2 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•
•

•
•

3 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•

火車 (Kasha)••

https://en.wikipedia.org/wiki/Kasha_(folklore)#/media/File:SekienKasha.jpg

5 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••possibly related

espionage +cybercrime2020~2021

espionage
2019~

2022
2021~2022
2023

6 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••Observed in previous Campaign
Observed in new Campaign

v0.1.2122020v0.4.7v0.4.8v0.2.7v0.3.1v0.3.2v0.3.845 6v0.4.68122021v0.3.4 v0.4.1
v0.3.5v0.3.6

8 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

1

v0.5.9v0.6.9v0.7.1v0.4.9v0.5.6v0.6.3v0.6.6v0.6.8411 123 4 5 6932022v0.5.8v0.7.2

4 59 10v0.6.9v0.7.32023

v0.6.5v0.6.2

••

•
••••
••
•
•9 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••

•
•
•
••
•

•
•

•−−

•−

10 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•−−−

11 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•> csvde.exe -f all.csv –u> nltest.exe /domain_trust> quser.exe•> dir \\<FILESERVER>\ /s> copy \\<FILESERVER>\Network Diagram.xlsx
C:\Users\<USER>\Desktop\Network Diagram.xlsx

12 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•> copy> copy13 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

\\<DC_IP>\c$\windows\temp\ntds.dit .
\\<DC_IP>\c$\windows\temp\system .

••−−−target application class−•14 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

%temp%\31558.TXT•> copy SfsDllSample.exe \\<IP>\c$\windows\temp\SfsDllSample.exe> copy SfsDll32.dll\\<IP>\c$\windows\temp\SfsDll32.dll> copy vcruntime140.dll \\<IP>\c$\windows\temp\vcruntime140.dll> copy mssitlb.xml \\<IP>\C$\Windows\system32\UIAnimation.xml> copy ShiftJIS.dat \\<IP>\C$\Windows\system32\ComputerToastIcon.contrast-white.dat

15 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•> makecab> makecab> makecab

systemntds.ditpeople.txt•\\tsclient\C\aaa\All PC List.xlsx\\tsclient\C\aaa\All IP List.xlsx\\tsclient\C\aaa\Network Diagram.xlsx

16 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf

https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf
17 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•
•
•
••
•

•••

•
••

•
•••
•
•
•

•
•
•
•
•

•
•
•
•

18 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•−•

•

20 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•••

21 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••

••••

•

22 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•••

LODEINFOLDR Type 2 loading process

LODEINFOLDR Type 1 loading process

DLL
Side-Loading
SfsDllSample.exe

DLL
Side-Loading
SfsDll32.dll

Signature

23 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

frau.dll

Decrypt by
RC4 or XOR

Seucirty Directory

Encrypted
payloadElze.exe

Run inmemory

LODEINFO

Decryptby XOR

Elze.exe_

Run inmemory

LODEINFO

0x28200

add

0x4238

0x2C438

Legitimate signature

RC4 key (0x40)

Encrypted payload

24 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•

https://www.eset.com/jp/blog/welivesecurity/unmasking-mirrorface/

25 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•
•

•••
•
•
••
•
•
••
•
•
•
•
•
•
•
•
•
26 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•
•
••••
•••
••••
•
••
•
•••
••••••••••••••••••••••••••••••••••••••••••••••

2nd stage LODEINFO’s backdoor
command process routine•−−•
1st stage LODEINFO

27 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••NOOPLDRNOOPLDRNOOPDOOR

28 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

NOOPDOORMSBuild task containing
obfuscated C# to load NOOPDOOR−−

29 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

Control Flow obfuscationand junk codes

•
•−−−
−

30 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•NOOPDOOR is basically active backdoor
but also supports passive backdoor••C2 server−•TCP/443
TCP/47000•••Clientthread

