{"id":818,"date":"2017-05-15T21:20:47","date_gmt":"2017-05-15T20:20:47","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=818"},"modified":"2017-05-17T09:49:10","modified_gmt":"2017-05-17T08:49:10","slug":"2017-05-15-adwindjrat-rat-from-malspam","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=818","title":{"rendered":"2017-05-15 Adwind\/JRAT RAT from MalSpam"},"content":{"rendered":"

Trolling through the email filters today I came across this nugget. From what I can tell this looks to be related to the Adwind\/JRat family of malware. This particular RAT was found in an email that is in Turkish. Kaspersky has a quick write-up about this RAT which you can find here<\/a>. As usual, you can find the artifacts from this investigation over in the Github repo here<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

The Google translation of the email states the following: <\/p>\n

Subject:
\nCould you take a look at all your orders?<\/p>\n

Body of email:
\nCould you take a look at all your orders? Hello, our orders are enclosed, please check.<\/p>\n

Indicators of Compromise:
\n=========================
\nguvencingiller[.]com \/ 188[.]165.206[.]163 (DNS)
\n188[.]165.206[.]163 (TCP – 54264)<\/p>\n

Artifacts:
\n==========
\nFilename: siparis.pub
\nFile size: 169KB
\nMD5: 22f89a3c797d070bff3c5d89553d3e5e
\nVirustoal:
\nDetection ratio: 19 \/ 56
\nFirst submission: 2017-05-14 01:03:08 UTC
\nHybrid Analysis: http:\/\/www.hybrid-analysis.com\/sample\/1d205d034a5132b367e4fca0b3e67506c5c3952c7c3034c2a882e2b6be7b9d56?environmentId=100<\/a><\/p>\n

Filename: 1.jar
\nFile size: 63KB
\nFile path: C:\\Users\\%username%\\AppData\\Local\\Temp
\nMD5: fd0fdf29739daca8b186c9300507c035
\nVirustoal: NA
\nMalwr: NA
\nHybrid Analysis: NA<\/p>\n

Filename: Viw.jar
\nFile size: 63KB
\nFile path: C:\\Users\\Bill\\AppData\\Roaming\\One
\nMD5: fd0fdf29739daca8b186c9300507c035
\nVirustoal: NA
\nMalwr: NA
\nHybrid Analysis: NA<\/p>\n

Analysis of Malware:
\n====================
\nThis is a pretty simple infection chain. Once the user downloads and runs the Microsoft Publisher file called “siparis.pub,” they are greeted with the following screen:<\/p>\n

\"\"<\/a><\/p>\n

which translated means “File can not be opened.” In the back ground we can see that the Publisher file runs the macro which has the JAR file embedded in it, and proceeds, with the help of a CMD.exe process, to create the file called “1.jar” located in the “C:\\Users\\Bill\\AppData\\Local\\Temp” directory. We then see CMD.exe calling the Java executable (javaw.exe) so it can launch the malicious JAR file that was just written above (the 1.jar file). From there we can see that a couple of other events occur from this javaw.exe\/1.jar process (PID 2756):<\/p>\n

\t– An attempt to add a new registry key pointing to a new file called “Viw.jar” which ends up being denied: reg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \/v Gbd \/t REG_SZ \/d “\\”C:\\Program Files\\Java\\jre6\\bin\\javaw.exe\\” -jar \\”C:\\Users\\Bill\\AppData\\Roaming\\One\\Viw.jar\\”” \/f
\n\t– Attrib.exe is used to modify attributes of some newly created files\/directories:
\n\t\t— attrib +s +h +r “C:\\Users\\Bill\\AppData\\Roaming\\One\\*.*”
\n\t\t— attrib +s +h +r “C:\\Users\\Bill\\AppData\\Roaming\\One” <\/p>\n

***One thing to note here – since the java\/1.jar process has modified the file attributes of the directory “C:\\Users\\Bill\\AppData\\Roaming\\One\\*.*” and made this a system folder, the icon that shows up is of the Recycle Bin which also does not show any other files outside of what is in the Recycle Bin.<\/p>\n

\"\"<\/a><\/p>\n

Once the attributes are undone, the files in the “One” folder are visible and no longer the Recycle Bin.<\/p>\n

We also see a new instance of javaw.exe\/Viw.jar spin up as a child (PID 2804) to the above javaw.exe \/1.jar process (PID 2756) and proceed to run the same kind of activity as mentioned above:<\/p>\n

\t– Another attempt to add a registry key via reg.exe that gets denied: reg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \/v Gbd \/t REG_SZ \/d “\\”C:\\Program Files\\Java\\jre6\\bin\\javaw.exe\\” -jar \\”C:\\Users\\Bill\\AppData\\Roaming\\One\\Viw.jar\\”” \/f
\n\t– Last attempt to create persistence on the machine, this time using a different registry location which is successful: reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \/v Gbd \/t REG_SZ \/d “\\”C:\\Program Files\\Java\\jre6\\bin\\javaw.exe\\” -jar \\”C:\\Users\\Bill\\AppData\\Roaming\\One\\Viw.jar\\”” \/f
\n\t– Attrib.exe used to modify a folder that is also a hidden, system folder:
\n\t\t— attrib +H C:\\Users\\Bill\\.Kvq<\/p>\n

From the network perspective, once the system is infected, and the javaw.exe\/Viw.jar process is up and running, the only malicious traffic that I was able to find is a DNS request to the domain guvencingiller[.]com, and then nothing but SYN\/SYN-RST packets from various ports incrementing by 1 from the infected system to the 188.165.206.163 (what guvencingiller[.]com resolves to) on port 54264 as seen below.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Considering that the connection to that IP\/port pair was reset every time, I am thinking that this C2 has been killed off and this RAT is not fully functional at this time.<\/p>\n","protected":false},"excerpt":{"rendered":"

Trolling through the email filters today I came across this nugget. From what I can tell this looks to be related to the Adwind\/JRat family of malware. This particular RAT was found in an email that is in Turkish. Kaspersky has a quick write-up about this RAT which you can find here. As usual, you can find the artifacts from this investigation over in the Github repo here. The Google translation of the email states the following: Subject: Could you take a look at all your orders? Body of email: Could you take a look at all your orders? Hello,…<\/p>\n

Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-818","post","type-post","status-publish","format-standard","hentry","category-packet-analysis"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=818"}],"version-history":[{"count":6,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/818\/revisions"}],"predecessor-version":[{"id":829,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/818\/revisions\/829"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}