_time64(), rand(), srand()9jli.dll/stage_1.dll
Multiple algorithms (XOR, DES, AES and RSA) are defined and the order of using them is configured. Read
encrypted data in specified DLL from the end of data till configured size and decrypt.

skippedjli.dllXOR

key = 0x9F

Decryption Algorithm

skipped
MZPE
Section table +Section 1 … Nvac.dll

Embedded dataAES(CBC mode)

key = 83H4uREKfFClDH8ziYTH8xsBYa32p3wl
IV = 83H4uREKfFClDH8z

skippedstage_1.shellcode

10

starge_1.shellcode▪ In addition to known "ecipekac" magic_bytes, some samples use {BFAFBFAF} or {9F8F7F6F}
as magic_bytes.
▪ Prepare DLL from separately embedded data in shellcode

stage_1.dll

stage1_1. shellcode
0x00000

shellcode

0x00bf5
0x00bfd
0x00c010x00c05

ecipekac
Size of buf
Size of code
Section table
Section1 … N

0x39a1dPE
MZ

0x39b250x00000
0x000E0MZ
PE

0x001E8

Section table

0x01000

Section 10xXXXXXSection N11Variant of stage_2.shellcode• In addition to stage_2.shellcode that has almost same feature asstage_1.shellcode, we found 2 types of stagae_2.shellcodes.
✓ ​Stager Shellcode
RC4✓ Shellcode dedicated for SodaMasterstage_2.shellcode

Embedded structure ofshellcode for SodaMaster

SodaMaster(payload)

offsetdata

description

0x000

90 90 90 90 90 90 90 90

magic bytes for Identification, this isused for comparision before dataprocessing

0x008

0x11600

Size of encrypted data, only this value(size) is observed

0x00C

A9 5B 7B 84 9C CB CF E8
B6 79 F1 9F 05 B6 2B FE

16 bytes RC4 key (each sample hasdifferent key)

0x01C

C7 36 7E 93 D3 07 1E 86
23 75 10 49 C8 AD 01 9F[skipped]

Encrypted SodaMaster payload with RC412

DESLoader TimeLine▪ AES and DES algorithms
are implemented using
proprietary coding▪ In many cases, not all
ciphers are used
▪ The order in which
ciphers are used ischanged▪ DESLoader which
implements only one
cipher contains a lotof OutputDebugStringA()
code

Compile Date(JST)2019-10-18
2019-10-24
2019-12-26
2019-12-28
2020-05-04
2020-05-04
2020-05-09
2020-05-30
2020-06-02
2020-06-04
2020-06-30
2020-06-30
2020-07-01
2020-09-28
2020-09-29
2020-10-02
2020-12-21
2020-12-26
2020-12-26
2020-12-27
2020-12-27
2020-12-27
2020-12-31
2021-01-01

File name

Algorithm

PayloadCCFIPC64.DLL
SBIEDLL.DLL
GLIB-2.0.DLL
DBUS-1-3.DLL
jli.dll
jli.dll
DBUS-1-3.DLL
dbus-1-3.dll
uxtheme.dll
UXTHEME.DLL
VMTOOLS.DLL
SECUR32.dll
jli.dll
jli.dll
jli.dllvmtools.dll
jli.dll
JLI.dllsbiedll.dll
JLI.DLLJLI.DLLJLI.DLL
vmtools.dll
jli.dll

AES
DES
DES
DESDES
DES
DES
DES
DES
AES->DES (RSA XOR Not Used)
XOR->AES->DES (RSA Not Used)
AES->DES (RSA XOR Not Used)
DES
DES->AES (RSA XOR Not Used)
DES->AES (RSA XOR Not Used)
DES->AES (RSA XOR Not Used)
DES
DES->AES (RSA XOR Not Used)
RSA(AES DES XOR Not Used)
DES->AES (RSA XOR Not Used)
DES->AES (RSA XOR Not Used)
DES->AES (RSA XOR Not Used)
XOR->AES (RSA DES Not Used)
XOR->AES (RSA DES Not Used)

xRAT
Stager_Shellcode
Stager_Shellcode
Stager_Shellcode
SodaMaster
SodaMaster
SodaMaster
Stager_Shellcode
P8RAT
P8RATSodaMaster
SodaMaster
P8RAT
SodaMaster
SodaMaster
SodaMaster
SodaMaster
Stager_Shellcode
Stager_Shellcode
Stager_Shellcode
Stager_Shellcode
Stager_Shellcode
P8RAT
P8RAT

DES: Modified DES / AES: AES-CBC

13

2-2．DESLoader’s Payload
1.
2.
3.
4.

