Digging up InvisiMole’s hidden arsenal | WeLiveSecurity

Digging up InvisiMole’s hidden arsenal

ESET researchers reveal the modus operandi of the elusive InvisiMole group, including newly discovered ties with the Gamaredon group

ESET researchers reveal the modus operandi of the elusive InvisiMole group, including newly discovered ties with the Gamaredon group

In our tracking of the InvisiMole group, which we discovered, named, and first reported on in 2018, we have found a new campaign targeting high-profile organizations in Eastern Europe. Investigating the attacks, in close cooperation with the affected organizations, we uncovered its updated toolset and previously unknown details about InvisiMole’s tactics, techniques and procedures (TTPs).

In this blogpost, we summarize the findings published in full in our white paper, InvisiMole: The hidden part of the story.

The InvisiMole group is a threat actor operating at least since 2013. We previously documented its two backdoors, RC2CL and RC2FM, notable for their extensive spying capabilities, but we didn’t know how these backdoors were delivered, spread or installed on the system.

In this recent campaign, the InvisiMole group has resurfaced with an updated toolset, targeting a small number of high-profile organizations in the military sector and diplomatic missions, both in Eastern Europe. According to our telemetry, the attack attempts were ongoing from late 2019 to the time of writing this report.

Thanks to investigating the attacks in cooperation with the affected organizations, we were able to expose the inner workings of the updated InvisiMole toolset.

We discovered InvisiMole’s arsenal is only unleashed after another threat group, Gamaredon, has already infiltrated the network of interest, and possibly gained administrative privileges. This allows the InvisiMole group to devise creative ways to operate under the radar.

For example, the attackers use long execution chains, crafted by combining malicious shellcode with legitimate tools and vulnerable executables. They use DNS tunneling for stealthier C&C communications, and place execution guardrails on the malicious components to hide the malware from security researchers.

Delivery mechanism

During our investigation, we discovered that InvisiMole is delivered to the compromised systems by a .NET downloader detected by ESET products as MSIL/Pterodo, the work of the Gamaredon group. Gamaredon is a threat actor, operating at least since 2013, characterized by rapid development and making little effort to stay under the radar. We recently documented the newest Gamaredon components, distributed through spearphishing emails and used to move laterally as far as possible within the target’s network, while fingerprinting the machines.

Our research now shows Gamaredon is used to pave the way for a far stealthier payload – according to our telemetry, a small number of Gamaredon’s targets are “upgraded” to the advanced InvisiMole malware, likely those deemed particularly significant by the attackers.

Figure 1. Gamaredon’s .NET downloader can “upgrade” the victim’s machine to InvisiMole’s TCP downloader

As we detail in the white paper, despite the evidence of collaboration, we consider Gamaredon and InvisiMole to be two distinct groups with different TTPs, rather than a single threat actor.

Spreading and updating mechanisms

We document three ways that InvisiMole spreads within compromised networks:

  • Using the BlueKeep vulnerability in the RDP protocol (CVE-2019-0708)
  • Using the EternalBlue vulnerability in the SMB protocol (CVE-2017-0144)
  • Using trojanized documents and software installers, crafted using benign files stolen from the compromised organization

To craft the trojanized files, InvisiMole first steals documents or software installers from the compromised organization, and then creates an SFX archive that bundles the file with the InvisiMole installer. The original file is then replaced with the weaponized version, while its name, icon and metadata are preserved. The attackers rely on the users to share and execute these files.

This lateral movement technique is especially powerful if the trojanized file happens to be a software installer placed on a central server – a common way to deploy software in larger organizations. That way, InvisiMole is organically distributed to many computers that use this server.

Regardless of the spreading method, the first InvisiMole component deployed on the newly-compromised machines is always InvisiMole’s TCP downloader – a simple addition to the toolset that downloads the next stage of the infiltration.

The second addition to the updated InvisiMole toolset, the DNS downloader, has the same functionality but is designed for long-term, covert access to the machine. It uses a stealthier method of C&C communication, using a technique called DNS tunneling (see Figure 2).

Figure 2. DNS tunneling

With DNS tunneling, the compromised client does not directly contact the C&C server; it only communicates with the benign DNS server(s) the victim machine would normally communicate with, where it sends requests to resolve a domain to its IP address. The DNS server then contacts the name server responsible for the domain in the request, which is an attacker-controlled name server, and relays its response back to the client.

