Office 365 is Microsoft's software plus services offering that includes office productivity apps and cloud storage. The service allows for users to install Microsoft Office on their PCs, storage space on OneDrive and 60 Skype minutes per month. There are various offerings for consumers and business wishing to use Office 365.
Microsoft 365 is a subscription that includes the most collaborative, up-to-date features in one seamless, integrated experience. Microsoft 365 includes the robust Office desktop apps that you’re familiar with, like Word, PowerPoint, and Excel. Microsoft 365 includes everything you love about Office 365 and more, at the same price. We’ve added value to the Office 365 subscription to make it Microsoft 365. With Microsoft 365, you receive additional benefits including Microsoft Editor, Money in Excel, and premium creative content in Office, plus more to come. Need help installing Office? See all Office options.
Select Office 365 apps to begin the installation. The 64-bit version is installed by default unless Office detects you already have a 32-bit version of Office (or a stand-alone Office app such as Project or Visio) installed. In this case, the 32-bit version of Office will be installed instead.
Here are the various subscription plans for Office 365 available to regular, non-business consumers:
- Office Online: Includes online versions of Word, Excel, PowerPoint and OneNote for free.
- Office 365 Personal: Includes access to Word, Excel, PowerPoint, OneNote, Outlook, Publisher, and Access for home use on one computer and one tablet, 1 TB of additional OneDrive storage, and 60 minutes of Skype international calls per month.
- Office 365 University: A version of Office 365 Personal, but for those in universities and offered at a discounted price.
- Office 365 Home: Includes access to Word, Excel, PowerPoint, OneNote, Outlook, Publisher, and Access for home use on up to five devices by up to five users and five tablets, 1 TB of additional OneDrive storage per user, and 60 minutes of Skype international calls per month.
Новый вариант RogueRobin использует Google Диск в качестве альтернативного канала для получения команд.
APT-группировка DarkHydrus запустила новую вредоносную кампанию. Злоумышленники взяли на вооружение обновленный вариант трояна RogueRobin и в качестве альтернативного канала связи с ним используют Google Диск.
В ходе последней кампании группировка атаковала цели на Среднем Востоке. Троян попадал на компьютеры жертв через документ Excel с вредоносным кодом VBA (макросом). Атака была зафиксирована 9 января 2019 года специалистами китайского 360 Threat Intelligence Center (360 TIC). Эксперты отнесли ее на счет группировки DarkHydrus, которую «Лаборатория Касперского» называет Lazy Meerkat.
В 360 TIC обнаружили, что макросы во вредоносном документе загружают файл .TXT, а затем запускают его с помощью легитимной программы regsvr32.exe. Через несколько этапов на атакуемую систему в итоге загружается написанный на C# бэкдор.
По словам специалистов из Palo Alto Networks Unit 42, в текстовом файле скрывается файл Windows Script Component (.SCT), загружающий версию трояна RogueRobin. Как правило, эта полезная нагрузка базируется на PowerShell, но, похоже, киберпреступники портировали ее в компилированный вариант.
DarkHydrus компилировали RogueRobin с добавлением новой функции, позволяющей трояну использовать Google Диск в качестве альтернативного канала связи для получения инструкций. Команда x_mode отключена по умолчанию, однако ее можно включить через канал туннелирования DNS – основной канал связи трояна с C&C-сервером.
Background
360 Threat Intelligence Center captured several lure Excel documents written in Arabic in January 9, 2019. A backdoor dropped by macro in the lure documents can communicate with C2 server through DNS tunnel, as well as Google Drive API.
We confirmed that this is a DarkHydrus Group’s new attack targeting Middle East region. In July 2018, Palo Alto disclosed DarkHydrus Group which showed its special interest to governments in Middle East[1]. Prior to that report, we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms), which is believed a work of DarkHydrus[2].
