[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_spacing=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_shadow=”none” column_border_radius=”none” column_link_target=”_self” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” tablet_text_alignment=”default” phone_text_alignment=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text]\n<\/p>
In this article, we share a surprising discovery we found when studying the ASUS Live Update attack that occurred during March of 2019. Our research shows the possible presence of another malicious operation that seemingly targeted the financial sector. Below are our key takeaways.<\/p>\n
This financial sector attack was inadvertently discovered during our investigation of Operation ShadowHammer[1], which was an advanced persistent threat (APT) targeting certain ASUS users. Compromising the update mechanism of the ASUS Live Update platform, the legitimate certificate and the trusted dispatch channel made it easy for the attacker to mask their malicious activities. While Operation ShadowHammer highlighted the severity of a supply chain attack, our research team dug deeper to see if there was any other malware utilizing the fake ASUS Live Update service.<\/p>\n
Our research involved developing several Yara rules and malware hunting techniques on VirusTotal. For instance, the ShadowHammerDropper rule, which is demonstrated in Fig. 1, detected the string “ASUS Live Update” and the resource name “EXE”. Another rule, ShadowHammer<\/em>Signed determined if ASUS certificates were used. We also implemented several rules for detecting ShadowHammer’s malware. Results revealed the detection of several malware samples, including ones unrelated to ShadowHammer. Among these unrelated samples, we were particularly interested in the following three malware. Since these malware had valid certificates, they would not be flagged by most anti-virus software.<\/p>\n A more detailed analysis is presented in the following sections.<\/p>\n <\/p>\n According to the behavior of these samples, they can basically be classified into two types of payload, as depicted in Fig. 2 and Fig. 3. The type 1 malware was downloaded from the phishing website https[:]\/\/pcisecuritysstandards[.]org\/, tricking users to think it was https[:]\/\/pcisecuritysstandards[.]org\/. Due to this social engineering attempt, we believe these malware samples were aimed at the financial sector. The downloaded malware pretended to be Adobe Download Manager, which resulted in users downloading another type of malware from the second stage C2 statistic.data-akamai[.]com. The final payload was a Cobalt Strike backdoor. Compared to type 1, the type 2 malware did not involve a second-stage process, but directly dropped and executed the Cobalt Strike backdoor.<\/p>\n <\/p>\n <\/p>\n <\/p>\n Basic information of the first stage dropper (31d1bc9911cdcd9af78c0a215417699a9406fcd4e7802c3d2f0e7cff4477f384) is shown in Fig. 4. Our threat intelligence platform gave it a MEDIUM threat rating. The first stage droppers was a fake Adobe Download Manager with legitimate signatures ( FOURSTAR SOLUTIONS LTD and AUSTEK CONSULTING LIMITED ), coded in C++ without obfuscation or packing.<\/p>\n A very important feature of the first stage dropper was that a legal certificate was used to sign this malware, causing many security vendors to treat it as a benign program, thereby increasing the likelihood of a system compromise. The malware used the name “AUSTEK CONSULTING” as a disguise for “ASUSTeK Computer Inc” to confuse victims. The inconsistency between the certificate and the program’s intent highlights the risk that certificates cannot be regarded as a foolproof way to establish trust.<\/p>\n Fig. 5. shows the reversed code snippet of the malware. The malware extracted the second stage malware from its resource section and invoked the second stage via ShellExecuteA. The second stage malware, RC\/101 and RC\/102, were dropped to C:\\Windows\\System32. RC\/102 was a service launcher that installed the RC\/101 service.<\/p>\n <\/p>\n The second stage payload consisted of a backdoor (RC\/101) and a service launcher (RC\/102), which were embedded in the resource section. Each discovered dropper dropped two files from the resource to C:\\Windows\\System32\\ with the following names:<\/p>\n As an example, the main routine of the service launcher (RC\/102) is shown in Fig. 6.<\/p>\n <\/p>\n <\/p>\n We found two types in the second stage payload. One of them was the downloader, while the other was the Cobalt Strike backdoor. The payload was encoded three times to evade detection.<\/p>\n An interesting technique employed by this malware was modifying __tmainCRTStartup in CRT for malicious behavior, which is illustrated in Fig. 7a. Meanwhile, some function calls were modified to _security<\/em>init_cookie. As it is highly unlikely for this function to fail, even if some changes were made to the function, nothing would be triggered by the subsequent error checking. There would be no early exits, and the programs would be normally executed. Thus, the implanted malware can be more robustly executed. Since CRT is very common in a normal executable and reverse engineers usually ignore them, it increases the chances for the malware to avoid detection.<\/p>\n As the memory protection attribute of the .text section was modified to read-write-execute, this implied the SMC (self-modifying code) technique was applied. It used a busy-loop-liked routine to compute xor key “CCCMMM”, as shown in Fig. 7b. Billions of instruction cycles were required, which caused a few seconds of delay, thereby allowing it to evade the emulation-based detection.<\/p>\n The first layer released a shellcode followed by a UPX packed module into the memory and a process hollowing trick to execute the UPX packed module as a second layer. The payload inside the UPX packed module released the Cobalt Strike backdoor as shellcode into the memory and was executed with ReflectiveLoader. Fig. 8 is the partial memory released from the first layer. The MZ indicates there was an embedded PE structure, which would be loaded later. The UPX0 string indicates this malware was packed with the UPX. Thus, it could be extracted from the memory and unpacked.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n The Cobalt Strike backdoor, which was dropped by the previous fake Adobe Download Manager, masqueraded as the ASUS Live Update utility program. The backdoor had the ability to upload files, download files, inject shellcode, execute powershell script, etc…, as shown by our reverse result in Fig 11. In Fig. 9, which is the resource information of this malware, the “LiveUpdate” strings appears in the Version Info. Another resource also contains a dialog template similar (or identical) to the ASUS Live Update, as shown in Fig. 10.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n The other way to invoke the final stage malware was via a downloader. The downloader downloaded shellcode from https[:]\/\/statistic.data-akamai[.]com\/eYVU and executed it in memory without dropping any file. From our threat intelligence platform, this domain was once bounded to 23[.]106.215.179. This IP is known to be involved in previous attacks as shown in our CTI platform, Fig 11 . The final stage shellcode (eYVU) was also a Cobalt Strike backdoor, similar to the one described above.<\/p>\n\n
Overall Attack Graph<\/h2>\n
First Stage Dropper<\/h2>\n
Second Stage Payload<\/h2>\n
\n
\n
\n
\n
Obfuscation Technique<\/h2>\n
Type 1: Cobalt Strike backdoor<\/h2>\n
Type 2: Downloader<\/h2>\n