TrendLabs

Table of Contents
Infection Vectors ........................................................................................................................................... 2
Spear-phishing Emails ...............................................................................................................................................2
Website Redirects .....................................................................................................................................................2
Direct Links ................................................................................................................................................................ 3
Malicious Attachments ..............................................................................................................................................3
Mail Sending Method ................................................................................................................................................3
Drive-by Download ....................................................................................................................................................3
Phishing .....................................................................................................................................................................3

Social Engineering and Weaponized Documents......................................................................................... 7
Downloaders ............................................................................................................................................... 10
Simple Downloaders................................................................................................................................................ 10
DDE Downloader ..................................................................................................................................................... 12

Payloads...................................................................................................................................................... 12
xRAT ........................................................................................................................................................................ 12
NDiskMonitor ........................................................................................................................................................... 13
Badnews Backdoor ................................................................................................................................................. 14

File Stealers ................................................................................................................................................. 17
Taskhost Stealer ...................................................................................................................................................... 17
Wintel Stealer .......................................................................................................................................................... 21
AutoIt Stealer ........................................................................................................................................................... 22

Infrastructure ............................................................................................................................................... 23
Practice Defense in Depth .......................................................................................................................... 24

TREND MICRO LEGAL DISCLAIMER
The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal
advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should
be relied on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing herein should be construed
otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice.
Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise
related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in thetranslation are not binding and have no legal effect for compliance or enforcement purposes.
Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any
kind as to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own
risk. Trend Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing, or delivering thisdocument shall be liable for any consequence, loss, or damage, including direct, indirect, special, consequential, loss of business profits, or special damages,
whatsoever arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof.
Use of this information constitutes acceptance for use in an “as is” condition.

Patchwork (also known as Dropping Elephant) is a cyberespionage group whose targets included
diplomatic and government agencies as well as businesses. Patchwork is known for rehashing off-therack tools and malware for its own campaigns. The group uses attack vectors that may not begroundbreaking—what with other groups exploiting zero-days or cunningly adjusting their tactics—but
as its moniker entails, its repertoire of infection vectors and payloads still makes them a credible threat.
We trailed Patchwork’s activities over the course of its campaigns in 2017. The diversity of their methods
is notable—from the social engineering hooks, attack chains, and backdoors they deployed. They also
included Dynamic Data Exchange (DDE) and Windows Script Component (SCT) abuse to their tactics, aswell as started exploiting recently reported vulnerabilities. These imply they’re at least keeping an eye onother threats and security flaws to repurpose for their own ends. Also of note are its attempts to be morecautious and efficient in their operations.
This technical brief provides deeper analyses of their campaigns—from the infection vectors and social
engineering to the infrastructure and malware they used. The indicators of compromise are in thisappendix.

Spear-phishing emails are their staple method for delivering malware. These socially engineered emails
contain web links of weaponized documents containing exploits or macros. We found Patchwork using
three variations of this method.

Patchwork set up an English-language news site. The spoofed website looks exactly like the legitimate
and original website. Inspection of the fake site’s HTML source code, however, reveals the addition of asmall code snippet. It contains an additional meta tag at the end of the web page source code,“refreshing” (redirecting) the site visitor to the weaponized document.
The web page is not indexed in search engines. It can only be visited by clicking on the link contained in
the spear-phishing emails, helping it evade traditional security mechanisms compared to directlysending the link to the malicious document.

Figure 1: The added code snippet that redirects its visitors to the malicious document

We also saw spear-phishing emails containing direct links to the weaponized documents hosted onservers they own. The group employs typosquatting to increase clicks. These servers were reachedthrough domain names similar to legitimate websites, such as rannd[.]org instead of rand.org.

The malicious documents were also directly attached to the email. However, we didn’t see this method
used as much, as the attachments can be detected by spam filters.

The spear-phishing emails were sometimes sent to victims by misusing YMLP and serversecure.net,
which are email/newsletter distribution services. Abusing these legitimate online services helps improvetheir emails’ chances of not being flagged as spam.
More recently, they’ve started sending emails using a Postfix server they operate. The domain name“servicelogin.center” was linked to this server. It had a proper MX record, an SSL certificate issued by
Let’s Encrypt, and the domain property validated on Google. Recently, the TXT SPF1 record of domains
hosting malicious documents has been updated to include “servicelogin.center”, probably to bypass
spam filters.