Timeline
Timeline of activities of DarkHydrus Group:
Kaspersky named “LazyMeerkat” to this APT group. [4]
Sample Analysis
Dropper（Macros）
| MD5 | 5c3f96ade0ea67eef9d25161c64e6f3e |
| Filename | الفهارس.xlsm（indexes. xlsm） |
| MD5 | 8dc9f5450402ae799f5f8afd5c0a8352 |
| Filename | الاطلاع.xlsm（viewing. xlsm） |
This malware is a lure Excel document with name ‘الفهارس.xlsm’. When it is opened, embedded VBA macro is trigged to run. That macro drops 12-B-366.txt to ‘%TEMP%’ directory first, then leverages regsvr32.exe to run 12-B-366.txt
Office 365 Sign In
12-B-366.txt is a HTA (HTML application) file, which will drop a PowerShell script to %TEMP% WINDOWSTEMP.ps1
Finally, the PowerShell script drops %TEMP%OfficeUpdateService.exe for execution by extracting Based64-encoded content.
Backdoor（OfficeUpdateService.exe）
| MD5 | b108412f1cdc0602d82d3e6b318dc634 |
| Filename | OfficeUpdateService.exe |
| PDB path | C:UserswilliamDocumentsVisual Studio 2015ProjectsDNSProjectDNSProjectobjReleaseDNSProject.pdb |
This backdoor is written in C#：
The PDB path has a project name ‘DNSProject’, which illustrates that the malware may leverage some DNS techniques to achieve its goal.
C:UserswilliamDocumentsVisual Studio 2015ProjectsDNSProjectDNSProjectobjReleaseDNSProject.pdb
The backdoor checks if ‘st:off’ and ‘pd:off’ is given as paramters. If ‘st:off’ presents, no persistence entry is added; PDF file is not dropped if ‘pd:off’ exists. Then it detects existence of virtual machine and sandbox before malicious payload is triggered.
A registry entry is added for persistence：
Office 365 Download
It can drop a PDF file：
Codes of virtual machine detection, sandbox detection and anti-debug are following,
Next, the backdoor will collect host name
The backdoor will send collected information to C2 server through DNS tunnel. queryTypesTest function is created for DNS tunnel communication.
Then, the backdoor tries to retrieve commands from C2 server via DNS tunnel, then through HTTP if failed.
After C2 commands is retrieved successfully, commands are dispatched by taskHandler.
Screenshot of a part of C2 commands
“^$x_mode” command sets file server address which is sent in DNS tunnel.
One file server is Google Drive
https://www.googleapis.com/upload/drive/v3/files/” + file_id + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents
All command lists are following：
| Command | Feature |
| ^kill | Kill thread or process |
| ^$fileDownload | Download file |
| ^$importModule | Import module |
| ^$x_mode | In x_mode，configure C2 address，then send RAT data to C2 by HTTP protocol |
| ^$ClearModules | Remove module |
| ^$fileUpload | Upload file |
| ^testmode | Test module |
| ^showconfig | Show configuration |
| ^changeConfig | Change configuration |
| ^slp | Sleep |
| ^exit | Exit process |
DNS Tunnel
DNS tunnel is a C2 communication technique in which malware send data and retrieve commands by DNS query packets. This technique is very effective since most gateways or firewalls allow both ingress and egress DNS traffic.
If C2 server is assigned in the format of IP address in malware body, malware can contact C2 directly. But OfficeUpdateService.exe backdoor has C2 server in the format of DNS name, which requires a DNS resolution to C2 domain name first. To do that, the backdoor queries C2 domain in specific name server. Then the backdoor communicates C2 server in DNS tunnel.
C2 domain names are following：
Name Server
Malware sends DNS queries to these two name servers for C2 domain name resolution: ‘tvs1.trafficmanager.live’ and ‘tvs2.trafficmanager.live’
Malware uses nslookup to send out DNS query, with following parameters: ‘timeout’ and ‘q’ for DNS record type
C&C Commands
To parse C2 commands from above types of DNS records, the malware uses different regular expressions. For example, if commands are sent back in DNS A record, the malware will use following regular expression:
Malware will retrieve a process ID as victim ID, then treats victim ID as subdomain name in C2 communication.
C2 commands are parsed out by regular expressions based on DNS record types.
We manually send out a DNS TXT query with victim ID as illustration.
