[FireEye]Targeted Attack Trend Alert: PlugX the Old Dog With a New Trick

[igor51]

Targeted Attack Trend Alert: PlugX the Old Dog With a New Trick

  FireEye Labs has
  discovered a targeted attack towards Chinese political rights
  activists. The targets appear to be members of social groups that are
  involved in the political rights movement in China. The email turned
  up after the attention received in Beijing during the 12th National
  People's Congress and the 12th National Committee of the Chinese
  People's Political Consultative Conference, which is the election of a
  new core of leadership of the Chinese government, to determine the
  future of China's five-year development plan [1].

 

The email contains a weaponized attachment that utilizes the Windows
  Office CVE-2012-0158 exploit to drop the benign payload components and
  decoy document. The Remote Access Tool (RAT) PlugX itself is known as
  a combination of benign files that build the malicious execution. The
  Microsoft file OInfoP11.exe also known as “Office Data Provider for
  WBEM” is a certified file found in the National Software Reference
  Library (NIST) and is a component from Microsoft Office 2003 suite.
  For integrity checking endpoint protection, this file would be deemed
  as a valid clean file. In Windows 7+ distributions, the svchost.exe
  will require user interaction by displaying a UAC prompt only if UAC
  is enabled. Although in Windows XP distributions, this attack does not
  require user interaction. The major problem is that this file is
  subject to DLL Sideloading. In previous cases, PlugX has been
  utilizing similar DLL Sideloading prone files such as a McAfee binary
  called mcvsmap.exe [2], Intel’s hkcmd.exe [3], and NVIDIA’s
  NvSmart.exe [4]. In this case, OInfoP11.exe loads a DLL file named
  OInfo11.ocx (payload loader posing as an ActiveX DLL) that
  decompresses and decrypts the malicious payload OInfo11.ISO. This
  technique can be used to evade endpoint security solution that relies
  on binary signing. Traditional anti-virus (AV) solutions will have a
  hard time to identify the encrypted and compressed payload. At the
  time of writing of this blog, there is only 1 out of 46 AV vendors can
  detect the OInfo11.ocx file.

 

The diagram in figure 1 shows the behavior and relationship of these files.

 

        src="/content/dam/legacy/blog/2013/05/5132013image001.png"
      alt="5132013image001"
      class="aligncenter size-full wp-image-2045 landscape-med"
      width="700" height="400" />Figure 1: Attack Diagram

 

  Infiltration

 

In Figure 2, the targeted email advertises a suffrage movement
  seminar event. Figure 3 is the contents of the Google document form
  link that contains the same information as in the email. In figure 4,
  the decoy document contains the details of the particular seminar
  section mentioned in the Google document link.

 

        src="/content/dam/legacy/blog/2013/05/5132013image003.png"
      alt="5132013image003"
      class="aligncenter size-full wp-image-2046 landscape-med"
      width="600" height="560" />

 

  Figure 2: Original Email

 

Below is the English translation of the email in figure 2.

 

        src="/content/dam/legacy/blog/2013/05/Li-Ping.jpg" alt="Li Ping"
      class="alignnone  wp-image-2164 landscape-sm" width="489" height="277" />

 

        src="/content/dam/legacy/blog/2013/05/5132013image005.png"
      alt="5132013image005"
      class="aligncenter size-full wp-image-2047 landscape-med"
      width="712" height="559" />Figure 3: Google Form

 

  Decoy Document

 

        src="/content/dam/legacy/blog/2013/05/5132013image007.png"
      alt="5132013image007"
      class="aligncenter size-full wp-image-2048 landscape-med"
      width="725" height="628" />Figure 4: Decoy Document

 

Below is the translation to the document shown above.