SodaMaster
P8RAT
FYAntiLoader ( ⇒ .NET Loader(ConfuserEx v1.0.0) ⇒ xRAT )Stager Shellcode

14

SodaMaster
Aka. DelfsCake, dfls, HEAVYPOT▪ One of DESLoader's payloads▪ Fileless RAT▪ Command identifiers are d, f, l and s▪ Same Compilation Time✓ 5CFE0D92 (Mon Jun 10 07:58:10 2019)▪ Check VM environment from the following
registry value✓ HKCR¥Applications¥VMwareHostOpen.exe

15

SodaMasterbase64(RSA key) + 12bytes data

▪ Mutex value is hex value
calculated from hardcodedbase64 string with CRC32 andreverse the order▪ Initial C2 communication datais encrypted with RSA. RSA key
is hardcoded base64 key_blob
and data contains randomly
generated RC4 key

CRC320x8d01ca9f

Mutex = 9FCA018D
Encrypted using RSA key

User
hostPID
Exec DateRC4key▪ Further communication data isencrypted with RC4RC4 encryption
SodaMasterC2 server

16

P8RATAka. GreetCake▪ One of DESLoader's payloads▪ Fileless RAT▪ Latest command identifiers are300~309▪ Command 309 was implemented NEW
after December 2020.

▪ Timer related strings at command
306 - 308 are not exposed atlatest version.
▪ Main feature looks Command 301,
Execution of secondary PE
based payload downloaded intomemory

17

P8RAT Update▪ Checks if processes
characteristic of the guest
OS of Virtual Machine isrunning or not▪ Collects OS version,
hostname and username▪ Looks to checks if it is asandbox or analyst
environment

18

Stager Shellcode▪ One of DESLoader's
Payloads▪ CobaltStrike StagerShellcode beacon▪ In Later version in 2020,
beacon contains HTTPHeader mimicking jQuery
Request19

2-3. FYAntiLoader▪ One of DESLoader's payloads▪ Fileless type loader module▪ .NET Loader having Provocative Exportfunction name▪ Contains .NET Loader packed
with ConfuserEx v1.0.0▪ Looking for specific directory and search filewith condition, then read file and decrypt
payload▪ Finally, Payload is xRAT
20

xRAT decoding flow with FYAntiLoader
loadside-loading

usoclient.exe

CCFIPC64.dll

reflective
dll injection

decodemsftedit.prf.coo

starge_1.shellcode

starge_1.dll

load

decodemsdtcuiu.adi.wdb

FYAntiLoader
reflective
dll injection

starge_2.shellcode

CppHostCLR

blob

load

starge_3.dll web_lowtrust.config.uninstall

xRAT

21

2-4．xRATVERSION
HOSTS
RECONNECTDELAYKEY
AUTHKEY
DIRECTORYSUBDIRECTORYINSTALLNAMEINSTALL
STARTUP
MUTEX
STARTUPKEYHIDEFILE
ENABLELOGGER
ENCRYPTIONKEYTAG
LOGDIRECTORYNAMEHIDEDIRECTORYHIDEINSTALLSUBDIRECTOR
download_url

2.0.0.0
45.138.157.83:443;
1846872[redacted][redacted]
Environment.SpecialFolder.ApplicationData
SubdirClient.exe
false
false
3n5HUTePmoGqIF8CZanamdGw
Quasar Client Startup
false
false
KCYcz6PCYZ2VSiFyu2GU[redacted]
Logs
false
false
none
22

３．Characteristics of Intrusion

A41APT’s intrusion method
Initial Intrusion

Penetration via SSL-VPN
using vulnerabilities orstolen credentials

Internal Recon.
Lateral Movement

Persistence ofmalware

C2Communication

Trace RemovalPerform a port scan tosearch for open RDP or
SMB port. Then, connect to
RDP with an administrator
account.

Persistence by scheduled
task registration to executethe legitimate PE

Communicate with C2 server
via DESLoader’s payload orPowerShell remoting

Delete the event log after
communication with C2 isfinished.

Scheduled task registration

A41APT・・・
AD Server
CredentialDumping

In Memory・・・

ServerServer*

DESLoader
PayloadLaptop

Legitimate PE*We have also observed cases where traces have been removed from other compromised servers as well.

Event log deletionC2 ServerORPowerShell
24

Characteristics of Compromise
1. Initial intrusion using SSL-VPN products
2. Network scanning and credential theft
3. PowerShell remoting to remove event logs
4. Persistence of malware by scheduled task

25

３-１． Initial intrusion via SSL-VPN (Exp. session hijacking)•In October 2019, an attacker used the hostname DESKTOP-A41UVJV to hijack
sessions to enter the internal network via SSL-VPN product, Pulse Secure.

