TA577 PIKABOT INFECTION

PCAP Analysis and Suricata Rules Set

https://images.hdqwalls.com/wallpapers/pikachu-ninja-jv.jpg

Let’s lay out our goal for this analysis. Our goal is to check for any possible IOCs from Pikabot infection that we can find in the pcap file and create rules on how to implement them on our Suricata (IDS/IPS).

Before we download our pcap file, we will check first what is Pikabot and how it is delivered to the system, because knowing this we will be able to know what we are up to and we can prevent them during their Delivery stage.

Pikabot, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. Despite being in the early stages of development, it already demonstrates advanced techniques in evasion, injection, and anti-analysis.

According to PulseDive the malware is being delivered using a zip file or a msi file, so we already have a clue of what we going to look for. Let’s take a look of what’s the distribution method of this malware from PulseDive.

Spam Campaigns — PulseDive

Malvertising — PulseDive

Now let’s download the file and start the analysis.

Note: We will only analyze the pcap file. There will be more IoCs outside of this process but our goal is to stop the malware from our perimeter.

We know that the malware was downloaded using phishing emails or through malvertising. After filtering the pcap file, we will be able to capture these domains.

(http.request or tls.handshake.type eq 1) and !(ssdp) && http.request.method == "GET"

We are going to check the reputaion of this IPs/Domains.

Based on the results of the reputation check, I suggest starting with the two domains that have an “Untrusted” reputation. Let’s run another check using AbuseIPDB and VT now.

QAKBOT

From the results above this two seems to be really malicious.

orangebrands(.)co(.)tz

From this we can check if QAKBOT is related to PIKABOT

https://www.darkreading.com/cyberattacks-data-breaches/pikabot-malware-qakbot-replacement-black-basta-attacks

Ok now we have one positive IoCs

gloverstech(.)com

This one what I notice is what I saw from Wireshark.

Why would someone download something from this site using PowerShell? It seems to be done automatically through an Invoke-WebRequest command embedded in the payload. Unfortunately, malicious actors often misuse this cmdlet.

These two domains are strong Indicators of Compromise (IoCs) in my opinion. Let’s analyze the http stream in Wireshark for further investigation.

orangebrands

Why include the favicon.ico if it didn't trigger hits on VirusTotal? We haven't extracted any suspicious files, and focusing only on connections to our primary IoCs might miss something. We can't afford to overlook potential threats, especially since this .ico file also appeared under the different name "qakbot.zip".

gloverstech

Now we get what we need from those two sites we will check again the pcap using Zui.

Looking at the results from Zui, we have some interesting outcome which we didn’t saw from our initial analysis.

From the results we are seeing 3 new IPs with higher alert event type. Before we check those new IPs, we will check the first IoCs we found from our first analysis.

To get all connections from that IP we will use this filter

id.resp_h==<ipaddress>

We will start with the IP that doesn’t have alert from Zui which is from orangebrands but we have positive identification from VT that correlates it to PikaBot.

This file is a positive as part of our IoCs.

Now Let’s check the other domain/IP(gloverstech) that has lower alert.

Looks innocent right? one more

Nothing again. :(

But have you noticed the file reputation from the zip file that we search? Let’s check again.

Seeing the associated domains for the hash of the ZIP file, it is also used by malicious actors. The .dat file extension serves as a good disguise to evade security measures, as malicious actors don’t typically use it to drop malware. This extension can also hide encrypted data that attackers can leverage later for their objectives. Nevertheless, we can now be confident that this IP is part of the IoCs.

Now let’s move to those IPs that we saw which has alert 1.

From what I’m seeing now this is a C2 traffic, if we take a look the information from MITRE ATT&CK framework we can see that this can be used to transfer traffic over TLS. For example this technique is being used by the group PROMETHIUM for transferring their traffic.

We can read more about this technique by visiting this link T1587.003

Let’s check the other two.

They are all connected to PikaBot, and probably they have the whole subnet being used for the C2 server.

Now let’s check the all the IoCs we collected from our analysis.

#INDICATORS OF COMPROMISE
Domains:
gloverstech.com
orangebrands.co.tz
IPs:
207.246.123.214
173.254.61.242
158.220.80.157(158.220.80.0/20)
158.220.80.167(158.220.80.0/20)
104.129.55.103(104.129.52.0/22)
Hashes:
MD5 fbbf079c6a30ac1452b9c8a7b5350f99
SHA-256 3cb8174becb3c89318ed01ccd76e71cbeb8bc9e0fcbce8e110d40cd71af20fa2
MD5 b40cdade67e92aa535fb41ee1b403235
SHA-256 b16c98f0f434bd92d799e7cb7157553f6d8815d7c06fcfe2567b7540d895de05
MD5 c8a944cf740226f8256e3774887380fc
SHA-256 5081c0ac7d945bd7ecc84b1998ab2f1828c6216369a9a28c72a75a80b177a6c9
Filnames:
Qft.zip
favicon.ico
0.526635390798647.dat

For the second part of this blog we will create Suricata Rules for the IoCs we collected.

We’ll start by building C2 connection rules as if it were a live environment. While alerts will be triggered here, in a live environment, termination would be the appropriate action for any C2 connection. We’ll use “any” for the port identifier as malicious actors can easily switch ports to avoid detection.

