Shadow Server Domains Leading to RIG Exploit Kit Dropping Smoke Loader. Downloaded Neutrino Bot (AKA Kasidet).

Brief History

These infection chains began from IOCs collected by Zain Gardezi over at FireEye. You can read the report HERE. The report contained a lot of IOCs, but the one that I want to highlight is the IP address 173.208.245.114. I was interested in this IP because the host using it was acting as a shadow server, hosting numerous domains that were redirecting victims to Sundown EK.

Some of the most recent domains resolving to that IP address include maddow.club and sayvinatge.club. Using those two domains as my referers proved to be successful as my host was redirected to RIG exploit kit numerous times. I don’t have time to go over each infection chain, but they are all similar. So, one example should do just fine.

Infection Chain

The infection chain I’m using as my example is from the Third Run. The infection begins when I visited sayvinatge.club. Below is the GET request for the domain and the web servers response:

The server responds with a “302 Found” and gives the new location of freeonlinecoupons.ml/go.php.

My host then makes a GET request for the go.php hosted at freeonlinecoupons.ml:

Again, we see a web server respond with another “302 Found” with the new location being that of a RIG exploit kit landing page at temp.askthevendor.com:

The browser loads the landing page and it is visible to the user (it usually happens out of the users view):

Below is an image of the traffic from the Third Run:

We then see the Flash exploit being sent to the host which is eventually followed by the malware payload: ask33u6p.exe (Smoke Loader). The script responsible for downloading the payload is o32.tmp, which is dropped and executed in %TEMP%.

Later on in the infection we see Smoke Loader generate GET requests for additional malware: s927397.exe (aka 1D95.tmp.exe) which appears to be an updated version of Smoke Loader and smoke927397.exe (aka 4CC4.tmp.exe) which turns out to be Neutrino Bot. There is an excellent article written by Hasherezade and Jérôme Segura about Neutrino Bot on the MalwareBytes Lab blog which you can read HERE.

Here is an image of my %TEMP% folder after many hours of letting my computer site idle:

If Neutrino bot detects that it is in a VM it deletes itself. It it passes checks then it copies itself to %APPDATA%:

The folder alFSVWJB is hidden from the my view

However, the folder and the malware are hidden from my view. That being said, I can see from the running processes (gjhax_16.exe) and the location of the file that the malware copied itself to %APPDATA% in a folder called alFSVWJB (C:Users[Username]AppDataRoamingalFSVWJBgjhax_16.exe):

You can also verify that the malware copied itself to %APPDATA% by looking at HKCU Run and HKLM Run:

The malware remains hidden by modifying the following registry keys:

HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedShowSuperHidden

Here are more entries as well as a base64 encoded value containing C2 information:

You’ll notice that the value in “a” (HKCUSoftwarealFSVWJB) contains the base64 encoded string “aHR0cDovL251dHN5c3RlbTEuYml0L25ld2ZpejIxL2xvZ291dC5waHA=”. This string decodes to “hxxp://nutsystem1.bit/newfiz21/logout.php”.

The malware also added itself into the firewall’s whitelist via the command:

cmd.exe " /a /c netsh advfirewall firewall add rule name="alFSVWJB" dir=in action=allow program=%APPDATA%alFSVWJBgjhax_16.exe"

An example of this can be seen in the process tree below:

Processes showing command

Following these events we see the Neutrino bot beacon out the word “enter” to nutsystem1.bit/newfiz21/logout.php and the response from the server is “success” (“enter” and “success” are base64 encoded)

ZW50ZXI = enter and c3VjY2Vzcw = success

Following the response we see another POST request to nutsystem1.bit/newfiz21/logout.php:

The malware collects information about the host via some base64 encoded data:

cmd&10bbd51x-660x-467x-9dax-04c078c4210x&WIN-U2ULJPT1QBB&Windows%207%20(64-bit)&1&N%2FA&5.2&01.04.2017&12042016ao

More base64 encoded data is in the response:

The base64 encoded data in the response decodes to:

1489603355568117#rate 2#1469100096882000#botkiller#1491107194447607#LOADER hxxp://178.159.36.43/s927400.exe#1491108002685833#LOADER hxxp://178.159.36.43/156a927400.exe#1491108010686425#LOADER hxxp://178.159.36.43/156b927400.exe#1491108018671854#LOADER hxxp://178.159.36.43/17927400.exe#1491108026318949#LOADER hxxp://178.159.36.43/74927400.exe#1491108034649083#LOADER hxxp://178.159.36.43/121927400.exe#1491108056268670#LOADER hxxp://178.159.36.43/123927400.exe#1491108064704461#LOADER hxxp://178.159.36.43/85927400.exe#1491108072487207#LOADER hxxp://178.159.36.43/226927400.exe#1491108081559782#LOADER hxxp://178.159.36.43/38927400.exe#1491108090903250#LOADER hxxp://178.159.36.43/161927400.exe#