•JPCERT also reported a similar attack targeting SSL-VPN [4].

•In some cases, attackers used credentials that they had stolen in the past intrusion.

26

３-2． Network scanning and credential theft
Network scanning and RDP

Credential theft▪ Run csvde.exe, a CSV export command▪ After the intrusion by SSL-VPN, perform
line tool provided by Microsoft.
internal network scanning to find open
port RDP (3389/TCP) and SMB (445/TCP). ▪ Execute AdFind provided by joeware.
▪ Use an administrator account to deploy▪ Dump of SYSTEM/SECURITY/SAM hive,
RDP to servers with free RDP.
etc.
Exp. server types that are frequently
compromised by RDP
AD serverFile server
Anti Virus management server
Backup server
Print server
FAX server

https://www.joeware.net/freetools/tools/adfind/https://docs.microsoft.com/en-us/previous-versions/windows/itpro/windows-server-2012-r2-and-2012/cc732101(v=ws.11)27

３-3． PowerShell remoting to delete event logs•

Event log: the end of a PowerShellremoting session•

Windows PowerShell.evtx
EID: 403•

The "C2 address" and the "*.nls filename" are changed, but the rest isthe same
⇒ probably common tools execution28

３-４．Persistence of malware by scheduled task
▪ Registered a task scheduler that executes a legitimate executable file that loads
DESLoader every 15 minutes.
▪ It is unlikely that the same scheduled task name is created on the compromised hosts.

29

Exp. Improperly registered scheduled tasks observed in the past
Scheduled Tasks¥Microsoft¥Windows¥Sysmain¥HybridDriveCachePrepopulate

PE nameHybridDrive.exe¥Microsoft¥Windows¥Shell¥FamilySafetyMonitor

wpcmon.exe¥Microsoft¥Windows¥NetworkAccessProtection¥NAPStatus UI

NAPStatus.exe¥Microsoft¥Windows¥SideShow¥AutoWake

AutoWake.exe¥Microsoft¥Windows¥SystemRestore¥SRsrtasks.exe¥Microsoft¥Windows¥Shell¥FamilySafetyUpload

FamilySafety.exe¥Microsoft¥Windows¥File Classification Infrastructure¥Property Definition Sync

DefinitionSync.exe¥Microsoft¥Windows¥UpdateOrchestrator¥Refresh Settings

usoclient.exe¥Microsoft¥Windows¥WindowsUpdate¥AUSessionConnect

AUSession.exe¥Windows¥System32¥Tasks¥Microsoft¥Windows¥Shell¥WindowsParentalControls¥Microsoft¥Windows¥UpdateOrchestrator¥Schedule Retry Scan
¥Microsoft¥Windows¥LanguageComponentsInstaller¥ReconcileLanguageResources

ParentalControls.exe

usoclient.exe
DiagPackage.exe¥Microsoft¥Windows¥Setup¥EOSNotify

EOSNotify.exe¥Microsoft¥Windows¥SkyDrive¥Idle Sync Maintenance Task

IdleSync.exe
30

４．Threat Actor’s InfrastructureThreat Actor’s Infrastructure
1. The hostname used for the intrusion via SSL-VPN
2. Characteristics of the C2 infrastructure32

Hostname used for the initial intrusion via SSL-VPN▪ Tendency to use distinctive hostnames and attempt intrusions
while changing IP addresses✓ Host names used in breaches observed in the past
DESKTOP-A41UVJV
dellemc_N1548P▪ Tendency to use an IP for intrusion that is different from the C2 server’s IP

33

Characteristics of the C2 infrastructure▪ For C2, there is a tendency to use IP addresses and not to use domains.
▪ From the observed C2 IP addresses, there is little bias toward country and AS, andwe observed that there is a tendency not to reuse IP addresses repeatedly.

34

５．Consideration of Threat Actor’s Attribution

Considerations for attribution of A41APT
1. Relevance to APT10
2. Relevance to BlackTech

36

１．Relevance to APT10
Common TTPs

▪ APT10 involvement in targeted attack campaign
against Turkey mentioned [5].
▪ Confirmed the existence of an early version ofSodaMaster (x86) in March 2019.

ShellCode- Multilayers loading- CPPHostDLR loader- F**jYouAnti export- Look for payloads under“C:¥Windows¥Microsoft.Net”load▪ xRAT observed in A41APT campaign has
common TTPs with BlackBerry Cylance reports
in 2019 was confirmed [6].