The actual C&C communication is embedded in the DNS requests and replies, unbeknownst to the benign DNS server that operates as an intermediary in the communication.

Execution chains

The most notable feature of the newest InvisiMole toolset is its long execution chains, used to deploy the final payloads – the updated RC2CM and RC2CL backdoors, and the new TCP and DNS downloaders.

We reconstructed four execution chains, used by the attackers in various situations – based on the OS version of the victim’s computer, and on whether they were able to gain administrative privileges on the system:

  • The Control Panel misuse chain uses a rare technique known from Vault 7 leaks, used to achieve covert execution in the context of the Control Panel.
  • The SMInit exploit chain exploits a vulnerability in the legitimate Total Video Player software. It is used in cases where the attackers haven’t managed to obtain administrative privileges on the system.
  • The Speedfan exploit chain exploits a local privilege escalation vulnerability in the speedfan.sys driver to inject its code to a trusted process from kernel mode.
  • The Wdigest exploit chain is InvisiMole’s flagship chain, the most elaborate, used on the newest versions of Windows, where the attackers have administrative privileges. It exploits a vulnerability in the Windows wdigest.dll library and then uses an improved ListPlanting technique to inject its code into a trusted process.

The vulnerable executables used in these chains are all introduced to the system by InvisiMole – the variation of this technique with a vulnerable driver has been previously referred to as Bring Your Own Vulnerable Driver by fellow researchers. For the other cases, we have named the technique Bring Your Own Vulnerable Software.

We document these tactics in detail in the Execution chains section of our white paper.

Figure 3. InvisiMole’s execution chains; padlocks indicate use of per-machine encryption

Note the heavy use of legitimate tools and per-victim encryption, shown in the overview of these four chains in Figure 3. It is the tactic of InvisiMole’s operators to exclusively install legitimate tools, and reserve the malicious payloads for later stages.

To place execution guardrails and encrypt the payloads individually per-victim, InvisiMole uses a Windows feature called Data Protection API (DPAPI), specifically:

  • the CryptProtectData API for data encryption
  • the CryptUnprotectData API for data decryption

This symmetric encryption scheme uses a key derived from the user’s logon secrets, so the decryption must be performed on the same computer where the data were encrypted.

Figure 4 shows a fragment of a typical InvisiMol loader that uses CryptUnprotectData for decryption and then checks whether the decrypted blob starts with a characteristic InvisiMole four-byte magic value:

  • 64 DA 11 CE for 64-bit payloads
  • 86 DA 11 CE for 32-bit payloads

Figure 4. Fragment of a characteristic InvisiMole loader

The DPAPI feature, intended for local storage of credentials such as Wi-Fi passwords or login passwords in web browsers, is abused by InvisiMole to protect its payload from security researchers. Even if they find InvisiMole’s components in telemetry or on malware sharing platforms, they can’t decrypt them outside the victim’s computer.

However, thanks to direct cooperation with the affected organizations, we were able to recover the payloads and reconstruct four of InvisiMole’s execution chains, which are described in detail in the white paper.

Conclusion

When we first reported about InvisiMole in 2018, we highlighted its covert workings and complex range of capabilities. However, a large part of the picture was missing.

After discovering new activity in late 2019, we gained the opportunity to take a proper look under the hood of InvisiMole’s operations and piece together the hidden parts of the story. Analyzing the group’s updated toolset, we observed continuous development and substantial improvements, with special focus on staying under the radar.

Our investigation also revealed a previously unknown cooperation between InvisiMole and the Gamaredon group, with Gamaredon’s malware used to infiltrate the target network and deliver the sophisticated InvisiMole malware to targets of special interest.

Having provided a detailed report on InvisiMole’s TTPs, we will continue to track the group’s malicious activities.

ESET detection names and other Indicators of Compromise for these campaigns can be found in the full white paper, InvisiMole: The hidden part of the story.

Acknowledgements to fellow ESET malware researchers Matthieu Faou, Ladislav Janko and Michal Poslušný for their work on this investigation.