Serverthread−••••31 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

NOOPDOOR

•

actionexample2023/12/01 00:00:00 -> 0x365692200 -> 0x65692200
0x65692200 -> 0x650a3600
hxxp://$j[TEST].srmbr[.]com:443/#180
217826c36e994d097eadcf856fdcadb21372e5a0845e496dbb6015e1a8d42867
dd5b50e5e0405a221fc3c45f8d40ae37733f190b62e2b64e5de10cd190224453d90eaf…
3VtQ5eBAWiIfw8RfjUCuN3M/GQti4rZOXeEM0ZAiRFPZDq8hG4tUb0ce7kFR4zdmLx+xTZe2
Z0P…
3VtQ5eBAWiIfw8Rfj -> VtQeBAWiIfwRfj -> vtqebawiifwrfj
vtqebawiifwrfj -> vtqebawifwrfj
hxxp://vtqebawifwrfj[.]srmbr[.]com:443/“#<NUM>” and “[]” is optional, and the letter in “$<KEY>” can be changed
32 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•••

NOOPDOOR

ANELtimeline

2021~

2017~2019

arch

64bit

32bit

form

shellcodeshellcode (Loader) -> DLL

protocolTCPHTTP33 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

NOOPDOOR•−−−

34 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

ANEL Loader

•NOOPDOOR−−

35 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

ANEL Loaderhosted encrypted LODEINFO components in 2023/04/25

45.76.197[.]236
resolveplouwvqlxy.myftp.org
connect
at 2023/05/23

NOOPDOOR

36 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

resolve

kcimqstvpvsvjzr.hopto.org

connect

LODEINFO•✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓

38 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•

✓

✓

✓✓✓
✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓

✓
✓

✓
✓
✓
✓
✓
✓
✓
✓

✓

✓
✓✓
✓

✓✓

✓

39 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

✓✓•Assumption
1. Malware such as LODEINFO and NOOPDOOR might possibly be shared with other groups?
2. There might possibly be a team focusing on initial compromise (like access broker)?
40 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•−•−•41 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

•−−−

•
•

42 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

Thank you© 2024 Trend Micro Incorporated. All rights reserved.

Appendix

45 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

46 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

47 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

••••−48 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

We will release a blog
with Yara rule soon
rule Trojan_LODEINFOLDR_generic{meta:
Author = "Trend Micro"
Created_Time = "2024-01-26"
strings:$chunk_1 = {
8A 02
34 ??
88 01
8A 42 0134 ??
88 41 01
8A 42 0234 ??
88 41 02
8A 42 0334 ??
88 41 03
8A 42 0434 ??
88 41 04
8A 42 05
34 ??
88 41 05
8A 42 0634 ??
88 41 06
8A 42 0734 ??
88 41 07
8B C1
C6 41 08 00}
condition:
uint16(0) == 0x5A4D andall of them}49 | Copyright © 2024 Trend Micro Incorporated. All rights reserved.

rule Trojan_NOOPLDR_xml{
meta:Author = "Trend Micro"
Created_Time = "2024-01-26"
strings:$s1 = "<Code Type=\"Class\" Language=\"cs\"><![CDATA[using "$s2 = "Software\\\\Microsoft\\\\SQMClient"$s3 = ".GetValue(\"MachineId\").ToString()"$s4 = "SHA384.Create();"$s5 = "new byte[32];Array.Copy("$s6 = "new byte[16];Array.Copy("condition:all of them}rule Trojan_NOOPLDR_dll{
meta:Author = "Trend Micro"
Created_Time = "2024-01-26"
strings:$chunk_1 = {48 8D 05 ?? ?? ?? ??
48 8D 0D ?? ?? ?? ??
0F B6 0C 0E
32 0C 06
0F B6 D1
48 8D 8D ?? ?? ?? ??
E8 ?? ?? ?? ??
}$chunk_2 = {3D ?? ?? ?? ??
7E ??
3D ?? ?? ?? ??
7F ??
3D ?? ?? ?? ??
0F 84 ?? ?? ?? ??
3D ?? ?? ?? ??
75 ??
B8 ?? ?? ?? ??
EB ??
}condition:
uint16(0) == 0x5A4D andall of them}