1. ) 158[.]220[.]80[.]157

From this stream we will match TLS as protocol, subject, issuer, and any pattern that we can see that might be useful for tracking it down.

alert tls 158.220.80.157 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=bloodguiltiness.tirol"; fast_pattern; tls.cert_issuer; content:"Abridges Lippier"; nocase; pcre:"/.Crab\D/"; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000001; rev:1;)

We can see that we are able to match 17 alerts from our rule, let’s do the other one but right now let’s use TLS fingerprint as well in our rules.

2. ) 104[.]129[.]55[.]103

alert tls 104.129.55.103 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=infemininesilverberry.rentals"; fast_pattern; tls.cert_fingerprint; content:"82:ea:08:00:d4:9c:b5:6c:49:2c:19:6f:29:53:5e:77:c4:03:d0:9a"; nocase; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000002; rev:1;)

3. ) 158[.]220[.]80[.]167

We’ll use the subnet associated with the IPs. Since two IPs from the same subnet are already identified, it’s possible they control the entire subnet for their operations. Additionally, we’ll match any connections based on the TLS serial number.

alert tls 158.220.80.0/20 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=unsplendorous.tips"; fast_pattern; tls.cert_serial; content:"6A:15:9C:DE:84:14:9C:43:55:1F:50:6D:E7:0E:C3:9B:E9:0F:CA:C6"; nocase; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000002; rev:1;)

4. ) 173[.]254[.]61[.]242

Malicious actors frequently drop diverse file types with varied names and extensions to deliver malware. In this case, they seem to favor ZIP and MSI files based from PulseDive blogpost. To catch these attempts, I’ve created a PCRE (Perl Compatible Regular Expression) to match potential file names and compression formats.

alert http any any -> 173.254.61.242 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.protocol; content:"HTTP/1.1"; http.accept_enc; content:"gzip"; content:"deflate"; classtype:trojan-activity; sid:2000004; rev:1;)

alert http 173.254.61.242 any -> any any (msg:"ET PIKABOT Detected - Foothold attempt - Filename Identifier"; flow:established,from_server; http.start; content:"HTTP/1.1"; file.name; pcre:"/(?:[a-zA-Z0-9_]+)+\.(?:zip|7z|rar|tar|msi)$/"; classtype:trojan-activity; sid:2000005; rev:1;)

I’ve also created a rule for GET request that will match any image file that the malicious actor will try to drop using PCRE.

alert http any any -> 173.254.61.242 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/(?:[a-zA-Z0-9_]+)+\.(?:ico|jp\wg|png|gif)$/"; http.protocol; content:"HTTP/1.1"; classtype:trojan-activity; sid:2000004; rev:1;)

5. ) 207[.]246[.]123[.]214

We’ve use again PCRE to match this filename 0.526635390798647.dat and even though they change the numbers a bit like what they did from here:

It would still match as that’s how pattern matching works.

alert http any any -> 207.246.123.214 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(?:[a-zA-Z0-9@.])+(?:\.dat)/"; http.protocol; content:"HTTP/1.1"; classtype:trojan-activity; sid:2000004; rev:1;)

In this blog post, we’ve created seven rules that will either trigger alerts or immediately terminate connections established by malicious actors. Here’s a quick rundown of the rules we made:

alert tls 158.220.80.157 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=bloodguiltiness.tirol"; fast_pattern; tls.cert_issuer; content:"Abridges Lippier"; nocase; pcre:"/.Crab\D/"; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000001; rev:1;)

alert tls 104.129.55.103 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=infemininesilverberry.rentals"; fast_pattern; tls.cert_fingerprint; content:"82:ea:08:00:d4:9c:b5:6c:49:2c:19:6f:29:53:5e:77:c4:03:d0:9a"; nocase; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000002; rev:1;)

alert tls 158.220.80.0/20 any -> any any (msg:"ET PIKABOT Detected C2 traffic using malicious SSL Certificate"; flow:established,to_client; tls.cert_subject; content:"CN=unsplendorous.tips"; fast_pattern; tls.cert_serial; content:"6A:15:9C:DE:84:14:9C:43:55:1F:50:6D:E7:0E:C3:9B:E9:0F:CA:C6"; nocase; reference:url,twitter.com/Unit42_Intel/status/1755741384982561175; classtype:domain-c2; sid:2000003; rev:1;)

alert http any any -> 173.254.61.242 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.protocol; content:"HTTP/1.1"; http.accept_enc; content:"gzip"; content:"deflate"; classtype:trojan-activity; sid:2000004; rev:1;)

alert http any any -> 173.254.61.242 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/(?:[a-zA-Z0-9_]+)+\.(?:ico|jp\wg|png|gif)$/"; http.protocol; content:"HTTP/1.1"; classtype:trojan-activity; sid:2000005; rev:1;)

alert http 173.254.61.242 any -> any any (msg:"ET PIKABOT Detected - Foothold attempt - Filename Identifier"; flow:established,from_server; http.start; content:"HTTP/1.1"; file.name; pcre:"/(?:[a-zA-Z0-9_]+)+\.(?:zip|7z|rar|tar|msi)$/"; classtype:trojan-activity; sid:2000006; rev:1;)

alert http any any -> 207.246.123.214 any (msg:"ET PIKABOT Detected - Foothold attempt - GET Request"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(?:[a-zA-Z0-9@.])+(?:\.dat)/"; http.protocol; content:"HTTP/1.1"; http.header; content:"gloverstech.com"; classtype:trojan-activity; sid:2000007; rev:1;)

We are also been able to generate 81 alerts just using the PCAP file itself.

Thank you for reading the blog, till next time! :D