# WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware **[sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/](https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/)** Joey Chen **By Joey Chen and Amitai Ben Shushan Ehrlich, with additional insights from QGroup** ## Executive Summary A new threat cluster we track as WIP19 has been targeting telecommunications and IT service providers in the Middle East and Asia. We assess it is highly likely this activity is espionage-related and that WIP19 is a Chinese-speaking threat group. The threat cluster has some overlap with Operation Shadow Force but utilizes new malware and techniques. WIP19 utilizes a legitimate, stolen certificate to sign novel malware, including SQLMaggie, ScreenCap and a credential dumper. ## Overview SentinelLabs has been monitoring a threat cluster we track as WIP19, a group characterized by the usage of a legitimate, stolen digital certificate issued by a company called “DEEPSoft”. Based on our investigations, WIP19 has been targeting telecommunications and IT service providers in the Middle East and Asia. ----- Throughout this activity, the threat actor abused the certificate to sign several malicious components. Almost all operations performed by the threat actor were completed in a “hands-on keyboard” fashion, during an interactive session with compromised machines. This meant the attacker gave up on a stable C2 channel in exchange for stealth. Our analysis of the backdoors utilized, in conjunction with pivoting on the certificate, suggest portions of the components used by WIP19 were authored by WinEggDrop, a well-known Chinese-speaking malware author who has created tools for a variety of groups and has been active since 2014. The use of WinEggDrop-authored malware, stolen certificates and correlating TTPs indicate [possible links to Operation Shadow Force, as reported by TrendMicro and](http://documents.trendmicro.com/assets/pdf/shadow-force-technical-brief.pdf) [AhnLab. As the](https://download.ahnlab.com/global/brochure/%5BAnalysis_Report%5DOperation_Shadow_Force(1).pdf) toolset itself appears to be shared among several actors, it is unclear whether this is a new iteration of operation “Shadow Force” or simply a different actor utilizing similar TTPs. The activity we observed, however, represents a more mature actor, utilizing new malware and techniques. [We linked an implant dubbed “SQLMaggie”, recently described by DCSO CyTec, to this set](https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01) of activity. SQLMaggie appears to be actively maintained and provides insights into the development timeline with hardcoded version names. In addition, we identified a number of other pieces of malware utilized by this threat actor. This report focuses on detailing the set of activity we track as WIP19 and provides further context around the usage of these new tools. ----- Relationship between the malware, certificates, and creators ## Abusing Valid Digital Certificates WIP19 has been observed signing malware with a valid digital certificate issued for DEEPSoft Co., Ltd., a Korean company specializing in messaging solutions. The threat actor used the certificate to sign several malware components, some of which were tailor-made for specific targets. We assess that it is highly likely the certificate was stolen, as it was also used to sign legitimate software used by DEEPSoft in the past. ----- DEEPSoft digital certificate Activity involving toolsets authored by WingEggDrop and signed with both legitimate and [fake certificates has been previously reported on by AhnLab. It’s commonly understood that](https://download.ahnlab.com/global/brochure/%5BAnalysis_Report%5DOperation_Shadow_Force(1).pdf) malware created by WinEggDrop is shared among several threat clusters, making it possible that these associated toolsets could also be in use by the WIP19 threat actor. ## Dumper Analysis Like many components utilized by WIP19, all their credential harvesting tools – consisting mainly of password dumpers – were signed using the DEEPSoft certificate. The main dumper used by the threat actor utilized open source projects to load an SSP to LSASS and then dump the process. WIP19’s password dumper consists of two