Common TTPs

SodaMasterxRAT/QuasarRAT

connect

MenuPass/QuasarRAT
Backdoor Report

Run dll payload
Run Shellcode payload*Compared to SodaMaster in 2020, only two commands are supported.

Attributerare-coins[.]com

APT10

Used in attack

AttackTurkish Victim37

２．Relevance to BlackTech
SodaMaster

TSCookie▪ Identified common features
between SodaMaster andTSCookie [7].
▪ The same information is collectedfrom the compromised host in theinitial stage– Username– Computer name– Current process ID▪ Observed existence of twomalware, SodaMaster andTSCookie, on multiple
compromised hosts
38

６．SummaryWrap up：A41APT Campaign
ADVERSARY（A41APT）▪ Intrusion via SSL-VPN▪ Heavy usage of RDP for lateral
movement (mainly servers)▪ Strong association with APT10▪ Abusing DLL-Sideloading▪ Relevance to BlackTech▪ Remove traces

INFRASTRUCTURECAPABILITIES▪ Targeting Japanese companies
including overseas branches▪ Heavy usage of IP addresses for C2(no domain usage)▪ Wide range of industries such asmanufacturing▪ Less reuse of IP addresses for C2

VICTIMS▪ IP for an initial intrusion and C2 IP
40
are different.

Wrap up： TTPs ~MITRE ATT&CK Mapping~
Tactics

Techniques

Initial Access

External Remote Services (T1133) : Intrusion via SSL-VPN using vulnerabilities or stolen credentials

Execution

Command and Scripting Interpreter: PowerShell (T1059.001)
Base64 obfuscated PowerShell commands (delete event log)
Windows Management Instrumentation (T1047) : WMIC collects services for security products

Persistence

Scheduled Task/Job: Scheduled Task (T1053.005) :Privilege Escalation

Hijack Execution Flow: DLL Search Order Hijacking (T1574.001)

Defense Evasion

Deobfuscate/Decode Files or information (T1140)
Indicator Removal on Host: Clear Windows Event Logs (T1070.001)
Hijack Execution Flow: DLL Search Order Hijacking (T1574.001)

Credential Access

OS Credential Dumping: Security Account Manager (T1003.002)
OS Credential Dumping: NTDS (T1003.003)

Discovery

Account Discovery: Domain Account (T1087.002)
Domain Trust Discovery (T1482)
Software Discovery: Security Software Discovery (T1518.001)

Lateral Movement

Remote Services: Remote Desktop Protocol (T1021.001)

Collection

Archive Collected Data: Archive via Utility (T1560.001) : Compression by WinRAR

Command and Control

Application Layer Protocol: Web Protocols (T1071.001)
Data Encoding: Non-Standard Encoding (T1132.002)

41

Wrap up： Features of this campaign✓ Targeting the kryptonite of EDR/FSA detection• Malware is written on the disk by the attacker's manual operation via SSL-VPN instead ofmalware-originated intrusion from Spear phishing email (legitimate file, loader, encrypted file)• Intrusion from group affiliates, including overseas companies• Malware is mostly placed on servers, and the number of compromised servers are very small.
• Most of the malware detected in the same period have different C2 addresses, so there is littletendency to use the same samples.

✓ After the intrusion, some rough operations were seen.
• Heavy usage of network discovery using RDP• Common traces deletion method of event logs
• Recorded attacker's hostname in event log42

Examples of countermeasures against this campaign
SSL-VPN•••

End User

Implementation of MFA
Patch adaptation operation
Monitoring

Governance（Overseas/affilates）•••

Additional threat visibility••••

Network Monitor by NTA
Strengthen security measures for servers
Hunting stealthy attack by using EDR/FSA
Leverage Yara rule to detect loader or payload onmemory

Framework for sharing information (Incident, ThreatIntel and security situation )Apply same security level
Apply same level of detection in each intrusion method

Additional Monitoring••••

Audit authentication attemp of administrator account(success/failure)
Monitor deletion of Windows event log
Monitor login from host that is not in list of organization asset
Monitor SSL-VPN log for suspicious login from unknown host( e.g. hostname is not in organization asset )Strengthen Monitoring for Authentication
Vendor(SOC)•Talk with end user to know white-list ( username, hostname, IP address and date/time ) ofauthentication and give proactive alert to end user43

Examples of countermeasures against this campaign(Based on intrusion method)
Initial Intrusion- Implementation of MFA- Patch adaptation operation- Monitor suspicious logins
from overseas

Internal Recon.
Lateral Movement

Persistence ofmalware

C2Communication- NW monitoring by NTA- Monitor the creation of- Strengthen security measures suspicious scheduled task
for servers (EDR/FSA etc.)
events.
- Monitoring of administrator
authentication attempt(success/failure)- Suspicious login monitoringfrom hosts outside of asset
management- Payload detection by Yara
- C2 identification and blocking
by malware analysis

ServerNTA・・・

ServerMonitoring

Monitoring

NTA・・・

Patch application
operation- Monitor for traces ofsuspicious event log
deletions.