The attackers also reportedly used a fake Youku Tudou website (a video platform similar to YouTubevery popular in China). It entices users to download a fake Adobe Flash player update, which turned out
to be a variant of the xRAT malware.

The group also employs phishing to harvest their targets’ credentials to access email accounts and other
online services.
We took a closer look at a phishing kit hosted on Patchwork’s infrastructure. Opening one of thesuspicious domains, hxxps://accounts[-]login[-]secure[.]163[.]com[.]neteease[.]com, in a web browser
returns an “account suspended” message, which they’ve copied from a web development company.

Figure 2: One of the domains of Patchwork’s phishing kit whose appearance
was copied from a web development company

A closer look reveals that the phishing kit expects a few parameters. The kit, which spoofs a legitimate
web portal and email service, consists of two PHP files: main.php, which has the initial webpage; anderror.php, which harvests and processes entered credentials.

Figure 3: The PHP file that processes entered credentials

main.php expects the following commands with base64-encoded values (seen on the screenshot
above):
u = user (encoded username, the victim cannot change it on the web form)r = referrer (hxxp://mial[.]163[.]com was used as referrer; the use of “mial” instead of “mail” is noted)
d = domain (163 or 126 or yeah or shouji)
The domain has one of the four possible values:
MTYz is 163
MTI2 is 126
eWVhaA== is yeah
c2hvdWpp is shouji (which means mobile phone in Chinese)

As of November 24, 2017, we found three different phishing websites using a valid SSL certificate issued
by Let’s Encrypt for three months. Some of them used the new TLD “.support”. The SSL certificateslisted the following domain names:accounts[-]login[-]secure[-]163 [-]com[-]neteease.com

accounts[-]login[-]secure[-]qq[-]com[-]neteease.com

accounts[-]login[-]vip[-]sina[-]com[-]neteease[-]com

neteease[.]com

accounts[.]login[.]yahoomail[.]support

yahoomail[.]supportaccounts[.]login[.]googlemail[.]support

Figure 4: Page information properties of one of the phishing websites

The parameters sent to the error.php script that attackers collect are username, domain, password andredirector values.

Figure 5: Parameters sent to the error.php script

Given how the phishing kit works, the attackers seem cautious. The phishing page can only be obtainedby sending specific arguments to the PHP script. Any other way will lead to the fake suspended accountpage. The link leading to the phishing page can only be found on the emails sent to the victims.

Many of the documents were found in a directory accidentally left open. The group uses sociopoliticalthemes as social engineering hooks. Those with the .doc extension are actually Rich Text format (RTF)
files that trigger an exploit for CVE-2012-1856, patched via MS12-060 last August 2012. It is a remotecode execution (RCE) vulnerability in the Windows common control MSCOMCTL, an ActiveX Control
module. These files drop variants of the NDiskMonitor backdoor. The PowerPoint Open XML Slide Show(PPSX) files exploit Sandworm (CVE-2014-4114), an RCE vulnerability in Windows’ Object Linking andEmbedding (OLE) feature patched last October 2014.

Figure 6: The directory containing the documents

The PowerPoint (PPT) file exploits CVE-2017-0199, an RCE vulnerability in Microsoft Office’s Windows
OLE, patched last April 2017. Once the victim clicks “Enable Editing”, the file will attempt to download
an .HTA file and silently exploits it by leveraging CVE-2017-0199.

Figure 7: The PPT containing the CVE-2017-0199 exploit

Figure 8: Code snapshot showing the PPT file downloading a malicious .HTA file

We also saw another document that comes with an executable instead of a macro. The file decodes andexecutes a Visual Basic script (VBS) that drops and executes a hybrid batch/.NET file, which thendownloads and executes the NDiskMonitor backdoor and a decoy document. The relatively long
infection chain can be construed as their way to obscure their activities.
A document the group recently used had an additional step, likely done to avoid antivirus (AV) detection.
A Word document embedded with a malicious PPSX file urges the victim to click on a fake PDF icon to
open the malicious document. It exploits CVE-2017-8570 (an RCE vulnerability in Microsoft Office
patched last July 2017) to download a Windows Script Component (SCT) file from a Patchwork-owned
server.