components, one used as a loader, and the other as a dumper. On many of the instances observed, the dumper was executed using WMIEXEC. ### Loader Analysis ----- The dumper loader component is a signed EXE file, internally dubbed `ssp_rpc_loader, as` indicated from the PDB path embedded within the file. As the name suggests, the loader uses RPC to load a malicious DLL file as an SSP (Security Support Provider), given as an [argument. The loader appears to be taken from an open source project available on GitHub.](https://github.com/jas502n/mimikat_ssp) ``` D:\source\dump_lsass-main\ssp_rpc_loader\x64\Release\ssp_rpc_loader.pdb ### SSP Analysis ``` [The actual SSP loaded is NanoDump, which is loaded into LSASS and creates a minidump](https://github.com/helpsystems/nanodump) of the process. Loading NanoDump as an SSP is a built-in function embedded within [NanoDump. This is done utilizing the MiniDumpWriteDump API. The dump will be created in](https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump) the following path: ``` C:\\windows\\temp\\1.bin ``` Much like the loader, the threat actor did not bother to remove the PDB path for the DLL dumper. ``` D:\source\dump_lsass-main\dll1\x64\release\dll1.pdb ``` Combining both components, a full execution of the dumper will look like this: ``` C:\attacker\loader.exe c:\attacker\ssp.dll ## Keylogger & Screen Recording (ScreenCap) ### Loading Mechanism ``` [WIP19 has been observed utilizing a less-common (although documented) DLL search order](https://www.elastic.co/cn/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process) hijacking of `explorer.exe to load a keylogging and screen recording component internally` named `ScreenCapDll_x64 .` The keylogging and screen recording components ----- The threat actor dropped the malicious, signed DLL, in the path ``` c:\windows\linkinfo.dll . Dropping the file in this specific path triggers the loading of ``` the DLL into `explorer.exe the next time it is executed. The threat actor may manually kill` and restart the `explorer.exe process to initiate the screen recording and keylogging` functionality. The ScreenCap malware performs checks involving the victim’s machine name, indicating it is specially crafted for each deployment. This does not prevent the actor from re-signing each of the payloads with the DEEPSoft certificate, proving the actors have direct access to the stolen certificate. After verifying it is executed on the correct machine, the ScreenCap malware drops a RAR CLI binary in one of the following paths, according to the target’s operating system: ``` C:\Documents and Settings\All Users\Application Data\dwmgr.exe C:\Users\Public\AppData\MsTemp\dwmgr.exe ``` RAR executable drop file path ### Keylogging The keylogging functionality mainly focuses on the user’s browser. The malware detects the user’s browser and logs all keystrokes to `.ax files stored in its current working directory. By` default, it will keylog Internet Explorer activity, but it also supports keylogging of other popular browsers including Chrome and Opera. ----- Keylogger drop file path and the browser it targets ### Screen Recording A relatively unique TTP observed in this activity is the recording of the user’s screen. Much like keylogging, this helps the actor harvest credentials and access sensitive information. The malware will record the screen for 1,296,000 milliseconds at a time, 30 times, and store the output as `.avi files in its current working directory.` Using Windows Multimedia (vfw.h) to record the user’s screen During our analysis of the ScreenCap malware, we identified a number of samples that contained hardcoded victim IDs. This indicates that some of the intrusions are well researched and highly targeted. ----- Hardcoded victim host identity number “DESKTOP-xxxxxxx ## ExtendedProcedure SQL (SQLMaggie) Whilst we did not observe the initial infection vector in this intrusion, the SQLmaggie malware dropped on victim networks targets Windows systems and has to be executed in an MSSQL server. This provided us a foundation from which to investigate further. We found that SQLMaggie masquerades as a legitimate DLL containing extended stored procedure functions for an MSSQL Server. The [executed methodology uses the](https://docs.