### Security # Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo www.bitdefender.com ----- ## Contents Executive Summary.................................................................................................................................................. 3 Key Findings:............................................................................................................................................................. 3 Analyzing Foudre and Tonnerre............................................................................................................................... 3 2d459929135993959cacceb0dd81a813 – doc analysis..........................................................................................................3 491786aa4bc9d1f09b9c793b21e80073 (Program Office2019.exe) analysis......................................................................4 ## Contents cfee183cf4bbe22ecbdf0d73ff16e0fb – Foudre version 23......................................................................................................4 175bd76c33491d6b97731c8755ade093: Foudre’s next stage - Tonnere.............................................................................4 Command and Control servers for Tonnerre and Foudre......................................................................................9 Tonnerre sinkhole victims........................................................................................................................................ 9 IOCs.........................................................................................................................................................................10 Mitre Matrix TTPs...................................................................................................................................................11 **Author:** ----- Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo ## Executive Summary Bitdefender researchers recently investigated the decade-old Foudre (French for “lightning”) APT that now uses a new component named “Tonnerre” (French for [“thunder”). First investigated in May 2016, the Foudre](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) malware is allegedly of Iranian origin and traditionally targets both government and the private sector. Our investigation also revealed that the C&C infrastructure is still active and that there are victims phoning back home. It’s safe to speculate that this particular Iranian APT is still operational despite flying under the radar in recent years. ## Key Findings: The investigation started from a sample submitted for analysis to our researchers . Once unpacked, the archive contained both a document and a binary, both installing a backdoor into the compromised machine. Since the backdoor is designed to work on x86 and x64 Windows machines, threat actors were likely betting that victims would download and open the archive. Apart from some improvements in the Foudre backdoor involving C&C communication and forensic investigation resilience tactics, the APT group also used a secondstage payload named Tonnerre. This second component has several functionalities, ranging from persistence to data exfiltration. This could allow attackers to take screenshots, collect recent files and documents with specific extensions, and even record audio using the system’s microphone before uploading that data to the attacker-controlled C&C. In this recent investigation, Bitdefender security researchers focused on dissecting the malicious payloads and investigating their capabilities. - Decade-old Iranian APT still has active C&C infrastructure - New C&C communication capabilities for “Foudre” APT malware - “Tonnerre” component used for persistence, surveillance and data exfiltration - New TLDs for Tonnerre C&C infrastructure ## Analyzing Foudre and Tonnerre We were able to analyze the content of one of the zip files: Zip file: .لئاسرلا اورظتناzip ``` 9c1982c30c5ac019417072eb6827de07 ``` It contains 2 files, a Word document and an executable: لئاسرلا اورظتنا.doc: ``` 2d459929135993959cacceb0dd81a813 ``` Program Office2019.exe: ``` 491786aa4bc9d1f09b9c793b21e80073 ``` Both the document and the “Program Office2019” executable install the Foudre (version 23) backdoor on the system, so the attacker uses two tactics to trick the victim to install the malware. #### 2d459929135993959cacceb0dd81a813 – doc analysis The malicious document contains macros and an embedded rar sfx executable. When opened, the macros will run and will execute the embedded exe. ``` d01bcca6255a4f062fc59a014f407532– rar sfx that ``` contains, among some images:  d569de7d83936cb961a949b8bdcfa3f1– “conf3616.dll”  cfee183cf4bbe22ecbdf0d73ff16e0fb– “d530” ----- Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo “conf3616.dll” is a dll responsible for installing the Foudre backdoor (“d530”). It is similar to the one described by [Tencent in a blog post from November 2020 (https://cloud.tencent.com/developer/article/1738806). The rar sfx