A domain name ‘ajpinc.akamaiedge.live’ is created. In subdomain ‘ajpinc’, ‘a’ means this is the first request, and ‘c’ is the character for string end, while ‘jpin’ is process ID. Then, we send DNS query by using nslookup command as following
The malware will use following regular expression to parse out command, ([w+).(akdns.live|akamaiedge.live|edgekey.live|akamaized.live](file://w+).(akdns.live|akamaiedge.live|edgekey.live|akamaized.live)).
Finally, system configuration is sent to C2 server in DNS protocol.
Communication Rule
This malware uses following types of DNS record
| A |
| AAAA |
| AC |
| CNAME |
| TXT |
| SRV |
| SOA |
| MX |
To parse C2 commands from above types of DNS records, the malware uses different regular expressions. For example, if commands are sent back in DNS AC record, the malware will use following regular expression:
Following regular expression is for commands in DNS AAAA records,
And there is one regular expression for several DNS record types, including CNAME, SRV, SOA,
Breakdown of regular expressions are as following,
| Types of DNS record | Regular expressions |
| A | Address:s+(d+.d+.d+.d+) |
| AC | ([^r-vs]+)[r-v]([wd+/=]+)-w+.(<C2DOMIAN>) |
| AAAA | Address:s+(([a-fA-F0-9]{0,4}:{1,4}[w|:]+){1,8}) |
| CNAME、TXT、SRV、SOA、MX | ([^r-vs]+)[r-v]([wd+/=]+)-w+.(<C2DOMIAN>)and(w+).(<C2DOMIAN>) |
However, the malware will cancel operation if commands is matched by following regular expression: “216.58.192.174|2a00:1450:4001:81a::200e|2200::|download.microsoft.com|ntservicepack.microsoft.com|windowsupdate.microsoft.com|update.microsoft.com”
Attribution
We found some traces which lead us to believe that DarkHydrus is behind this attack.
Office 365 Login Portal
Samples with DNS Tunnel Function
Similar to the malware disclosed by Palo Alto[2], both malware use DNS tunnel technique:
Sandbox detection and Backdoor Capability
The new malware has very similar code of detection to sandbox and virtual machine as previous DarkHydrus samples
Both samples have very similar code and functionality:
Pivot
One interesting finding is that, there is one Twitter user Steve Williams with handle name @darkhydrus2. It’s coincident that both ‘darkhydrus’ (APT group name) and ‘Williams’ (user name in PDB path) found in this Twitter user.
Summary
In recent APT incidents, more and more threat actors tend to adopt Office VBA macro instead of Office 0day vulnerability in the consideration of cost reduction. It is recommended that users avoid to open documents from untrusted sources. And Office macro should be disabled by default.
Products of 360 ESG can protect users from this new malware, including 360 Threat Intelligence Platform, SkyEye APT Detection, 360 NGSOC.
IOC
| MD5 |
| 5c3f96ade0ea67eef9d25161c64e6f3e |
| 8dc9f5450402ae799f5f8afd5c0a8352 |
| b108412f1cdc0602d82d3e6b318dc634 |
| 039bd47f0fdb6bb7d68a2428c71f317d |
| PDB PATH |
| C:UserswilliamDocumentsVisual Studio 2015ProjectsDNSProjectDNSProjectobjReleaseDNSProject.pdb |
| C2 |
| 0ffice365.life |
| 0ffice365.services |
| 0nedrive.agency |
| akamai.agency |
| akamaiedge.live |
| akamaiedge.services |
| akamaized.live |
| akdns.live |
| azureedge.today |
| cloudfronts.services |
| corewindows.agency |
| edgekey.live |
| microsoftonline.agency |
| nsatc.agency |
| onedrive.agency |
| phicdn.world |
| sharepoint.agency |
| skydrive.agency |
| skydrive.services |
| t-msedge.world |
| trafficmanager.live |
References
[1]. https://ti.360.net/blog/articles/analysis-of-settingcontent-ms-file/
[2]. https://unit42.paloaltonetworks.com/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
[3]. https://ti.360.net/
[4]. https://twitter.com/craiu/status/1083305994652917760
[5]. Взято © https://www.securitylab.ru