Evasive Panda
A new Chinese APT “Evasive Panda” group targets India and Hong
Kong using a variant of MgBot malware
By Hossein Jazi and Jérôme Segura
September 2020

Hossein Jazi
Senior Threat Intelligence
AnalystSpecial interest in tracking
APT campaigns
Twitter: @h2jazi

Jérôme Segura
Director Threat IntelligenceSpecial interest in webthreats
Twitter: @jeromesegura

AgendaIntroduction
Discovery

Campaign Analysis
Analysis of discovered campaign

Attribution
Tracking and Attribution

TTPs and Toolsets
Overview of TTPs and tools

Conclusion

Discovery• July 2nd:–Found the first mal doc dropping Cobalt Strike• July 3rd:
– Same document dropped MgBot• July 5th:
–New mal doc dropped MgBot

C ON F ID EN T IAL

5

Campaign Analysis
Targeting Hong Kong and India

Variant 1: Cobalt Strike

C ON F ID EN T IAL

7

Variant 1: Cobalt
StrikeMalicious document injecting Cobalt Strike
into Rundll32.exe

C ON F ID EN T IAL

8

Variant 1: Cobalt Strike
Injects CobaltStrike into rundll32.exe using reflective DLL injection• Remote template: Dynamic Data Exchange

C ON F ID EN T IAL9Variant 1: Cobalt Strike (cont.)• Squiblydoo(MITRE T1218)• Payload injection

C ON F ID EN T IAL

10Variant 2: MgBot

C ON F ID EN T IAL

11

Variant 2: MgBot

Malicious document dropping a new variant ofMgBot

C ON F ID EN T IAL

12

Variant 2: MgBot
Dropping new variant of MgBot• Malicious document: Template Injection• Remote template: Dynamic Data Exchange

C ON F ID EN T IAL

13

MgBotMgBot Overview

Loader

Privilege Escalation - UAC Bypass• Auto-elevated COM interface
Name

CLSID

DLLCMSTPLUA{3E5FC7F9-9A51-4367-9063-A120244FBEC7}

system32\cmstplua.dll

Color Management{D2E7041B-2927-42fb-8E9F-7CE93B6DC937}

system32\colorui.dll• COM interface IARPUninstallStringLauncher (Appwiz.cpl)–Uses windows uninstall interface to bypass UAC

C ON F ID EN T IAL

16

Anti-Analysis• Self-modification• VM detection• AV detection

C ON F ID EN T IAL

17

Resolve API calls• builds a function pointer table

C ON F ID EN T IAL

18

Process• Calls CreateFileW to create iot7D6E.tmp• Calls WriteFile to populate its content• Calls CreateProcessInternalW to invoke expand.exe• Calls CopyFileW to copy tmp.dat into pMsrvd.dll• Calls DeleteFileW to delete tmp.dat• Drops DBEngin.EXE and WUAUCTL.EXE in• Modifies the registry hive ofof HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt

C ON F ID EN T IAL

19

APP management• svchost.exe -k netsvcs -p -s AppMgmt• svchost.exe -k netsvcs• svchost.exe -k imgsvc• Net start AppMgmt• net start StiSvc
C ON F ID EN T IAL

20

Clean up• Change codepage (1252 – Windows Western)• Ping 127.0.0.1 –n 5 -> Wait for 5 seconds• Delete

C ON F ID EN T IAL

21

Final payload
pMsrvd.dll (VideoTeam.dll)

Final Payload• C2 communications• Screen capture• File and directory management• Process management• Get drive type
– FAT, FAT32, NTFS, CDFS
– Free space

C ON F ID EN T IAL

23

String obfuscation
C ON F ID EN T IAL

24

API Calls

C ON F ID EN T IAL

25

API Calls

C ON F ID EN T IAL26

System Services

C ON F ID EN T IAL

27

Screen Capture

C ON F ID EN T IAL

28

Injection

C ON F ID EN T IAL

29

C2 Communications

C ON F ID EN T IAL

30

Attribution
Evasive Panda

Attribution• TTPs• Document contents• Past campaigns• Toolsets

C ON F ID EN T IAL

32

Evasive Panda- Campaigns history

Distributed several MgBot
pretended to be legit AV
related files and otherapplications such as Google
ChromeIdentified several variant ofKsRemote Android Rat
Identified several newvariants of MgBot

Needle in haystackCVE-2012-0158

20122014

Target India and Hong Kong
Template injection, DDE

CVE-2018-8174
Identified several different variants ofMgBot
Identified several variant ofKsRemote Android Rat

20162017

2018

2019

2020

JanMarchJuly

Use of Covid19 pandemic to distribute MgBot
疫情下勞工生生存現狀文章視頻匯總.rar"list of texts and videos regarding the current situation of workers during thepandemic"
Target: Hong Kong, Taiwan, and Malaysia
C ON F ID EN T IAL

33

TTPs
Initial Access
Phishing

Execution

Persistence

Command lineinterface

New service

Execution throughmodule load

Modify existingservicesPrivilege Escalation
Windows service
Bypass UAC

Defense Evasion
File deletion
Run32.dll

Rundll32

Bypass UAC

Scripting

Virtualization/Sandbox
evasionService execution

Template injection

Mshta

Signed Binary Proxy
Execution

PowerShell
Inter-Process
communication

C ON F ID EN T IAL

34

TTPs
Discovery

LateralMovement

C&C

Collection

Exfiltration

Query Registry

Remote File
Copy

Application
Layer
ProtocolScreen Capture

Automatic
Exfiltration

System Information
Discovery

NonStandard
Ports

ImpactExfiltration Over C2
ChannelSystem Service
Discovery

C ON F ID EN T IAL

35

Evasive Panda• Initial infection vector– Documents• Template injection• Exploit vulnerabilities (CVE-2012-0158)– Archive file
– VB script vulnerability (CVE-2018-8174)• Toolsets– MgBot– KsRemote Android Rat– Cobalt Strike

C ON F ID EN T IAL

36

CVE-2012-0158•

One of the most exploited vulnerabilities at its time•

Buffer overflow vulnerability in the ListView / TreeView
ActiveX controls in the MSCOMCTL.OCX library.

•Binary data appended to the end of the Word file.

C ON F ID EN T IAL

37

CVE-2018-8174
Remote code execution
vulnerability of Windows VBScript
engineC ON F ID EN T IAL

38

Infrastructure

C ON F ID EN T IAL

39

KsRemote Android Rat

KsRemote Android Rat

C ON F ID EN T IAL

41

C ON F ID EN T IAL

42

KsRemote Android Rat• Recording screen and audio
using the phone’s
camera/mic• Locating phone withcoordinates• Stealing phone contacts, calllog, SMS, web history• Sending SMS messages

C ON F ID EN T IAL

43Conclusion• Uncovered a new Chinese APT group that has been active at least since 2012
• Targets: Hong Kong, Taiwan, India and Malaysia• Initial infection vector: Spear phishing• Main tool: MgBot• Capable of targeting Android users

C ON F ID EN T IAL

44

Questions?