Figure 9: Screenshot of the Word document containing a PPSX file that exploits CVE-2017-8570

Figure 10: Code snippet showing the malicious SCT to be retrieved

The scriptlet .SCT file shown above contains PowerShell code. The payload downloads a malicious
xRAT sample and a decoy PowerPoint presentation. It also recursively deletes Resiliency registry keys
created by Microsoft Office applications (Word, Excel, PowerPoint, etc.). Some items in the Resiliency
registry key are created when the Office application does not terminate correctly, later displaying thisinformation to the user. Deleting Resiliency keys will make the Office application think that everything
was correct and there were no problems during the latest application run. The latest step involves
starting PowerPoint, maximizing its window, and loading a decoy document while starting the payload in
the background. We also found other PPSX documents that exploited this vulnerability, but they weresent directly and not embedded in a DOCX file.
We also uncovered documents related to the Bangladesh Army and a United Nations Development
Programme in Sri Lanka. These documents contained malicious macros that deliver the xRAT remote
access tool, which lets attackers control the infected machine.
There were also other socially engineered documents that used government-related news and activities,
with subjects such as “Supply Chain Management” as lures. These are RTF files exploiting CVE-20151641, a memory corruption vulnerability in Microsoft Office patched last April 2015. When executed, it
drops a signed java-rmi.exe executable from Java Runtime and two dynamic-link libraries (DLLs)—aclean msvcr71.dll and malicious jli.dll. The malicious DLL, which contains the Badnews backdoor, isloaded and executed using the DLL side-loading technique.

Figure 11: Screenshots of RTF files that exploit CVE-2015-1641 and deliver the Badnews backdoor

We managed to acquire a few samples abusing a technique called self-compiled .NET hybrids. One text
file contains both JavaScript code and batch code, which compiles the JavaScript code into executable
files and later executes it.
The file starts with two lines, shown below. The first line must be a valid statement in both languages. If
executed as a batch script, the first comparison (@X)==(@Y) is evaluated as False. Therefore @end is not
executed. Each following line is then evaluated by a batch file interpreter until the “exit /b” command
causes the batch processing to terminate.

Figure 12: Code snippet of samples using the self-compiled .NET hybrid

JavaScript, however, treats terms starting with @ as conditional compilation variables, evaluated as
False, followed by a multiline comment. JavaScript , therefore, ignores all the code between /* and */,and only the code that follows */ is considered.
The compilation process is achieved by the following command, where %jsc% points to a JScript
compiler and %~dpsfnx0 is resolved to the name of the currently executed batch file (d means disc, pmeans path, f means file, x means extension; all are modifiers of a special %0 parameter).

Figure 13: Command that facilitates the compilation process

The end of the batch script behind the */ comment is treated as source code. The code shown below
makes a simple command-line downloader with two parameters, URL, and file name.

Figure 14: Snapshot showing the command-line downloader

After compilation, the batch script uses the previously compiled simpledownloader.exe to download andexecute both the payload and decoy document.

Figure 15: Snapshot showing the payload and decoy document being retrieved

The scvhost6.exe file is actually a variant of the NDiskMonitor backdoor, while the document.doc is adecoy document, which is a legitimate sociopolitical essay.

Patchwork also abused the Dynamic Data Exchange (DDE) protocol to deliver their malware. The internal
structure of a sample we analyzed, an Office Open XML file, is a ZIP archive that contains the“document.xml” file, which contains an embedded DDE payload.
The payload starts with a DDEAUTO string, followed by a command to be executed. The command canbe split into several fields by “w:instrText” or through the use of other methods. In the figure below, theentire PowerShell command (displayed in black) is split into several chunks. When a victim opens the
document and DDE is enabled on the machine, the PowerShell command downloads and displays the
decoy document then retrieves and executes xRAT.

