This article aims to provide its readers with the details about PRODAFT & INVICTUS Threat Intelligence (PTI) team’s latest operation on different threat actors; who have been detected to be working in cooperation with the notorious Fin7 APT group.
Throughout this article, which is planned to be released in 6/7 successive parts (similar to other articles on our pentest blog (pentest.blog); we will approach different aspects of our operation, which had been continued for the last 3 months until the end of July.
Throughout these articles; all of which originates from a single OPSEC failure on the threat actor’s side, we will try to expand the topic on a step-by-step basis, similar to how we expanded our scope as we’ve continued to discover further.
Between the months of May and July 2020; four members of PRODAFT Threat Intelligence team have conducted operation BlueRaven. A case study which originated from discovering a minor OpSec failure of a seemingly unimportant group of threat actors. Of course these threat actors have later been found to have ties with the notorious Fin7 / Carbanak threat actors.
PTI’s OP has originated from an OPSEC failure on the attacker’s side. Unlike previously discovered and published data what makes this OP special is we have managed to discover an important deal of unpublished information about attackers’ toolset which reveals the TTP of attackers.
Carbanak Group / Fin7, which was first detected in 2014, is one of the most effective APT groups in the world, and is among the first known APT groups. The group is thought to cause damage over 900 million dollars worldwide. Our OP has resulted to discover following critical findings about these threat actors:
The real identity of some of the attackers in Fin7 has been obtained.
Detailed evidence has emerged about Fin7’s tools and attack methods.
The relationship between Fin7 and REvil ransomware group (which will be provided in detail in latter stages) has emerged.
This report was written to raise awareness and assist cyber security experts’ analysis. Of course, PRODAFT some of our findings have been redacted. So, authorized bodies may get in touch with PRODAFT or INVICTUS for further disclosure.
Each article will deal with a specific aspect of the operation; including but not limited to attack methods, organizations, and identities of the attackers. Also; our team has managed to eavesdrop different jabber conversations between attackers. Most of these conversations will also be published throughout these series.
Carbanak Backdoor was among the first findings that our group has acquired.
The current version of CARBANAK backdoor (the most known tool of the team that gave the name to the Carbanak group) is the first tool that caught the attention of our team. The “3.7.5” version, which was compiled in November 2019 according to PE file header, is the last detected version of the backdoor command and control server. The screenshot of the management panel of “3.7.5” version of Carbanak backdoor is given in the screenshot below.
We compared the last version we obtained with the versions of the “Command Manager” in Virustotal in 2017 and conducted a review on this tool. In the image below, the differences between the source codes obtained as a result of the decompilation of the two versions mentioned can be seen. In the following image, which lists only the source codes that differ between the two versions, the left column belongs to the file uploaded to Virustotal in 2017, and the right column belongs to the “3.7.5” version that our team obtained. The blue lines refer to files that differ, while the green lines represent new files. As a result of the examination made on both command and control server software, it was seen that the basic changes were made to manage plugins through the GUI interface, to create a more detailed error log, and to add new language encodings.
6 versions of the malware “Command Manager” tool compiled in 2019 have been identified. The timestamps of the detected versions are given in the image below.
|3.7.5||Thu Nov 7 16:50:51 2019|
|3.7.3||Mon Sep 16 18:06:32 2019|
|3.7.2||Wed Jul 24 20:52:26 2019|
|3.7.1||Fri Jul 5 21:16:24 2019|
|3.6.3||Thu May 16 11:13:05 2019|
|3.6||Fri Apr 19 10:17:22 2019|
In the old version of Bot.dll, which is the component of the malware working on victim devices, 981 functions were detected with disassembly while 706 functions were detected in the new version of the same software. With Diaphora binary diffing tool, 607 functions get the best match score, while 43 functions get partial match. Also, the new bot file has less than 50kb of file size compared to the old version in Virustotal. When the new bot file is examined, it is seen that the functions other than the basic functions in the old version are implemented as plugins. These new plugins, which perform operations such as keylogging, process monitoring, are executed fileless with the reflective loading method. As a result, the file size of the malware shrinks, leaving less trace for forensic and signature-based security software solutions. Plugins in the last data obtained in the list below are listed.
In this section, some of the plugins that are “not” among the previously discovered files will be examined. As these are among the neverbeforeseen features of the notorious toolkit, we believe following sections to be very important in terms of further analyzing the group’s TTP.
The “keylog.dll” plugin capturing user keystrokes using the RegisterRawInputDevices API. To determine in which context the keystrokes are used, “Executable File Path”, “Windows Text” and Timestamp information of the foreground process is logged together with the keystrokes.