MITRE ATT&CK techniques

Note: For better readability, we have separated the RC2FM and RC2CL backdoors into their respective ATT&CK mapping tables, because of their rich capabilities. The first mapping pertains to InvisiMole’s supporting components used for delivery, lateral movement, execution chains, and for downloading additional payloads.

InvisiMole

TacticIDNameDescription
ExecutionT1196Control Panel ItemsInvisiMole’s loader is masked as a CPL file, misusing control panel items for execution.
T1106Execution through APIInvisiMole has used ShellExecuteW and CreateProcessW APIs to execute files.
T1129Execution through Module LoadInvisiMole implements a custom loader for its components (InvisiMole blobs).
T1203Exploitation for Client ExecutionInvisiMole has delivered vulnerable Total Video Player software and wdigest.dll library and exploited their stack overflow and input validation vulnerabilities, respectively, to gain covert code execution.
T1085Rundll32InvisiMole has used rundll32.exe as part of its execution chain.
T1053Scheduled TaskInvisiMole has used Windows task scheduler as part of its execution chains.
T1064ScriptingInvisiMole has used a JavaScript file named Control.js as part of its execution chain.
T1035Service ExecutionInvisiMole has registered a Windows service as one of the ways to execute its malicious payload.
T1204User ExecutionInvisiMole has been delivered as trojanized versions of software and documents, using deceiving names and icons and relying on user execution.
PersistenceT1050New ServiceInvisiMole has registered a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.
T1060Registry Run Keys / Startup FolderInvisiMole has placed a LNK file in Startup Folder to achieve persistence.
T1053Scheduled TaskInvisiMole has scheduled tasks under names MSST and \Microsoft\Windows\Autochk\Scheduled to achieve persistence.
T1023Shortcut ModificationInvisiMole has placed a LNK file in Startup Folder to achieve persistence.
Privilege EscalationT1088Bypass User Account ControlInvisiMole can bypass UAC to obtain elevated privileges.
T1068Exploitation for Privilege EscalationInvisiMole has exploited CVE-2007-5633 vulnerability in speedfan.sys driver to obtain kernel mode privileges.
Defense EvasionT1140Deobfuscate/Decode Files or InformationInvisiMole decrypts strings using variations of XOR cipher. InvisiMole decrypts its components using the CryptUnprotectData API and two-key triple DES.
T1480Execution GuardrailsInvisiMole has used Data Protection API to encrypt its components on the victim’s computer, to evade detection and make sure the payload can only be decrypted (and then loaded) on one specific compromised computer.
T1143Hidden WindowInvisiMole has executed legitimate tools in hidden windows and used them to execute malicious InvisiMole components.
T1066Indicator Removal from ToolsInvisiMole has undergone technical improvements in attempt to evade detection.
T1202Indirect Command ExecutionInvisiMole has used winapiexec tool for indirect execution of Windows API functions.
T1027Obfuscated Files or InformationInvisiMole has obfuscated strings and code to make analysis more difficult, and encrypted its components to thwart detection.
T1055Process InjectionInvisiMole has injected its code into trusted processes using an improved ListPlanting technique and via APC queue.
T1108Redundant AccessInvisiMole has deployed multiple backdoors on a single compromised computer.
T1085Rundll32InvisiMole has used rundll32.exe as part of its execution chain.
T1064ScriptingInvisiMole’s loader uses a JavaScript script as a part of setting up persistence.
T1063Security Software DiscoveryInvisiMole’s DNS plugin avoids connecting to the C&C server if selected network sniffers are detected running.
T1099TimestompInvisiMole has modified timestamps of files that it creates or modifies.
T1036MasqueradingInvisiMole has attempted to disguise its droppers as legitimate software or documents, and to conceal itself by registering under a seemingly legitimate service name.
DiscoveryT1046Network Service ScanningInvisiMole has performed network scanning within the compromised network using its Portscan and BlueKeep components, in order to search for open ports and for hosts vulnerable to the BlueKeep vulnerability.
T1518Software DiscoveryInvisiMole’s DNS downloader attempts to detect selected network sniffer tools, and pauses its network traffic if any are detected running.
T1082System Information DiscoveryInvisiMole’s DNS downloader collects computer name and system volume serial number.
T1124System Time DiscoveryInvisiMole can collect the timestamp from the victim’s machine.
Lateral MovementT1210Exploitation of Remote ServicesInvisiMole has exploited EternalBlue and BlueKeep vulnerabilities for lateral movement.
T1080Taint Shared ContentInvisiMole has replaced legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.
Command and ControlT1043Commonly Used PortInvisiMole’s downloader uses port 443 for C&C communication. InvisiMole’s DNS plugin uses port 53 for C&C communication.
T1090Connection ProxyInvisiMole’s TCP downloader is able to utilize user-configured proxy servers for C&C communication.
T1024Custom Cryptographic ProtocolInvisiMole’s TCP and DNS downloaders use a custom cryptographic protocol for encrypting network communication.
T1132Data EncodingInvisiMole’s DNS downloader uses a variation of base32 encoding to encode data into the subdomain in its requests.
T1008Fallback ChannelsInvisiMole’s TCP and DNS downloaders are configured with several C&C servers.
T1105Remote File CopyInvisiMole’s TCP and DNS downloaders can download additional files to be executed on the compromised system.
T1071Standard Application Layer ProtocolInvisiMole’s DNS downloader uses DNS protocol for C&C communication.
T1095Standard Non-Application Layer ProtocolInvisiMole’s TCP downloader uses TCP protocol for C&C communication.
T1065Uncommonly Used PortInvisiMole’s TCP downloader uses port 1922 for C&C communication.