exe](https://cloud.tencent.com/developer/article/1738806) executes the installer dll like this: Silent=1 Overwrite=2 Update=U Path=%temp%\tmp5699 Setup=rundll32.exe conf3616.dll f8755 d530 #### 491786aa4bc9d1f09b9c793b21e80073 (Program Office2019.exe) analysis The sample is a RAR SFX self-extracting installer that contains 2 dlls and a jpg:  `827626def03076264c7948d47452e725– “conf3803.dll”`  `cfee183cf4bbe22ecbdf0d73ff16e0fb– “d288”`  `4bcdc131621953f3c0a58fe0e0c812f6- “Digi-Swirls.jpg”` This rar sfx exe is similar to the one in the document. Its role is to install the Foudre backdoor on the system using the installer dll: Silent=1 Overwrite=2 Update=U Path=%temp%\tmp764 Setup=rundll32.exe conf3803.dll f8755 d288 Both the document and the executable installs the same variant of Foudre version 23: ``` cfee183cf4bbe22ecbdf0d73ff16e0fb. #### cfee183cf4bbe22ecbdf0d73ff16e0fb – Foudre version 23 ``` The sample is very similar to versions 21/22 described in Tencent’s blog post, sharing the same domain generating algorithm (DGA). As mentioned by Tencent, the Foudre backdoor records keystrokes and sends keylogs to the C2, but also downloads the next stage, which is deployed to high-value victims. #### 175bd76c33491d6b97731c8755ade093: Foudre’s next stage - Tonnere [The next stage downloaded by Foudre seems to be a variant of Infy M described by Palo Alto in 2016 (https://unit42.](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) [paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/). As they said, this variant of](https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/) Infy is sent only to high-value victims. Even if they share many functionalities, this sample has a DGA, similar to the Foudre variant of Infy found by Palo Alto in 2017. Also similar to the Foudre backdoor, we observed that the malware creates a window named “tonnere,” so it’s safe to name the malware Tonnere. The analyzed sample is Tonnere v11. This malware seems to have been used since 2017, as we found a Tonnere v1 sample that has the compilation timestamp 2017-01-04 15:38:26. The compilation timestamp for v11 we analyzed is 2019-06-20 16:51:34. #### Detailed analysis The malware is a rar sfx password-protected exe, downloaded and executed by the initial Foudre backdoor. The password (“RBA4b5a98Q”) is hardcoded in the Foudre backdoor and sent as a command line parameter when it executes Tonnere. The command line also contains the “/set” parameter, telling Tonnere to add persistence. The rar archive contains an executable and a certificate used to validate the CNC’s responses. #### dedbec01f4d61c65b24425b6039038f2 – Tonnere v11 The exe found in the archive is a Delphi executable that has 5 graphical forms, each one with a specific functionality: - Form 1: Deals with persistence and initialization of the malwarei ----- Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo - Form 3: Implements a ftp client that receives commands from the ftp server and executes them - Form 4: Seems to not be used, its functionality being implemented in Form2 - Form 5: The role of this form is to record audio using the system’s microphone, but this functionality seems to be disabled by default Each of these forms will be described below. ##### Form1: This form initializes various strings used by the malware and parses the command line and adds persistence, depending on the parameters - The malware can receive 2 possible parameters: - /set: it installs the malware in programdata/Synaptics/and executes it with the -ex parameter - Persistence: Scheduled Task; in case it can’t add a scheduled task, as backup it adds a registers run key - It also receives a crc code as a parameters; It gets the machine GUID (SOFTWARE\Microsoft\ Cryptography\MachineGuid), it applies a CRC32s hash on it and compares the crc with the one provided as parameter; If it doesn’t match, it stops execution - Generates a random directory in %programdata%/Synaptics/ - Saves the random directory name in registers, in HKEY_CURRENT_USER, L”Software\\temp”, L”tran1”; it also adds the string “TNIV33M” in the global atom table to know that the malware was installed; on further runs, it will check for “TNIV33M” and if found, will get the directory name from the registers - Copies itself as “helper.exe” and the public.cer in that directory - Runs the exe using the “-ex” command line parameters - -ex : executes the malware - It checks for the crc to match and also checks if the malware runs from a path that contains “synaptics” (lower case) - Inits strings used by the malware ##### Form2: - The role of this form is to make screenshots, collect various files and communicate with the cnc - There are 2 main functions: Init, Timer - The initialization function: - Sets a timer for the (Timer) function that collects files (detailed below) and communicates with the cnc - Creates the base folder for the collected files: - %programdata%/Synaptics/G directory if “dfserv.exe” is not found running on the system (dfserv. exeseems to be a component of Deep Freeze software) - “D:\dfserv\”or “E:\dfserv” if “dfserv.exe” is