Observations from recent alerts: Part 2

In this post, I’m sharing a few interesting true positive alerts I’ve worked on recently, not as deep dive threat analyses, but as short notes on how certain malware families are still active. The goal isn’t to break down every IOC or technique in detail, but to highlight how old threats continue to evolve, resurface, and appear in modern environments, reminding us that old, dated malware doesn’t always mean dead.

Similar to the last post on the observation of IOCs last year, this post will also contain the malwares that are deliberately downloaded without users knowing, either through cracked software or compromised old applications on the internet. Part 1: https://medium.com/@hariharanss/observations-from-recent-true-positive-alerts-708c17d52148

Threat actors are now posting articles on legitimate websites to distribute malware. They are utilizing famous forums, Q&A pages of specific companies, free boards, comments, etc.

Cryptocurrency-Stealing Malware Leveraging Tor:

This one was pretty interesting to investigate, as the victim first reported that they were seeing random extension files appearing in their shared folders out of nowhere. So we began investigating the folder with historical processes, network connections, etc. But nothing clicked right away, and we did a little deeper investigation and checked persistence, and we observed the following things happening in the background. The host had multiple suspicious scheduled tasks which were created by commands executing from a .js file. After this, it had two files in the data directory, namely ehuse_x4.exe and ugate.exe. On analysis, the command downloads and runs the malware from the attacker’s C2 server. The malware then creates several components in the public user directory, including a malicious JavaScript file, a Tor client executable file, and a task scheduler job file.

Basically, the user downloaded an old version of Adobe Acrobat cracked software which, on execution, creates a public folder and drops multiple .js files and the ugate.exe file. The ugate file was the Tor client, and collectively these create multiple Defender exclusions for temp folders and also check antivirus status. So the scheduled tasks are for the malicious JavaScript files. The scheduled tasks containing the .js file use ugate.exe to connect to the Tor client and send machine information and geolocation, and also monitor clipboard activity mainly to steal crypto wallet passwords by checking browser information and extensions. But here, the user was actually affected by clicking the file from the shared folder rather than downloading the actual malicious file. Since this was a shared folder, the unmanaged device was responsible, as the person who downloaded the cracked file had also turned off antivirus scanning on shared folders. What a day to have people like this, I wonder.

Another version of the infection

The key takeaway is obviously to restrict what employees can download or use application control to at least know what they are doing and educate them. Protect shared folders as well with the security product and make sure not to have unmanaged devices, if possible, as these might become the attack vector in case of incidents.

Remcos RAT:

Second one is actually simple. An admin account was running suspicious PowerShell commands and also created a weird registry key. On investigation, we found the parent to be olk.exe, which is Outlook, and a file named pdf-7z.9f4 was executed, which spawned PowerShell and created the registry key. As per the script, it was heavily obfuscated and used an obfuscation method called counter-principle that extracts every fourth character starting at index three. Upon doing this, it creates a registry key and made outbound connections to URLs and IPs, but none of them were malicious at that time as per OSINT. However, the antivirus deleted the registry entries and the main file from Outlook, which prevented further damage. This was a Remcos variant as per analysis.

Example of Remcos

The key takeaway from this is that phishing is still one of the important threat factors to consider. Everything here happened in the background, and the user would never know what they did wrong.

Hope you got to know something from this blog. Until next time, cheers.

References: https://asec.ahnlab.com/en/92142/ https://www.csk.gov.in/alerts/Remcos_RAT.html