 

        src="/content/dam/legacy/blog/2013/05/The-seminar.jpg"
      alt="The seminar"
      class="alignnone size-full wp-image-2174 landscape-med"
      width="614" height="462" />

 

  Attack Analysis

 

The XLS file (1146fdd6b579ac7144ff575d4d4fa28d) utilizes the
  CVE-2012-1058 Windows Office exploit to drop the “ews.exe” payload and
  the decoy document shown in figure 4. This payload extracts the
  Microsoft file OINFOP11.exe, the benign DLL OInfo11.ocx and encoded
  and compressed shellcode sections from Oinfo11.ISO. OInfoP11.exe will
  load OInfo11.ocx as a DLL and once loaded will decompress using
  RTLDecompressBuffer and decrypt the Oinfo11.ISO to run in memory. The
  malicious execution is never dropped to the file-system and is
  therefore not seen by filesystem-based anti-virus detectors. Figure 5
  shows the high level view of the relationship of the dropped files.

 

        src="/content/dam/legacy/blog/2013/05/5132013BLOG2.png"
      alt="5132013BLOG2"
      class="aligncenter size-full wp-image-2188 landscape-med"
      width="700" height="175" />

 

  Figure 5: Payload Relationship

 

  Summary of Dropped Files

 
   
     
   
                class="c09_td">
        721cca40df0f7eab5b5cb069ee8fda9d       class="c09_td_value is-hidden-mml">721cca40df0f7eab5b5cb069ee8fda9d
                  class="c09_td">
        Exe       class="c09_td_value is-hidden-mml">Exe           class="c09_td">
                class="c09_td_value is-hidden-mml">           class="c09_td">
                class="c09_td_value is-hidden-mml">
   
                class="c09_td">
        a31cad2960a660cb558b32ba7236b49e       class="c09_td_value is-hidden-mml">a31cad2960a660cb558b32ba7236b49e
       
                  class="c09_td">
                class="c09_td_value is-hidden-mml">           class="c09_td">
                class="c09_td_value is-hidden-mml">
   
                class="c09_td">
        b355dedbabb145bbf8dd367adac4f8c5       class="c09_td_value is-hidden-mml">b355dedbabb145bbf8dd367adac4f8c5
       
                  class="c09_td">
        Yes       class="c09_td_value is-hidden-mml">Yes           class="c09_td">
                class="c09_td_value is-hidden-mml">
   
                class="c09_td">
        128e3fc5ffba06abdd3edab2aff3753f       class="c09_td_value is-hidden-mml">128e3fc5ffba06abdd3edab2aff3753f
       
                  class="c09_td">
        Yes       class="c09_td_value is-hidden-mml">Yes           class="c09_td">
        Yes       class="c09_td_value is-hidden-mml">Yes

Name	class="c09_td">Md5	class="c09_td">Locations	class="c09_td">Type	class="c09_td">Encoded/Encrypted	class="c09_td">Compressed
Ews.exe       class="c09_td_value is-hidden-mml">Ews.exe	%TEMP%       class="c09_td_value is-hidden-mml">%TEMP%
OINFOP11.EXE       class="c09_td_value is-hidden-mml">OINFOP11.EXE	%TEMP%\RarSFX0\%ALLUSERSPROFILE%\SXS\       class="c09_td_value is-hidden-mml">%TEMP%\RarSFX0\%ALLUSERSPROFILE%\SXS\	Exe         (clean)           class="c09_td_value is-hidden-mml">Exe (clean)
OInfo11.ocx       class="c09_td_value is-hidden-mml">OInfo11.ocx	%TEMP%\RarSFX0\%ALLUSERSPROFILE%\SXS\       class="c09_td_value is-hidden-mml">%TEMP%\RarSFX0\%ALLUSERSPROFILE%\SXS\	Binary         File           class="c09_td_value is-hidden-mml">Binary File
OInfo11.ISO       class="c09_td_value is-hidden-mml">OInfo11.ISO	%TEMP%\RarSFX0\%ALLUSERSPROFILE%\\SXS\       class="c09_td_value is-hidden-mml">%TEMP%\RarSFX0\%ALLUSERSPROFILE%\\SXS\	Binary         File           class="c09_td_value is-hidden-mml">Binary File

 

  Exploit Details

 

This malware uses CVE-2012-0158 to drop the payload from the section
  shown in Figure 6.