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server?view=sql-server-ver16) ``` sp_addextendedproc function to register an external DLL in a MSSQL server. After ``` registering the DLL into the MSSQL server, the threat actor is able to fully control the server machine and use this backdoor to conduct reconnaissance in the internal network. For instance: ``` sp_addextendedproc 'malicious', 'c:\Program Files\Microsoft SQL Server\MSSQL13.0.MSSQLSERVER\MSSQL\Binn\malicious.dll'; ``` Reproduced SQLMaggie backdoor command Our analysis showed that this backdoor was authored by WinEggDrop. From the timestamp of the sample, we can confirm the first version of this backdoor variant was developed in or before 2019. Available commands in each version vary according to the target environment. Unlike some of the other components which can be found on public, open-source repositories, neither the source code nor the executable for SQLMaggie appear to be publicly available. This suggests that the tool is either sold or used privately, or is in exclusive use by WinEggDrop. ----- The author’s purported signature in SQLMaggie Below we detail SQLMaggie backdoor commands and capabilities. The following commands appear in all versions of SQLMaggie. **Command** **Description** SysInfo Show system information and detected is it in the VM or not FileAccess Modify file permissions ls List DIR Exec Create process RShell Reverse Shell Type Open file and print the strings inside Download Download files Additionally, the following commands appear variously in different versions of SQLMaggie coded for specific targets. **Command** **Description** StopSocks5 Stop Socks5 tunnel stopped StartHook Start WinSock socket hook StopHook Stop Winsock socket Hook ResetClientData Attacker input information ViewClientData Show client data, attacker input information TS Checking regkey about TermService and its port ListIP Get host name, IP ----- CheckPath Get data path StartSocks5 Create Socks5 tunnel SetClient Set client data, include hook winsock and allow ip, port InstallTS Install TermService DelFile Delete file SetFile Set file attributes GetUser Using ROOT\\CIMV2 to get host account GetModule Print out the execute module file path ScanStatus Scan the victim’s environment machines StopScan Terminate all scan threads GetAdmin Get domain admin account SqlCheck Check SQL server is running and list username & password SqlScan Create a thread to scan for SQL server Exploit Run Use exploit to execute process Exploit AddUser Use exploit to add user Exploit Clone Use exploit to clone user Exploit TS Use exploit to install TermService on a machine StartHook Hook WinSock socket and show client data, attacker input information Port Check if port is open WriteAll MSSQLServer Write permission AccessAll MSSQLServer Access permission ## Attribution Analysis We assess it is highly likely this activity is espionage-related and that WIP19 is a Chinesespeaking threat group. The Work-In-Progress (WIPxx) designation is used for unattributed clusters of activity. A WIP may represent activity that fits under the umbrella of an existing – but thus far unknown – actor or ultimately represent the activity of a new threat actor. ----- The intrusions we have observed involved precision targeting and were low in volume. Specific user machines were hardcoded as identifiers in the malware deployed, and the malware was not widely proliferated. Further, the targeting of telecommunications and IT service providers in the Middle East and Asia suggest the motive behind this activity is espionage-related. Communications providers are frequent targets of espionage activity due to the kinds and amount of sensitive data they hold. The overlap with Operation Shadow Force through a possible common developer in WinEggDrop, and the fact their tooling has been observed in other Chinese espionagerelated activity, supports the assessment that this activity is likely being carried out by a thus far unidentified Chinese-speaking threat group. The hardcoding of machine identifiers and the usage of malware to log keystrokes and screenshot specific user machines, suggests that WIP19 is after very specific information. ## Conclusion WIP19 