Figure 16: PowerShell command retrieving and executing xRAT

xRAT, renamed QuasarRAT in its latest versions, is a remote access tool whose source is publicly
available on Github. This availability allows anyone to easily clone the project and compile it. The projectis actively maintained, with users reporting bugs and the developer fixing them and committing therepaired files back to the Github repository.

NDiskMonitor is a custom backdoor written in .NET, named after the project name. We haven’t seen thisbackdoor used by any other threat actor, so we construe this as Patchwork’s own.

Figure 17: Snapshot of NDiskMonitor’s properties

NDiskMonitor’s configuration is stored in update_details global variable. 70600 is probably its backdoor
ID, "FuckYou" is the AES password used for encrypting certain information, and the string following it is
the command and control (C&C) address.

Figure 18: NDiskMonitor’s configuration

NDiskMonitor spawns a few threads. The first thread beacons regularly to let attackers know that themachine is alive. The parameter license is the encrypted username, current_license is the encrypted
computer name, and bui is the backdoor ID.

Figure 19: Thread spawned by NDiskMonitor

The second thread listens for backdoor commands. Backdoor queries are done via updatecheck.php,
with parameters client as the encrypted user name. Supported commands are:cme-update|<base64
command>Dv
rr|<base64 directory>ue|<base64 url>

execute command, AES-encrypted result
exfiltrated with /php/component_update.php,
parameters component = user name and check =encrypted result
return list of all logical drives, separated by “&”list all the files and directories in given directory
download and execute file from given URL

The third thread regularly downloads and executes the Wintel file/information stealer, while the fourth
thread runs a custom Task Host program. It’s a persistence mechanism for Wintel, which doesn’t haveone on its own.
Of note were multiple NDiskmonitor samples we found in the wild that had different hashes but similar
code. The attackers added four extra bytes of random uppercase and lowercase letters after the PEreferenced data in the overlay. We think this is done solely to change the file hashes since the Windows
PE loader won't even load those extra bytes into memory.

This backdoor, which has been used in other campaigns, has an interesting method for retrieving theactual C&C address. The binary has a few hardcoded and encoded URL addresses, which can be
decoded by subtracting 0x01 from each character.
After the decoding, we get the actual URLs.

Figure 20: The hardcoded strings (above), and the actual URLs when decoded (below)

These addresses refer to legitimate websites such as Github, Feed43, WebRSS, Wordpress, and Weebly,
likely to circumvent AV detection. Accessing these decoded URLs reveals a long base64 string enclosed
within parentheses. This may be hidden on some websites, as the text has white color on a whitebackground, so it’s important to “make a selection” to highlight the text.

Figure 21: base64 string enclosed in the decoded URLs (above and center), and how it’s decoded (below)

The text needs to be decoded on the actual C&C server. This can be done by base64 decoding,decoding Hex string to bytes, then XORing each byte with 0x23 and rotating left by three positions. The
decoded C&C URL looks like the following:

hxxp://188[.]165[.]124[.]30/c6afebaa8acd80e7/byuehf8af[.]php
Badnews will then start to communicate with the C&C server. The request is not sent in clear text form,
but is encoded using the same algorithm used for encoding the C&C server name:uid=<14 hex digits >&u=<hex encoded Unicode username>&c=<hex encoded Unicode computername>&v=2.2

The server response may include any of these 11 implemented commands:


shell—download and save file

link—download and write file, run with ShellExecute, inject into process if writing to file fails

mod—download and save DLL file; likely module

upd—download and save EXE file; likely update

dwd—create empty file and send it to C&C server; probably for testing purposes

kl—send logged keys to C&C server

snp—snap, take screenshot

ustr—upload stolen documentssdwl—upload file to C&C server

utop—stop stealing files

hcmd—run cmd.exe as a shell

Figure 22: Badnews’ backdoor commands

Depending on Badnews’ version, there are two threads. One logs all the pressed keys and stores themin a file, which, based on the received backdoor command, may be sent back to C&C server. The samegoes for the file-stealing thread, which monitors USB devices and copies files with certain extensions tothe backdoor’s predefined directory. Depending on C&C server’s command, it can send the stolen files
back to C&C server. This feature is probably implemented to overcome air-gapped environments, as not
all of its versions have a thread that steals data stored on USB devices. Badnews is usually compiled asa DLL loaded by a legitimate Java runtime executable, which is vulnerable to DLL hijacking. The real
Authenticode certificate is sometimes appended to the DLL to make it look more legitimate, but it isinvalid. We recently saw a sample of it as an executable in the wild.