 

        src="/content/dam/legacy/blog/2013/05/5132013_image012.png"
      alt="5132013_image012"
      class="aligncenter size-full wp-image-2042 landscape-med"
      width="700" height="400" />

 

  Figure 6: Exploit Payload Section

 

Shellcode can be found in the first few bytes of this section.
  Figure 7 shows the disassembly of the code found at the 0x1de0b offset
  shown in figure 6.

 

        src="/content/dam/legacy/blog/2013/05/5132013image014.png"
      alt="5132013image014"
      class="aligncenter size-full wp-image-2078 landscape-med"
      width="705" height="524" />

 

  Figure 7: Payload Shellcode

 

  Campaign Characteristics

 

OInfoP11.exe is a valid Microsoft file and its certificate is shown
  in figure 8.

 

        src="/content/dam/legacy/blog/2013/05/5132013_image016.png"
      alt="5132013_image016"
      class="aligncenter size-full wp-image-2043 landscape-sm"
      width="442" height="361" />

 

  Figure 8: Signature Usage

 

When the OInfop11.exe is called with the following arguments as
    C:\Documents and Settings\All Users\SxS\OINFOP11.EXE" 200
  0, it will begin the loading of the file OInfo11.ocx.

 

        src="/content/dam/legacy/blog/2013/05/5132013image019.png"
      alt="5132013image019"
      class="aligncenter size-full wp-image-2050 landscape-lg"
      width="805" height="508" />

 

  Figure 10: Loader Entrypoint

 

The arrow shows the exact jump point where the entrypoint to where
  the shellcode begins for the decompression and decryption of the ISO file.

 

        src="/content/dam/legacy/blog/2013/05/5132013_image021.png"
      alt="5132013_image021"
      class="aligncenter size-full wp-image-2044 portrait-sm"
      width="370" height="521" />

 

  Figure 11: Shellcode Example

 

This is an example of the memory space of the loaded benign DLL
  OInfo11.ocx. The functionality of OInfo11.ocx is essentially a loader
  in which this section decompresses and decrypts the malicious payload
  in memory.

 

        src="/content/dam/legacy/blog/2013/05/5132013image023.png"
      alt="5132013image023"
      class="aligncenter size-full wp-image-2081 landscape-lg"
      width="885" height="612" />

 

  Figure 12: Decryption of the ISO file

 

This is the decryption loop used through out the sample. In this
  instance, it is used to decrypt the ISO shellcode in memory.

 

        src="/content/dam/legacy/blog/2013/05/5132013image025.png"
      alt="5132013image025"
      class="aligncenter size-full wp-image-2051 portrait-sm"
      width="200" height="400" />

 

  Figure 13: DLL location in memory

 

This is an example of the complete malicious DLL address space in memory.

 

  Entrenchment

 

Artifacts to watch for:

 
   
     
   
                class="c09_td">
        Adds       class="c09_td_value is-hidden-mml">Adds           class="c09_td">
        \REGISTRY\MACHINE\Software\CLASSES\FAST
                class="c09_td_value is-hidden-mml">\REGISTRY\MACHINE\Software\CLASSES\FAST
   
     
                  class="c09_td">
            \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
            Settings\5.0\User Agent\Post Platform

            \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
            Security\User Agent\Post Platform           class="c09_td_value is-hidden-mml">\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
          Settings\5.0\User Agent\Post Platform

          \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
          Security\User Agent\Post Platform
   
     
                  class="c09_td">
            \REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware

            Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet
            Settings\"ProxyEnable" = 0x00000000
                    class="c09_td_value is-hidden-mml">\REGISTRY\MACHINE\SYSTEM\ControlSet001\Hardware

          Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet
          Settings\"ProxyEnable" = 0x00000000
   
                class="c09_td"> %ALLUSERS
            PROFILE%\SXS\
  %ALLUSERS
            PROFILE%\SXS\OInfo11.ocx
  %ALLUSERS
            PROFILE%\SXS\OInfo11.ISO
  %ALLUSERS PROFILE%\SXS\OINFOP11.EXE
       