RC2CL backdoor

TacticIDNameDescription
ExecutionT1059Command-Line InterfaceRC2CL backdoor can create a remote shell to execute commands.
T1106Execution through APIRC2CL backdoor uses CreateProcess and CreateProcessAsUser APIs to execute files.
Privilege EscalationT1134Access Token ManipulationRC2CL backdoor can use CreateProcessAsUser API to start a new process under the context of another user or process.
T1088Bypass User Account ControlRC2CL backdoor can disable and bypass UAC to obtain elevated privileges.
Defense EvasionT1090Connection ProxyRC2CL backdoor can be configured as a proxy relaying communication between other compromised computers and C&C server.
T1140Deobfuscate/Decode Files or InformationRC2CL backdoor decrypts strings using variations of XOR cipher.
T1089Disabling Security ToolsRC2CL backdoor is able to disable Windows firewall.
T1107File DeletionRC2CL backdoor can delete dropped artifacts, and various files on-demand following a delete command.
RC2CL backdoor can safely delete files to thwart forensic analysis.
T1112Modify RegistryRC2CL backdoor hides its configuration within registry keys.
T1027Obfuscated Files or InformationRC2CL backdoor obfuscates/encrypts strings and code to make analysis more difficult.
T1099TimestompRC2CL backdoor modifies timestamps of files that it creates/modifies.
T1497Virtualization/Sandbox EvasionRC2CL backdoor is able to detect virtualized environments.
DiscoveryT1087Account DiscoveryRC2CL backdoor can list account information and session information.
T1010Application Window DiscoveryRC2CL backdoor can list information about active windows.
T1083File and Directory DiscoveryRC2CL backdoor can list files, and specifically recently opened files, and list information about mapped/unmapped drives.
T1046Network Service ScanningRC2CL backdoor is able to scan the compromised network for hosts vulnerable to EternalBlue vulnerability.
T1057Process DiscoveryRC2CL backdoor can list running processes.
T1012Query RegistryRC2CL backdoor can query registry to obtain information about installed software, applications accessed by users, applications executed on user login/system start, recently opened files,
T1063Security Software DiscoveryRC2CL backdoor modifies its behavior if Bitdefender firewall is enabled, or if selected AV processes are detected running.
T1518Software DiscoveryRC2CL backdoor can list installed software, recently accessed software by users, software executed on each user login and/or each system start.
T1082System Information DiscoveryRC2CL backdoor can list information about loaded drivers, computer name, OS version, memory status, local time, system and process DEP policy.
T1016System Network Configuration DiscoveryRC2CL backdoor can list IP table; configured proxy information; information about enabled wireless networks for geolocation of the victims.
T1007System Service DiscoveryRC2CL backdoor can list system service information.
CollectionT1123Audio CaptureRC2CL backdoor can record the sounds from microphones on a computer. RC2FM misuses a legitimate lame.dll for MP3 encoding of the recordings.
T1005Data from Local SystemRC2CL backdoor can collect data from the system, and can monitor changes in specified directories.
T1074Data StagedRC2CL backdoor can store collected data in a central location for a later exfiltration.
T1113Screen CaptureRC2CL backdoor can capture screenshots of the victim’s screen. RC2CL backdoor can also capture screenshots of separate windows.
T1125Video CaptureRC2CL backdoor can access victim’s webcam and capture photos/record videos.
Command and ControlT1008Fallback ChannelsRC2CL backdoor is configured with several C&C servers. Via a backdoor command, it is possible to extend the list and change which C&C server is used.
T1105Remote File CopyInvisiMole can download additional files to be executed on the compromised system.
T1065Uncommonly Used PortRC2CL backdoor uses port 1922 for C&C communication.
ExfiltrationT1002Data CompressedRC2CL backdoor can create zlib and SFX archives. It misuses a copy of the legitimate WinRAR tool for compression and decompression.
T1022Data EncryptedRC2CL backdoor uses variations of XOR cipher to encrypt data.
T1041Exfiltration Over Command and Control ChannelRC2CL backdoor exfiltrates collected information over its C&C channel.

