Analysis of a Dridex maldoc pre-Locky

By Pasquale Stirparo -
The latest trends on the security threat landscape have mainly been Ransomware distributed via infected websites, and Banking Trojans distributed via malicious documents attached to phishing emails. In particular, Dridex banking trojan has been one of the most active threats. Last week the two threats merged and Dridex began distributing Locky ransomware as well.
In this post we will go through the analysis of a malicious office document delivering Dridex banking Trojan, spreading just the day before it switched to Locky and we will the similarities between the two actors that make us believe the same is behind the two.

Introduction

On Friday February 12th, we observed a big wave of phishing attempts, over 700, which looked like the following:

Sender: fpo.cc.XX@vosa.gsi.gov.uk
Subject: DVSA RECEIPT
Attachment: Fixed Penalty Receipt.docm
MD5 Checksum: 50e1c94e43f05f593babddb488f1a2f9

Where XX are two random digits. Few days later, on Monday February 15th, we observed a second bigger wave, this time counting over 1700 phishing attempts and all from a specific sender. The email looked like the following:

Sender: kpegg@responserecruitment.co.uk
Subject: Invoice (w/e 070216)
Attachment: SKM_C3350160212101601.docm
MD5 Checksum: d93f33e2d5a4b3232f824dbd1d897df4 

Analysis

The .docm is a MS Word file format similar to .docx, it's basically a zip archive containing the xml files. Therefore it is possible to perform some static analysis using oledump.py, which helps to immediately identify the macro streams within the document:


Going through the different vba streams, we can find the AutoOpen() subroutine, which is the starting point executed as soon as the user opens the .docm attachment.


And by opening the stream A7, the biggest one containing all the code, we find the AddSensors() subroutine called above. Following the code, we reach the point where there seems to be the embedded domain address. Here the obfuscated url and the decryption routine:


The array on top is the url, while the ErrHandler function represent the de-obfuscation routine, confirmed as follows:


Performing a dynamic analysis, we get the confirmation about the previous finding. In particular, when the Word file is executed, it performs a GET request to hxxp://www.profildigital[.]de/09u8h76f/65fg67n (82.197.153[.]120), from which it downloads the executable Ladybi.exe.


This specific sample would then starts communicating with the C&C server at the address 5.45.180[.]46. Just one day later, on the 16th of February, Locky ransomware started to spread. Evidences from the analysis of Locky showed that the same actors behind this Dridex analyzed here could be the same behind Locky. Evidences are:
  • Similar IOC
  • Similar modus operandi (TTP) and spreading mechanisms
  • Similar C2 infrastructure
You can find more references and indicators about Locky analysis and the correlation with Dridex at the following references [1][2][3][4].

Happy Hunting

Pasquale

REFERENCES:

Comments

Post a Comment

Popular posts from this blog

A first look at Android 14 forensics

By -
Android 14 was released to the public by the Open Handset Alliance on October 4, 2023, and is now available on various smartphones, including the Google Pixel. This blog post aims to explore a list of the majr oartifacts you can find on this version of the Android OS.  For testing and review, I set up a Google Pixel 7A and used it for about a month, with a SIM card and various native and third-party apps installed. The blog post is organized by sections: Device information and general settings User accounts Information on Cellular, Wi-Fi, and Bluetooth connections Native Android applications Google applications Analysis of the use of native and third-party applications Other relevant information As always, I'll try to update this blog post as I test and research. Device information and general settings build.prop TXT format Stored in the root directory of the system partition  Among other things, it contains the device manufacturer, the device model, the operating system version, a
Keep reading

Huawei backup decryptor

By -
When doing Mobile Forensics the first and usually the hardest step is to get access to user's data . It depends on the case type, but the so called physical  acquisition is the analyst object of desire. The reason is simple: iOS and Android native backups, respectively adb  and iTunes , contain a subset of user data, because they respect the various apps configurations where they can specify " you can't include me in backups ". Which leads to inconsistent situations like, for example, having WhatsApp data in iTunes backups and not having it in Android adb backups. Not considering WhatsApp, the majority of apps in iOS and Android do not allow their data to be included in backups . In the scenario where  device is unlocked or the lock  code is known (the only scenario considered in this post), the analyst could use the device itself to make the analysis of the installed applications. Anyone who did that at least once knows how uncomfortable is this approach. Al
Keep reading

WhatsApp Xtract

By -
I don’t want to bore you explaining what is WhatsApp . If you have this serious gap, you can fill it here .  Forensically speaking, WhatsApp was a very cool app until the last June. After that, someone had decided to add the extension “crypt” to such excellent source of information which was msgstore.db . This database stores information about contacts and also entire conversations. But simply opening it with SQLite Browser , you can have some troubles in extracting a single chat session with a desired contact, or in reordering the messages. My last python script wants to overcome these problems, avoiding to deal with complex SQL queries. Now, you need only to decrypt that file! Go to the repo.
Keep reading