This prompts my host to download additional malware from 178.159.36.43:

Host downloads additional files from locations retrieved by the C2

This is the part that threw me for a bit of a loop. You’ll notice a lot of POST requests to Omegle.com and its various subdomains. I had no idea what Omegle.com was but apparently it’s a website that allows users to connect to various servers and talk to random strangers. Looking at the POST requests we can see the following pattern:

front3.omegle.com/start?rcs=1&firstevents=1&spid=&randid=UMKDFYRE&lang=en
front3.omegle.com/events
front3.omegle.com/send
front3.omegle.com/disconnect

It repeats this pattern over and over again, each time switching between subdomains “front1.omegle.com” through “front15.omegle.com.” What is it doing exactly? Well, it is connecting to the servers via /start?rcs=1&firstevents=1&spid=&randid=UMKDFYRE&lang=en and then sends messages to the strangers using POST /send. Once it is done spamming the message it disconnects from the server via POST /disconnect and moves to the next one.

The message being spammed on Omegle.com servers is as follows:

hi wassup? girl here with picturesz i'm soo bored. just kik me at: [random kik username] this is my kik user-name, im gunna wait for ya ;)

And here is the message shown on Omegle.com:

Here is a TCP stream showing the messages being sent to Omegle.com:

msg = hey

msg = friendly girl here. i love dogs 😉

msg = want to be my friend on kik?

msg = LynrDowdle

msg = here is my kik User ,Name. im going to be on right now 😉

I’m also seeing traffic to Instagram:

Maybe the bot is simply trying to drive traffic to paying customers? If anyone knows for sure you can contact me via Twitter. All the files should be available for download via the Hybrid-Analysis reports in the IOCs section.

IOCs

First Run

173.208.245.114 – maddow.club – Shadow server domain
23.238.19.56 – freecouponcodes.ml – GET /gile.php – Gate
185.159.128.195 – admin.pennypincherconsignment.com – RIG exploit kit

Second Run

173.208.245.114 – maddow.club – Shadow server domain
23.238.19.56 – freecouponcodes.ml – GET /gile.php – Gate
185.159.128.195 – free.jimmagescontract.com – RIG exploit kit
178.159.36.151 – GET /s927392.exe – ET INFO Executable Download from dotted-quad Host
178.159.36.151 – GET /smoke927392.exe – ET INFO Executable Download from dotted-quad Host
23.5.104.242 – java.com – ET TROJAN Sharik/Smoke Loader Java Connectivity Check
192.150.16.117 – adobe.de – POST /support/main.html – ET TROJAN Sharik/Smoke Loader Adobe Connectivity check
112.78.9.34 – mailserv.xsayeszhaifa.bit – POST /hosting2/
112.78.9.137 – smoke.nutsystem3210z.bit – POST /hosting/

Third Run

173.208.245.114 – sayvinatge.club – Shadow server domain
23.238.19.56 – freeonlinecoupons.ml – GET /go.php – Gate
188.225.34.15 – temp.askthevendor.com – RIG exploit kit
178.159.36.162 – GET /s927397.exe
178.159.36.162 – GET /smoke927397.exe

Fourth Run

173.208.245.114 – sayvinatge.club – Shadow server domain
23.238.19.56 – freeonlinecoupons.ml – GET /go.php – Gate
188.225.34.15 – art.auctionagenda.com – RIG exploit kit

C&C Traffic

112.78.9.34 – nutsystem1.bit – POST /newfiz21/logout.php
112.78.9.31 – nutsystem1.bit – POST /newfiz21/logout.php
178.159.36.43 – GET /s927400.exe
178.159.36.43 – GET /156a927400.exe
178.159.36.43 – GET /156b927400.exe
178.159.36.43 – GET /17927400.exe
178.159.36.43 – GET /74927400.exe
178.159.36.43 – GET /121927400.exe
178.159.36.43 – GET /123927400.exe
178.159.36.43 – GET /85927400.exe
178.159.36.43 – GET /226927400.exe
178.159.36.43 – GET /38927400.exe
178.159.36.43 – GET /161927400.exe:

Malicious Artifacts (Password is infected)

Malicious Artifacts.zip

Until next time!

Category: Exploit Kit
Tag: IOCs, Neutrino Bot, Rig Exploit Kit, Smoke Loader

Published by malwarebreakdown

Just a normal person who spends their free time infecting systems with malware. View all posts by malwarebreakdown

x00x June 19, 2017 at 10:57 AM

interested write up :*

LikeLike

Reply

Brief History

Infection Chain

IOCs

Malicious Artifacts (Password is infected)

Share this:

Published by malwarebreakdown

Leave a Comment Cancel reply

Related