In Patchwork’s case, file stealers are used to search for files with certain extensions, which are thenuploaded to their C&C server. The stealers we found seem to be developed and used exclusively by
Patchwork.

Taskhost Stealer combines theft and persistence capabilities. It’s written in .NET and obfuscated with
Crypto Obfuscator, which can be removed with the de4dot tool.

Figure 23: Taskhost Stealer’s properties

Taskhost Stealer has a constructor of a class, where the base.Load function is assigned an importantfunction called RemoveResources. The IP address of C&C server is also assigned to a variable named
windowID. Note that function names don’t have any relation to their actual function, e.g.,
RemoveResources doesn’t mean that it “removes resources”. The fake names were probably made toconfuse reverse engineers and researchers.

Figure 24: Code snapshot showing RemoveResources

Within the RemoveResources function is a list of document extensions that are of interest to Patchwork,
which are files commonly associated with cyberespionage. It also has a function that checks for the
existence of a sys.bin file in %APPDATA\Roaming\Microsoft\taskhost\1.0.0.0\. This file contains a list of
all documents with paths accessible from the infected machine.

Figure 25: Document extensions specified by Taskhost Stealer

Then, it drops Microsoft.Win32.TaskScheduler.dll and adds persistence. The code snippet below shows
the name of the task (Active Qiho Security), as well as the time interval (5 minutes) and duration (60 days).
It means that the process of looking for new files repeats every 5 minutes for the next 86,400 minutes(60 days), based on the code and scheduled task exported to XML format.

Figure 26: Code snippets showing how Taskhost Stealer looks for new files (above), which is also in the XML fileexported from Task Scheduler (below)

It then enumerates all the available drives and makes a POST request on C&C about the existence of
these drives:

Figure 27: Available drives in the infected machine are enumerated

The request contains parameters drive and student_name. drive’s value is a disk letter followed byinformation if it is a Fixed or Network drive. student_name contains computer name and username,separated by a hyphen. Files on all “ready” drives will be enumerated as saved as a list in sys.bin.

Figure 28: POST request with the drive and student_name parameters (above) and files being enumerated (below)

The next step is to read from hxxp://209[.]58[.]185[.]35/LOG/<computer name>-<user name>[.]html. If
the response is c121, the program ends. This lets attackers control which machines they do not want toreceive files from.
All files from the previously created list will be uploaded one by one. A list of uploaded files will be ins.dwg, while the list of all files is in sys.bin. During each run, sys.bin is deleted and newly created;
however, s.dwg remains the same. This ensures that only newly created files are uploaded. The upload
path looks like this: drive (Fixed or Network), followed by path, computer name, and username.

Figure 29: Code snippets showing the c121 response (top) and s.dwg (bottom)

Wintel Stealer (Win Telephonic Services) is another .NET stealer named after the project name.
Compared to the Taskhost Stealer, Wintel Stealer targets different files types and has no persistencemechanism.
The information of files are stored in the following format: filename whose path is AES-encrypted with ahardcoded password, then encoded with base64, with the &, SHA256 hash, and $ character appended.
This structure is stored in a global variable and remains in memory. A timer is enabled, starting the
upload process when an internet connection is available.

Figure 30: Wintel Stealer’s configuration (left) and the file types it targets (right)

Figure 31: Information about the files is stored in a certain format

The load_check.php script is first queried with the parameters user, which is base64-encoded username,and hsh, which is file hash. The ?ussr= in the screenshot below is likely a typo; it should be user and notussr (Soviet Union).

Figure 32: Wintel Stealer’s load_check.php script

Querying this script will tell whether the files are of interest and should be uploaded, and also ensuresthat the backend server doesn’t upload duplicate files. The up.php script is for uploading files, usingparameters use for username, fl for bytes of the file, hs for the SHA256.