Mutex	class="c09_td">	class="c09_td">\BaseNamedObjects\oleacc-msaa-loaded       DoInstPrepare
Registry         Key       class="c09_td_value is-hidden-mml">Adds
Registry         Key           class="c09_td_value is-hidden-mml">Registry Key	Adds       class="c09_td_value is-hidden-mml">Adds
Registry         Key           class="c09_td_value is-hidden-mml">Registry Key	Sets         Value           class="c09_td_value is-hidden-mml">Sets Value
Folders and         Files           class="c09_td_value is-hidden-mml">Folders and       Files	Hides       class="c09_td_value is-hidden-mml">Hides

 

        src="/content/dam/legacy/blog/2013/05/5132013image027.png"
      alt="5132013image027"
      class="wp-image-2052 aligncenter portrait-sm" width="360" height="450" />

 

  Injection

 

The DLL injects code into svchost using the VirtualAllocEx call then
  uses WriteProcessMemory to write into the memory space of svchost.exe.
  The thread is then resumed to run the injected code. This injection
  process is used for both svchost.exe and msiexec.exe. When svchost.exe
  spawns msiexec.exe it calls the CreateEnvironmentBlock and the
  CreateProcessesUser so that the svchost service can launch a user session.

 

  Keylogging Activity

 

Creates a kellogging file in %ALLUSERS PROFILE%\SXS\ as NvSmart.hlp.
  Below is an example of the content of this file.

 

        src="/content/dam/legacy/blog/2013/05/2013.jpg" alt="2013"
      class="alignnone size-full wp-image-2177 landscape-sm" width="455" height="77" />

 

  Proxy Establishment

 

This sample can communicate using ICMP, UDP, HTTP and TCP. In this
  situation the sample is using the string Protocol:[ TCP], Host:
  [202.69.69.41:90], Proxy: [0::0::] to establish the proxy for the
  C&C communication.

 

        src="/content/dam/legacy/blog/2013/05/5132013image029.png"
      alt="5132013image029"
      class="aligncenter size-full wp-image-2053 landscape-med"
      width="698" height="468" />

 

  Figure 14: Communication Options

 

Modes of Operation Overview The table below outlines some of the
  functionality that this variant uses. The options have not changed so
  therefore this table is used as a refresher. Figure 15 shows an
  example of how these functions are called by the sample.

 
   
     
   
                class="c09_td"> Access disk
            drives to modify the files           class="c09_td_value is-hidden-mml">Access disk drives to
          modify the files
   
                class="c09_td"> List
        shares           class="c09_td_value is-hidden-mml">List shares
   
                class="c09_td"> List
            TCP/UDP connections           class="c09_td_value is-hidden-mml">List TCP/UDP
      connections
   
                class="c09_td"> Send system
            commands to the workstation such as screen
        lock Send
          system commands to the workstation such as screen
      lock
   
                class="c09_td"> Port
        mapping           class="c09_td_value is-hidden-mml">Port mapping
   
                class="c09_td"> Modify the
            state of processes           class="c09_td_value is-hidden-mml">Modify the state of
      processes
   
                class="c09_td"> Modify
            registry keys           class="c09_td_value is-hidden-mml">Modify registry
      keys
   
                class="c09_td"> Modify
        services           class="c09_td_value is-hidden-mml">Modify services
   
                class="c09_td"> Communicate
            through the established name pipe to the C&C
        server           class="c09_td_value is-hidden-mml">Communicate through the
          established name pipe to the C&C server
   
                class="c09_td"> SQL
            database queries           class="c09_td_value is-hidden-mml">SQL database
      queries
   
                class="c09_td"> Startup
            telnet server on the victim           class="c09_td_value is-hidden-mml">Startup telnet server on
          the victim

Mode	scope="col">Description
Disk       class="c09_td_value is-hidden-mml">Disk
Nethood       class="c09_td_value is-hidden-mml">Nethood
Netstat       class="c09_td_value is-hidden-mml">Netstat
Option       class="c09_td_value is-hidden-mml">Option
PortMap       class="c09_td_value is-hidden-mml">PortMap
Process       class="c09_td_value is-hidden-mml">Process
RegEdit       class="c09_td_value is-hidden-mml">RegEdit
Service       class="c09_td_value is-hidden-mml">Service
Shell       class="c09_td_value is-hidden-mml">Shell
SQL       class="c09_td_value is-hidden-mml">SQL
Telnet       class="c09_td_value is-hidden-mml">Telnet

