APTs-Adversary-Simulation/North Koreans APT/Stardust Chollima

Stardust Chollima APT Adversary Simulation

This is a simulation of attack by (Stardust Chollima) APT group targeting Chilean interbank network, The attack campaign was active in December 2018, have used PowerRatankba, a PowerShell-based malware variant that closely resembles the original Ratankba implant. The Redbanc corporate network was infected with a version of the PowerRatankba that was not detected by anti-malware. The way attackers delivered the malware, according to Flashpoint a trusted Redbanc IT professional clicked to apply to a job opening found on social media (linkedin). I relied on Security Affairs to figure out the details to make this: https://securityaffairs.com/79929/breaking-news/chilean-research-redbank-lazarus.html

Stardust Chollima Operations performed: https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Subgroup%3A%20Bluenoroff%2C%20APT%2038%2C%20Stardust%20Chollima&n=1

The dropper used to deliver the malware is related to the PowerRatankba, a Microsoft Visual C#/ Basic .NET compiled executable associated with Stardust Chollima APT. The dropper was used to download a PowerRatankba PowerShell reconnaissance tool, the dropper displays a fake job application form while downloads and executes PowerRatankba in the background by useing (Base64).

Zdnet resources: https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/

The PowerRatankba sample used in the Chilean interbank attack, differently from other variants, communicates to the C&C server on HTTPS, This latter code is registered as a service through the “sc create” command as, the malware gain persistence by setting an autostart.

BushidoToken Threat Intel: https://blog.bushidotoken.net/2021/08/the-lazarus-heist-where-are-they-now.html

1. Social engineering technique: The attackers delivered the malware, according toFlashpoint a trusted Redbanc IT professional clicked to apply to a job opening found on social media.

2. Fake job application form: The dropper displays a fake job application form while downloads and executes PowerRatankba in the background by useing (Base64).

3. PowerRatankba.ps1: The main backdoor creates a connection between the targeted device and gives the attacker full control via C2 server and latter code is registered as a service through the “sc create” command as,“ the malware gain persistence by setting an autostart .

4. C&C server on HTTPS: When a command is received, it is executed using the PowerShell command in Windows. The output of the command is captured and sent back to the C2 server.

The first stage (social engineering technique)

The attackers delivered the malware, according to Flashpoint a trusted Redbanc IT professional clicked to apply to a job opening found on social media.The person that published the job opening then contacted the employee via linkedin Skype, etc for an interview and tricked him into installing the malicious code.

The group addressed several employees of the company through LinkedIn's messaging. Passing himself as a Meta recruiter, the attacker used a lure of job offer to attract the attention and confidence of the target

This attack is based on a scenario that seems very natural and realistic. The attackers conduct job interviews in a completely normal way, and then inform the victim that they’ve been accepted for the position. Naturally, when someone gets accepted for a job, it’s expected that they will receive access to a company email or be asked to install certain programs required to start their tasks.

The scenario appears completely logical they might add you to the company’s Slack server, or ask you to download specialized tools or software. In some cases, they even ask you to start learning a new language like Spanish, and they tell you that they’ve already purchased a chair for you. All you need to do is install a certain application and enter your personal information into it.

But in reality, that application runs in the background and silently downloads a backdoor, giving the attackers unauthorized access to your device.

And the real objective of the attack is not the job itself, but the information on your personal device. Many people still keep sensitive data from their previous jobs on their laptops such as documents, projects, or login credentials. So, the attacker is indirectly targeting the company the victim previously worked at, or even the one they’re currently working for, by using the victim’s personal machine.

Instead of launching a direct attack on the company, they exploit normal human behavior like the desire to find a better job and target individuals who already have access or sensitive knowledge. This gives the attacker a hidden entry point to breach organizations without raising suspicion.

The second stage (Fake job application - Backdoor Downloader by base64)

This Stager is a graphical user interface (GUI) designed to look like a registration form for a fake company called "Global Processing Center, LTD." However, in reality, it contains malicious code that executes a hidden PowerShell script when run. The dropper downloads and executes PowerRatankba in the background by useing (Base64).

Breakdown of the Malicious Code Execution:

1. Automatic Execution: When the program starts, it automatically calls the function ExecuteBase64Script(), which is responsible for decoding and executing the malicious payload.

2. Base64-Encoded PowerShell Script: The program contains Base64-encoded data, which is often used to hide malicious commands from antivirus and security software.

3. Execution with Unrestricted Policy: The PowerShell script is executed with bypassed execution policy (-ExecutionPolicy Bypass), meaning it ignores any security restrictions on running scripts.

   This is a known technique used by attackers to execute unauthorized PowerShell commands without user consent.

4. Decoding and Writing to File: The Base64 string is decoded and saved as a PowerShell script file named "PowerRatankba.ps1" which is then used as the attack payload.

The third stage (PowerRatankba.ps1 - Backdoor)

This PowerShell script is a reverse shell with persistence, meaning it allows an attacker to gain remote access to the infected machine and ensures it runs every time the system starts.

Once connected:

1. waits for commands from the attacker.

2. executes the commands on the victim’s machine.

3. sends the command output back to the attacker.

Persistence (Runs at Startup): The script modifies the Windows Registry (Run key) to automatically start on reboot. Every time the user logs in, the malicious script executes again, ensuring the attacker regains control.

The fourth stage (payload connect to HTTPS-C2 Server)

C&C server on HTTPS: When a command is received, it is executed using the PowerShell command in Windows. The output of the command is captured and sent back to the C2 server.

https://github.com/user-attachments/assets/a86c474f-2291-4447-adaf-f4f875b23475

MITRE ATT&CK Techniques

Technique ID	Technique	Implementation
T1566.002	Phishing: Spearphishing Link	Delivers a malicious job opportunity through social media (LinkedIn) to lure the victim into downloading the malware.
T1204.002	User Execution: Malicious File	Requires the victim to execute the downloaded PowerRatankba dropper.
T1059.001	Command and Scripting Interpreter: PowerShell	Executes attacker-issued PowerShell commands on the compromised host.
T1105	Ingress Tool Transfer	Downloads the next-stage payload from the attacker-controlled infrastructure.
T1547.001	Registry Run Keys / Startup Folder	Establishes persistence by creating a Windows Registry Run key executed at user logon.
T1071.001	Application Layer Protocol: Web Protocols	Communicates with the C2 server over HTTPS.
T1027	Obfuscated Files or Information	Uses obfuscation techniques to hinder static analysis of the dropper and payload.
T1082	System Information Discovery	Collects basic host information before processing attacker commands.
T1036	Masquerading	Uses legitimate-looking filenames and application metadata to reduce suspicion.
T1497	Virtualization/Sandbox Evasion	Detects analysis environments before continuing execution.