Older versions of Patchwork’s file stealers were written in AutoIt, and each of these contains an endlessloop. The function __searchindex searches drive C:\ for certain file extensions. They will copy thetargeted files to a directory named index. It also maintains a file Temp.log, each line of which containing
a file’s hex-encoded MD5 hash. The function __sendoutlist uploads all the files from index directory to
the C&C server and deletes them. Persistence is carried out by modifying the Run registry key.

Figure 33: The functions of the AutoIt stealers

We found 30 to 40 IP addresses as well as domain names used by Patchwork in 2017. Each server has
a different purpose. Some are only meant to be C&C servers that collect data sent by the file stealers,and no domain name points to those IP addresses. In some cases, the same server is used for C&C

communication while also acting as a website hosting content copied from legitimate websites andpropagating malware or weaponized documents.
They misuse publicly available PHP scripts to retrieve files from the server without disclosing their real
paths. While this could be for tracking purposes, it’s more likely for deterring researchers from finding
open directories. The documents are almost always downloaded from the /xinwen directory, which is
now properly configured and cannot be browsed. On multiple occasions, we observed them temporarily
removing the file so it could not be retrieved. Sometimes they replaced it with a legitimate file to dupe
researchers. In some of their servers’ homepages, they display a fake 302 redirection page to trick
researchers into thinking the files are gone.
Other servers are used only to host phishing websites. Content changes between each campaign, but
the same server remains. For instance, the qzonecn[.]com domain has been pointing to the same IP
address since January 2017, but it now points to yahoomail[.]support. It references euuwebmail[.]com
for four months, and then militaryreviews[.]net for a week. This is consistent with the three months ofvalidity of the Let’s Encrypt certificates. Apart from militaryreviews[.]net, all of these domain names are
similar to legitimate websites that require authentication. We also found one server that was not hosting
any content but had a Postfix instance running and being used to send targeted emails.
All of these servers seem to use Apache on CentOS. The favicon on a server they recently used was still
similar to the one used in WampServer. It’s probable that Patchwork uses this package to facilitateserver installation when using a Windows environment.
The domain names are always registered using a service protecting the related whois information, whichwasn’t always the case before Patchwork’s activities were disclosed in 2016. Additionally, many of thedomain names published in previous reports have been either sinkholed by security companies orabandoned by the attackers.

Patchwork is in a vicious cycle, given the group’s habit of rehashing tools and malware. The more thesetools are used, the likelier it is for them to be incorporated into the group’s arsenal. For enterprises, thegamut of tools and techniques at Patchwork’s disposal highlights the significance of defense in depth:
arraying proactive defense to thwart threats at each level—from the gateways, endpoints, and networks
to servers.
What can enterprises do? Keep the operating system and its applications updated—or employ virtual
patching for legacy systems—to prevent security gaps and deter attackers from exploiting them. Firewall,
sandbox, and intrusion detection and prevention systems help detect red flags in the network. Enforce
the principle of least privilege: blacklist and secure the use of tools usually reserved for systemadministrators, such as PowerShell. Network segmentation and data categorization thwart lateral
movement and risk of further data theft, while behavior monitoring and application control/whitelisting
block anomalous routines executed by suspicious files. And more importantly, secure the email gateway.
Patchwork may only be reusing vulnerability exploits and malware, but they’re tried-and-tested—it only
takes one susceptible layer to affect the whole chain.

Trend Micro Incorporated, a global leader in security software, strives to make theworld safe for exchanging digital information. Our innovative solutions for consumers,
businesses and governments provide layered content security to protect information
on mobile devices, endpoints, gateways, servers and the cloud. All of our solutions
are powered by cloud-based global threat intelligence, the Trend Micro™ SmartProtection Network™, and are supported by over 1,200 threat experts around theglobe. For more information, visit www.trendmicro.com.
©2017 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend
Micro t-ball logo are trademarks or registered trademarks of Trend Micro,
Incorporated. All other product or company names may be trademarks or registeredtrademarks of their owners.