The keylogging plug-in converts the collected data to Bitmap using Windows GDI + APIs and writes it to the folder named “SA45E91.tmp” in the user’s %TEMP% directory. The image below shows the function that malicious software uses to store data.
The screenshot of the sample of the logs obtained is given in the image below.
This plugin can track processes running in the target system and is used to obtain information about the start and termination times of the desired process. In the image below, a screenshot of the function that collects information about the running processes is given.
The malware named Tirion, which is thought to be developed to replace the Carbanak backdoor is the new loader tool of the Fin7 group. It contains many functions for information gathering, code execution, recon, and lateral movement purposes. As in the latest version of the Carbanak backdoor, which was examined in the previous section, many functions performed by the malware have been developed as separate plugins. They are loaded and executed fileless in the target system with the reflective loading method. Exposed data shows that the development of the Carbanak backdoor is currently stopped and development and tests are being performed on the Tirion Loader by the same team. Communication logs between attackers show that this new tool is intended to replace the Carbanak backdoor. Our team has detected 8 different Tirion Loader command and control servers currently used.
The functions of Tirion malware are as follows:
- Information Gathering
- Taking Screenshot
- List Running Processes
- Command / Code execution
- Process Migration
- Mimikatz Execution
- Password Grabbing
- Active Directory and Network Recon
The latest detected version of Tirion Loader belongs to the version “1.6.4” compiled on “Sun Jun 28 23:24:03 2020”. The image below shows the actions an attacker can take on a bot device. The “1.0” version, which is the oldest version detected and thought to be the first version used, was compiled on “Thu Mar 05 20:29:53 2020”.
The following text from the “readme.txt” file written by the attackers clearly states the basic components of the malware.
Описание системы удаленного доступа Tirion
Система состоит из 3-х компонентов:
Эти компоненты связаны следующим образом:
Лоадер переодически коннектится к серверу, клиент подключается к серверу с постоянным коннектом. Лоадер выполняет команды от
сервера и передает ему ответы. Через клиента пользователь отдает команды лоадеру через сервер. Полученны ответы от лоадера,
сервер передает клиенту.
English translation of the related text is given below.
The system consists of 3 components:
These components are related as follows:
The loader periodically connects to the server, the client connects to the server with a permanent connection. The loader executes commands from server and sends it responses. Through the client, the user issues commands to the loader through the server. Received responses from the loader,the server transmits to the client.
The file organization of the malware is as follows:
The English translation of some important items of the “readme.txt” file, which indicates the changes from the first version of the malware to the “1.6.3” version and contains the build instructions, is as follows. (Original text in Russian is omitted.)
[+] The result of ADRecon work is saved in the database in the loader from which it was launched, when the tab is called again, the data loaded automatically
[+] Added a form for launching the script ps2x.py (PsExec).
[+] Added support for executing scripts from the ThirdScripts folder
[+] Added plugin NetSession. The plugin collects information about the computers connected to the computer where the loader is running.
[+] added plugin info. In the context menu, select Info and after a while in the Info field there will be the user name, domain and version of Windows
[+] The “Get passwords” button has been added to the mimikatz plugin
[+] Added support for RDP grabber.
[+] added plugin mimikatz.
[+] added grabber plugin.
[*] updated data transfer protocol
[+] added AV definition, for this there must be an AV.lst file in the server folder
[*] updated data transfer protocol
[+] sending local
[+] - added support for the jumper plugin
[+] - added support for the jumper plugin
This component of the malware that will run on victim systems is about 9kb in size and runs commands from the server. When the attacker wants to run a function on the device in the victim, the related plugin file containing this function is loaded reflectively on the victim device and filelessly executed it .
Network traffic between server and loader is encrypted with the key determined during the build phase. The following image contains the relevant encryption algorithm.
It is a DLL file responsible for stealing and reporting sensitive information from the target system, especially browser and mail passwords. It was determined that the attackers also used this tool independently from Tirion Loader. In the image below, a screenshot of the logs collected by the malware is included.
In the first edition of these series; we wanted to provide an intro towards our operation by comparing the latest Carbanak toolkit, as discovered by PTI, to older versions that have been publicly accessible.
In the next article, we will be diving deeper into the TTPs of the attackers by also providing references from actual conversations between them.
Aside, we will also be providing screenshots that have been directly acquired from threat actors’ machines. (An exemplary one is given below as a teaser.)
Please feel free to get in touch with us if you have further questions.
Credits: PRODAFT Threat Intelligence Team (PTI), INVICTUS Threat Intelligence Team (ITI) [namely womd, y.a.p., e.b., a.b.c. and slv]
Edited by [k.u.]
PRODAFT & INVICTUS Out!