5.9 KiB
Venomous Bear APT Adversary Simulation
This is a simulation of attack by (Venomous Bear) APT group targeting U.S.A, Germany and Afghanista attack campaign was active since at least 2020, The attack chain starts with installed the backdoor as a service on the infected machine. They attempted to operate under the radar by naming the service "Windows Time Service", like the existing Windows service. The backdoor can upload and execute files or exfiltrate files from the infected system, and the backdoor contacted the command and control (C2) server via an HTTPS encrypted channel every five seconds to check if there were new commands from the operator. I relied on Cisco Talos Intelligence Group tofigure out the details to make this simulation: https://blog.talosintelligence.com/tinyturla/
The attackers uses a .BAT file that resembles the Microsoft Windows Time Service, to install the backdoor. The backdoor comes in the form of a service dynamic link library (DLL) called w64time.dll. The description and filename make it look like a valid Microsoft DLL. Once up and running, it allows the attackers to exfiltrate files or upload and execute them, thus functioning as a second-stage postern when needed.
-
BAT file: The attackers used a .bat file similar to the one below to install the backdoor as a harmless-looking fake Microsoft Windows Time service.
-
DLL backdoor: I have developed a simulation of the backdoor that the attackers used in the actual attack.
-
Backdoor Listener: I was here developed a simple listener script that waits for the incoming connection from the backdoor when it is executed on the target machine.
According to what the Cisco team said, they were not able to identify the method by which this backdoor was installed on the victims’ systems.
The first stage (.BAT file)
The attackers used a .bat file similar to the one below to install the backdoor as a harmless-looking fake Microsoft Windows Time service, the .bat file is also setting the configuration parameters in the registry the backdoor is using.
I wrote a .bat file identical to the one the attackers used to the one below to install the backdoor as a fake Microsoft Windows Time service.
These commands add various configuration parameters for the W64Time service to the registry.
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%SystemRoot%\system32\w64time.dll" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Hosts /t REG_SZ /d "REMOVED 5050" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v Security /t REG_SZ /d "<REMOVED>" /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeLong /t REG_DWORD /d 300000 /f
reg add "HKLM\SYSTEM\CurrentControlSet\services\W64Time\Parameters" /v TimeShort /t REG_DWORD /d 5000 /f
ServiceDll: Specifies the DLL that implements the service.
Hosts: Sets the hosts and port (values removed for security).
Security: Configures security settings (value removed for security).
TimeLong: A time-related setting.
TimeShort: Another time-related setting.
This means the malware is running as a service, hidden in the svchost.exe process. The DLL's ServiceMain startup function is doing not much more than executing.
The Second stage (DLL backdoor)
"Here, I have developed a simulation of the backdoor that the attackers used in the actual attack."
First, the backdoor reads its configuration from the registry and saves it in the "result" structure, which is later on assigned to the "sConfig" structure.
This backdoor includes the following components:
1.Service Control Handler: Registers a service control handler to manage the service's state.
2.Main Malware Function: Placeholder for the main logic of the backdoor.
3.Configuration Reading: Initializes the configuration with placeholders for actual values.
4.C2 Command Retrieval: Simulates retrieving commands from a Command and Control (C2) server.
5.Command Processing: Processes the retrieved commands (currently simulated).
6.Service Loop: Continuously connects to the C2 server and processes commands, with error handling and cleanup.
Adjust the placeholder values and add the actual logic for backdoor operations and C2 command processing as per your requirements.
The third stage (Backdoor Listener)
I was here developed a simple listener script that waits for the incoming connection from the backdoor when it is executed on the target machine.
Accepts incoming connections: When a client connects, it prints the client's IP address and port.
Sends the command: Encodes the command as bytes and sends it over the socket.
Prompts for a command: Asks the user to enter a command to send to the connected client.
Continues reading until no more data is received.
Receives output from the client: Reads data in chunks of 4096 bytes.
Accumulates the data into the output variable.