is an example of the greater breadth of Chinese espionage activity experienced in critical infrastructure industries. The existence of reliable quartermasters and common developers enables a landscape of hard-to-identify threat groups that are using similar tooling, making threat clusters difficult to distinguish from the defenders point of view. We hope this report helps move the needle forward in the effort to continue identifying threat groups engaged in spying on industries critical to society. SentinelLabs continues to track this activity to provide further insight into their evolution and future activity. ## Indicators of Compromise **SQLMaggie SHA1** **Real File Name** 4AABB34B447758A2C676D8AD49338C9E0F74A330 sqlmaggieAntivirus_32.dll 5796068CFD79FBA65394114BA0EDC8CC93EAE151 sqlmaggieVS2008new_64.dll 13BA1CFD66197B69A0519686C23BDEF17955C52E sqlmaggieVS2008new_32.dll CA25FCBA11B3B42D9E637132B5753C9B708BE6F0 sqlmaggieVS2008new_64.dll 26cbd3588b10cabc7c63492c82808104829e9ac0 sqlmaggieAntiVirus_64.dll 5e0291928e29db46386fd0bd85f269e967758897 sqlmaggieVS2008new_64.dll 96099015981559237a52a7d50a07143870728fd0 sqlmaggieAntiVirus_64.dll 7eb6e7d4e5bd5a34c602879cad0a26b35a3ca4fb sqlmaggieVS2008new_32.dll ----- fe2e7c663913e0744822d1469be0c3655d24178d sqlmaggieAntivirus_32.dll b15bae6a8379a951582fc7767fa8490722af6762 sqlmaggieAntiVirus_64.dll c81de9a27f7e8890d30bd9f7ec0f705029b74170 sql_epX64_MD.dll 829df7b229220c56eedc5660e8f0e7f366fa271f sqlmaggieAntivirus_32.dll d02fce5d87ea1fe9fabe7ac52cae2439e8215121 sqlmaggieAntivirus_32.dll 1c6d0e8920af9139a8a9fe3d60b15cf01fb85461 sqlmaggieAntiVirus_64.dll 2cad0328863cb09a6b27414d5158075d69bfb387 sqlmaggieAntiVirus_64.dll 26c0722a1d16641d85b97594deea2a65399daef7 sqlbackupAntiVirus_64.dll 17ff9fc9ee72baaf8d66ef9b3ab6411c47384968 sqlmaggieAntiVirus_64.dll 5be50453f6e941c5c1dd20e0ba53e9abb6d00b68 sqlmaggieVS2008new_32.dll 56d326dfe7dcb1ce7cae2cb4c13819510fc9945c sqlmaggieAntiVirus_64.dll 253e702ff8201eec6fdf9630a39f5a8c28b132ed xp_OAreateX64.dll b91ab391a4e26e4ff0717cd989ad5ce7f6af235c xp_OAreateX64.dll 4d2eb6e03be068f364e8e3f3c9645e03e1052e66 xp_OAreate.dll b91ab391a4e26e4ff0717cd989ad5ce7f6af235c xp_OAreateX64.dll 4d2eb6e03be068f364e8e3f3c9645e03e1052e66 xp_OAreate.dll 8941d889cb199a234d99c90ce78a96411b6dedb6 sqlmaggieAntivirus_32.dll 5aa9a9299865b0cb81fcad5f42424d79c67c403b sqlmaggieVS2008new_64.dll 5182e0a5f075317171ad0e01e52d32937ec2fa01 sqlmaggieVS2008new_64.dll bfccf57e173b8233d35928956022bae85fc5d722 sqlmaggieAntiVirus_64.dll 18d3ac848955295381f769b923a86871e01bfa1c sqlmaggieVS2008new_64.dll 2bf1b6163af5685824c2d7ecda4f3f65f3ca4723 sqlmaggieAntiVirus_64.dll 9577a2c15494edc2f7f4a59ecfb3ee90dd1df9d7 sqlmaggieAntiVirus_64.dll 32e96ef4754c8f357e2366078387750e7f6add43 sqlmaggieAntiVirus_64.dll 11678237dfccc88f257acca2b66b578713deaca8 sqlmaggieVS2008new_64.dll 327bedce44160ebccc7d465c673d3464e23292b9 sqlmaggieVS2008new_32.dll ----- 7d58e51aee7da91dc93025854712cee47ed03101 sqldoorVS2005_64.dll 4a6cf3d5b005e97ef6f2be09f8ab19c2755cae39 sqlmaggieAntiVirus_64.dll f37d9ce547894ab5449e5632188a3a3bb9e91fed sqlbackupAntiVirus_64.dll a347aaf152d8ddcd299d86d7839d4ffa369ef2ef sqlmaggieVS2008new_32.dll f2c64108cb670e82908e5f41c58f1aab97ee7786 sqlmaggieVS2008new_64.dll a34bda87bd253eda794462c20074baed19e1c01c sqlmaggieAntiVirus_64.dll df1a7c13a3ec612a10819353ba0d34348a404bc8 sqlmaggieAntiVirus_64.dll b3249b6f05eeeb2cf5f74931aa990fbc92027b54 sqlmaggieAntiVirus_64.dll d3eeb9db89f0b21dc945f5410be9a9532e0c951e sqlmaggieAntiVirus_64.dll **ScreenCap SHA1** **Real File Name** c6cb7ec82ee55ccb56a4cc8b91c64e9b4f4e14da ScreenCapDll_x64.dll 19f2a546a76458dda6eab6e2fae07d0942759b84 ScreenCapDll_x64.dll 693e4ed784279bc47a013dc56f87cbd103e1db2e x ad72aa442ff2c357b48ae8b4f8ba9b04b63c698b ScreenCapDll.dll **Hacking Tool SHA1** **Description** da876cd6e3528f95aafb158713d3b21db5fc780b Browser credential stealer 1121324a15e6714e4313dfa18c8b03a6da381ba1 Credential dumper loader 9bedb5810536879fae95c70a918eb90ac628953e Network scanning tool 539d87139de6d5136b6d45dbc33a1aae69926eee Credential dumper afe25455804a7afb7639cb4e356cb089105be82d Port relay tool 37cca724227a8e77671ecde3d295f5b98531705b Credential dumper loader 2eeb46d538c486f8591a78a65dde250b0bf62f89 Windows domain tool -----