New Fileless Malware Hides Shellcode in Windows Event Logs
Threat Level Description
Threat Level: High – An attack is highly likely. Additional and sustainable protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgments on acceptable risk.
Description
We have observed that a new malware campaign that uses a technique of hiding shellcode into Windows event logs and has not been previously documented, has been identified.
The remote unauthenticated threat actor, by using this technique, could plant fileless malware in the file system, launching an attack designed to keep the activity as stealthy as possible.
This stealthy infection process has been observed in the wild and it is believed that has commenced in September 2021, when the intended targets were lured into downloading compressed .RAR files containing the commercial penetration testing frameworks “Cobalt Strike” and “NetSPI”.
The adversary simulation software modules are then used as a launchpad to inject code into Windows system processes or trusted applications. Also notable is the use of anti-detection wrappers as part of the toolset, suggesting an attempt on the part of the operators to fly under the radar.
One of the most interesting parts of the attack is the injection of shellcode payloads into Windows event logs for the Key Management Services (KMS), an action completed by a custom malware dropper.
The final payload is a set of trojans that employ two different communication mechanisms (HTTP with RC4 encryption and unencrypted with named pipes) that could allow them to run arbitrary commands, download files from a URL, escalate privileges, and take screenshots.
This new approach is highly sophisticated and it is on its way of becoming very popular, as it seems quite efficient for injecting malicious DLL and evading detection and also because source code for injecting payloads into Windows event logs has been available in the public space for a brief period.
Indicators of Compromise:
File Hashes (malicious documents, trojans, emails, decoys)
Dropper
822680649CDEABC781903870B34FB7A7
345A8745E1E3AE576FBCC69D3C8A310B
EF825FECD4E67D5EC5B9666A21FBBA2A
FA5943C673398D834FB328CE9B62AAAD
Logs code launcher
2080A099BDC7AA86DB55BADFFBC71566
0D415973F958AC30CB25BD845319D960
209A4D190DC1F6EC0968578905920641
E81187E1F2E6A2D4D3AD291120A42CE7
HTTP Trojan
ACE22457C868DF82028DB95E5A3B7984
1CEDF339A13B1F7987D485CD80D141B6
24866291D5DEEE783624AB51516A078F
13B5E1654869985F2207D846E4C0DBFD
Named pipes Trojan and similar
59A46DB173EA074EC345D4D8734CB89A
0B40033FB7C799536C921B1A1A02129F
603413FC026E4713E7D3EEDAB0DF5D8D
Anti-detection wrappers/decryptors/launchers, not malicious by themselves
42A4913773BBDA4BC9D01D48B4A7642F
9619E13B034F64835F0476D68220A86B
0C0ACC057644B21F6E76DD676D4F2389
16EB7B5060E543237ECA689BDC772148
54271C17684CA60C6CE37EE47B5493FB
77E06B01787B24343F62CF5D5A8F9995
86737F0AE8CF01B395997CD5512B8FC8
964CB389EBF39F240E8C474E200CAAC3
59A46DB173EA074EC345D4D8734CB89A
A5C236982B0F1D26FB741DF9E9925018
D408FF4FDE7870E30804A1D1147EFE7C
DFF3C0D4F6E2C26936B9BD82DB5A1735
E13D963784C544B94D3DB5616E50B8AE
E9766C71159FC2051BBFC48A4639243F
F3DA1E157E3E344788886B3CA29E02BD
Host-based IoCs
C:WindowsTaskswer.dll
C:WindowsTasksWerFault.exe copy of the legit one to sideload the malicious .dll
Named pipe MonolithPipe
Event logs with category 0x4142 in Key Management Service source. Events ID auto increments starting from 1423.
PDB paths
C:Usersadminsourcereposdrxx64Releasesb.pdb
C:Usersadminsourcereposdrxx64ReleasezOS.pdb
C:Usersadminsourcereposdrxx64ReleaseThrowbackDLL.pdb
C:Usersadminsourcereposdrxx64ReleasedrxDLL.pdb
C:Usersadminsourcereposdrxx64ReleasemonolithDLL.pdb
CVE(s)
N/A
Affected Systems
Recommendation(s)
You should configure your EDR and any other security solution(s) based on the provided IOCs to detect and block this malicious behaviour.
You should understand the importance of security updates including new IOCs on your security controls and the urgency with which they should be applied, no matter how large or small your organization is. It is very important to apply an efficient patch management solution and always have enabled an active event security logging and practice event monitoring.
References