- Identify and block C2 bytraces of suspicious PowerShellremoting in event logs

Scheduled task registration

A41APT

Trace Removal

In Memory

DESLoader
payloads

Event log deletion

Event logmonitoring

C2OR

MFA
AD server
Monitoring

LaptopMonitoring

PowerShell
Legitimate PE Payloads detection
by Yara44

At the end...
 A41APT campaign is very stealthy and difficult to detect, but it is not undetectable.
 The compromised target has shifted from endpoint to server, and the intrusionroute has also shifted from spear phishing to abusing SSL-VPN. Security measuresneed to be reviewed in your organization to respond to change in attack method.

 By refining daily security operations and thoroughly reviewing the security holes ineach organization's environment, it may be possible to detect and protect attacks

from even small anomalies.
45Reference
1.

【緊急レポート】Microsoft社のデジタル署名ファイルを悪用する「SigLoader」による標的型攻撃を確認
https://www.lac.co.jp/lacwatch/report/20201201_002363.html

2.

Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japanespionage

3.

https://twitter.com/Int2e_/status/1333501729359466502?s=20

4.

Pulse Connect Secure の脆弱性を狙った攻撃事案
https://blogs.jpcert.or.jp/ja/2020/03/pulse-connect-secure.html

5.

APT10 THREAT ANALYSIS REPORT (ADEO IT Consulting Services)
https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf

6.

Threat Spotlight: MenuPass/QuasarRAT Backdoor
https://blogs.blackberry.com/en/2019/06/threat-spotlight-menupass-quasarrat-backdoor

7.

https://blogs.jpcert.or.jp/ja/2018/03/tscookie.html46IoCs
MD5

File name

Payloads

Comment

Path of Encrypted xRAT

f6ed714d29839574da3e368e4437eb99
dd672da5d367fd291d936c8cc03b6467

usoclient.exe
CCFIPC64.DLL

xRAT
xRAT

Legitimate EXE
DESLoader

Microsoft.NET¥test¥Framework¥v4.0.30319¥
Config¥web_lowtrust.config.uninstall

335ce825da93ed3fdd4470634845dfea

msftedit.prf.ccoxRAT

f4c4644e6d248399a12e2c75cf9e4bdf

msdtcuiu.adi.wdb

xRAT

Encrypted stage_1.shellcode
Encrypted
stage_2.shellcode

019619318e1e3a77f3071fb297b85cf3

web_lowtrust.confi
g.uninstall

xRAT

Encrypted xRAT

7e2b9e1f651fa5454d45b974d00512fb

policytool.exe

P8RAT

Legitimate EXE

be53764063bb1d054d78f2bf08fb90f3

jli.dllP8RAT

DESLoader

P8RAT

Encrypted
stage_1.shellcode
Encrypted
stage_2.shellcode

f60f7a1736840a6149d478b23611d561

vac.dll

59747955a8874ff74ce415e56d8beb9c

pcasvc.dll

P8RAT

c5994f9fe4f58c38a8d2af3021028310

80f55.rec.dll

SodaMaster(x86)037261d5571813b9640921afac8aafbe

10000000.dll

SodaMaster(x86)bca0a5ddacc95f94cab57713c96eacbf

ResolutionSet.exe

SodaMaster

Legitimate EXE

cca46fc64425364774e5d5db782ddf54

vmtools.dll

SodaMaster

DESLoader

4638220ec2c6bc1406b5725c2d35edc3

wiaky002_CNC175
5D.dll

SodaMaster

Encrypted stage_
1.shellcode

d37964a9f7f56aad9433676a6df9bd19

c_apo_ipoib6x.dll

SodaMaster

Encrypted
stage_2.shellcode

Hostname of Intruded via SSL-VPN
DESKTOP-A41UVJV
dellemc_N1548P
C2Payloads

45.138.157[.]83

xRAT

151.236.30[.]223

P8RAT

193.235.207[.]59

Stager Shellcode

www.rare-coisns[.]com

SodaMaster(x86)88.198.101[.]58

SodaMaster

47

Any Questions?