RC2FM backdoor

TacticIDNameDescription
ExecutionT1059Command-Line InterfaceRC2FM backdoor can create a remote shell to execute commands.
T1106Execution through APIRC2FM backdoor supports a command that uses ShellExecute and CreateProcess APIs to execute files.
Privilege EscalationT1088Bypass User Account ControlRC2FM backdoor can bypass UAC to obtain elevated privileges.
Defense EvasionT1140Deobfuscate/Decode Files or InformationRC2FM backdoor decrypts strings using variations of XOR cipher.
T1107File DeletionRC2FM backdoor can delete dropped artifacts, and various files on-demand following a delete command.
T1143Hidden WindowRC2FM backdoor uses CREATE_NO_WINDOW creation flag to execute malware in a hidden window.
T1112Modify RegistryRC2FM backdoor hides its configuration within registry keys.
T1027Obfuscated Files or InformationRC2FM backdoor obfuscates/encrypts strings and code to make analysis more difficult.
T1055Process InjectionRC2FM backdoor can inject itself into ctfmon.exe , dwm.exe , sihost.exe and taskhost.exe processes.
T1085Rundll32RC2FM backdoor uses rundll32.exe to load a stub DLL into which it then injects itself.
T1099TimestampRC2FM backdoor modifies timestamps of files that it creates/modifies.
T1497Virtualization/Sandbox EvasionRC2FM backdoor is able to detect virtualized environments.
DiscoveryT1083File and Directory DiscoveryRC2FM backdoor collects information about mapped drives. It can list files in a specific folder.
T1135Network Share DiscoveryRC2FM backdoor can list connected network shares.
T1057Process DiscoveryRC2FM backdoor can list running processes.
T1082System Information DiscoveryRC2FM backdoor collects computer name and system volume serial number.
T1016System Network Configuration DiscoveryRC2FM backdoor lists information about configured proxy servers.
CollectionT1123Audio CaptureRC2FM backdoor can record the sounds from microphones on a computer. It misuses a legitimate lame.dll for MP3 encoding of the recordings.
T1025Data from Removable MediaRC2FM backdoor can collect jpeg files from connected MTP devices.
T1056Input CaptureRC2FM backdoor can collect keystrokes.
T1113Screen CaptureRC2FM backdoor can capture screenshots of the victim’s screen.
Command and ControlT1043Commonly Used PortRC2FM backdoor uses port 80 for C&C communication.
T1090Connection ProxyRC2FM backdoor can use proxies configured on the local system, for various installed and portable browsers, if direct connection to the C&C server fails.
T1008Fallback ChannelsRC2FM backdoor is configured with several C&C servers. It is possible to update the C&C server by a backdoor command.
T1105Remote File CopyInvisiMole can download additional files to be executed on the compromised system.
T1071Standard Application Layer ProtocolRC2FM backdoor uses HTTP for C&C communication.
ExfiltrationT1022Data EncryptedRC2FM backdoor uses variations of XOR cipher to encrypt data.
T1041Exfiltration Over Command and Control ChannelRC2FM backdoor exfiltrates collected information over its C&C channel.

Newsletter

Discussion