 

        src="/content/dam/legacy/blog/2013/05/5132013image031.png"
      alt="5132013image031"
      class="aligncenter size-full wp-image-2054 portrait-med"
      width="587" height="596" />

 

  Figure 15: Functionality Example

 

  C&C Details and Communication

 

In figure 16, the sample is communicating to 202.69.69.41 over port
  90. The C&C node is down in this case, but the communication is
  dynamic non-http communication. An example of the callback content is
  shown in figure 17. This sample will also try to communicate with
  other instances laterally in the same network. An example of this
  traffic and content can be seen in figure 18 and figure 19.

 

        src="/content/dam/legacy/blog/2013/05/5132013image033.png"
      alt="5132013image033"
      class="aligncenter size-full wp-image-2055 landscape-med"
      width="700" height="80" />

 

  Figure 16: PCAP of C&C communication

 

        src="/content/dam/legacy/blog/2013/05/5132013image035.png"
      alt="5132013image035"
      class="aligncenter size-full wp-image-2056 landscape-med"
      width="606" height="39" />

 

  Figure 17: Callback Traffic

 

        src="/content/dam/legacy/blog/2013/05/5132013image037.png"
      alt="5132013image037"
      class="aligncenter size-full wp-image-2057 landscape-med"
      width="700" height="200" />

 

  Figure 18: UDP Beacon

 

        src="/content/dam/legacy/blog/2013/05/5132013image30.png"
      alt="5132013image30"
      class="aligncenter size-full wp-image-2084 landscape-med"
      width="549" height="92" />

 

  Figure 19: UDP packet content

 

Whois Information on the IP 202.69.69.41

 

inetnum: 202.69.68.0 - 202.69.71.255

 

netname: NEWTT-AS-AP

 

descr: Wharf T&T

 

Limited descr: 11/F, Telecom Tower,

 

descr: Wharf T&T Square, 123 Hoi Bun Road

 

descr: Kwun Tong, Kowloon country: HK

 

admin-c: EN62-AP

 

tech-c: BW128-AP

 

mnt-by: APNIC-HM

 

mnt-lower: MAINT-HK-NEWTT

 

mnt-routes: MAINT-HK-NEWTT

 

mnt-irt: IRT-NEWTT-HK

 

status: ALLOCATED PORTABLE

 

remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 

remarks: This object can only be updated by APNIC hostmasters.

 

remarks: To update this object, please contact APNIC

 

remarks: hostmasters and include your organisation's account

 

remarks: name in the subject line.

 

remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 

changed: hm-changed@apnic.net 20120725

 

source: APNIC

 

person: Eric Ng

 

nic-hdl: EN62-AP

 

remarks: please report spam or abuse to abuse@wharftt.com

 

e-mail: abuse@wharftt.com

 

e-mail: ericng@wharftt.com

 

address: 11/F Telecom Tower, Wharf T&T Square

 

address: 123 Hoi Bun Road, Kwun Tong,'

 

phone: +852-2112-2653 fax-no: +852-2112-7883

 

country: HK changed: ericng@wharftt.com 20070716

 

mnt-by: MAINT-NEW source: APNIC

 

person: Benson Wong

 

nic-hdl: BW128-AP

 

e-mail: abuse@wharftt.com

 

address: 5/F, Harbour City, Kowloon,

 

address: Hong Kong

 

phone: +852-21122651

 

fax-no: +852-21127883

 

country: HK

 

changed: bensonwong@wharftt.com 20070420

 

mnt-by: MAINT-HK-NEWTT

 

source: APNIC

 

I want to thank the FireEye Labs Team.

 

[1] http://rmqlxk.blogspot.com/2013/03/blog-post_15.html

 

[2] http://www.circl.lu/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf

 

[3] http://lastline.com/an-analysis-of-plugx.php

 

[4] http://blog.trendmicro.com/trendlabs-security-intelligence/unplugging-plugx-capabilities/

Source: Targeted Attack Trend Alert: PlugX the Old Dog With a New Trick