found running on the system and such a fixed drive exists - 5 other folders are created in the base folder: - S - used to store the screenshots - R - used to store the files found in %AppData%\Microsoft\Windows\Recent\ - F - seems to be used to store files collected from system’s drives, but that functionality seems to be disabled - H - used to store various collected files (described below) - V - used to store microphone recordings - Creates a file “clist.dat” that keeps the list of the collected files; the file locations is as follows: - %programdata%if “dfserv.exe” is not running ----- Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo - Creates a password used to compress the collected files: - If “public.cer” can be found in the malware folder, the archive password is random and is encrypted with the public key - Else, a hardcoded password is used: “1v-kQCh5eiBiSzKyE_HCQ” - The Init function also creates a function that monitors for new/modified files in %AppData%\Microsoft\ Windows\Recent\ - The collected files are archived and the archive is saved in the “R” folder - It collects files of sizes between 1 byte and 8mb - Clarification: - Before being saved in its corresponding folder (as detailed above), each file is compressed with FlexCompress (.fxc format) and the archive is password protected; - At the end of each archive is appended the following hex encoded data: - or (“Error” if the default hardcoded password was used) - - - - -- hardcoded to “fdir1” - -- from SOFTWARE\Microsoft\Cryptography\MachineGuid - - There is one archive for one file, each file is compressed individually and the above data is appended to the archive - The timer function: - Collects files measuring between 1 byte and 8mb from the current user’s: - Documents folder - Desktop folder - Download folder - Contacts folder - Pictures folder - Logical drives (DRIVE_FIXED, DRIVE_RAMDISK, DRIVE_REMOVABLE, DRIVE_REMOTE) - It looks only in these folders:  $recycle.bin  documents and settings  msocache  program files  program files (x86)  programdata  recovery  system volume information  users  windows  boot  inetpub  i386  appdata  temporary internet files  appdata\local\microsoft  $windows.~bt  `d877f783d5d3ef8c`  all users  wp-content\uploads k d ----- Iranian APT Makes a Comeback with “Thunder and Lightning” Backdoor and Espionage Combo - It looks only in same folders as for logical drives - Mentions:  It only collect files with the following extensions: .doc, .docx, .xls, .xlsx, .xlr, .pps, .ppt, .pptx, .mdb, .accdb, .db, .dbf, .sql, .jpg, .jpeg, .psd, .tif, .png, .txt, .text, .rtf, .odt, .htm, .html, .pdf, .wps, .one, .contact, .csv, .nbu, .vcf, .pst, .msg, .ost, .zip, .rar, .7z, .zipx, .pgp, .tc, .vhd, .p12, .crt, .pem, .key, .pfx, .asc, .cer, .p7b, .sst  “d877f783d5d3ef8c” is a directory used by Telegram - The files collected are archived (one archive per file) and the archives are saved in the “H” folder - The “clist.dat” file mentioned previously keeps information about the collected files - Each line has this format: -- - The malware ensures that a file is exfiltrated only once using this file; if a file metadata (like above) already appears in “clist.dat”, the file is skipped - The timer function is also responsible for communicating with the CNC, starting a thread that: - [Makes some dummy requests to http://www.msn.com to check if the system is connected to the internet and a](http://www.msn.com/) proxy is used - Then, a DGA is used to get a responsive cnc; the DGA is similar to the Foudre’s DGA, but it uses other TLDs: = hex(crc(“NITV1” + year + week_number)) firstCNC = .site if firstCNC is not responding: [ = make request to https://www.france24.com/en/rss and get the last build](https://www.france24.com/en/rss) date () -- usually is the date of current day = “NITV1” + .year + .month + .current_week = hex(crc32()) cnc = .site if cnc is not responding: for i = 1, i <= 100; i++: = hex(crc( + str(i))) if any of .site, .win, .com is re sponding, then that it will be used as cnc If none of above cncs responded: [ = md5(GET http://www.breakingnews.com/feeds/rss)](http://www.breakingnews.com/feeds/rss) if .host is not responding: [ = md5(GET http://www.platts.com/rssfeeddetail/metals)](http://www.platts.com/rssfeeddetail/metals) check if .com is responding - A GET request is made to http:////2016/?c=&u=&v=&f=&mi=&t= in order to download the next stage - has this format: “------” - The file is downloaded in %temp%/fttemp01.tmp - A GET request is made to http:////2017/?c=&u=&v=&f=&mi=&t= to download a signature used to verify the fresh downloaded next stage - The file is downloaded in %temp%/ftsdci32.tmp - All requests are using the following user agent: “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36” “2.187.193.169” “2.187.193.169” - Validates the next stage exe using the signature file and runs it with the following arguments: - -sp/set -pTtckjcAa54cE - Then it uploads each collected archive measuring at least 100 bytes and maximum 8mb to the cnc: A POST request is made to http:///blog/?