Trend Micro security researchers has uncovered improved tactics, techniques, and procedures (TTPs) on a new campaign attributed to an APT Group known as Earth Longhzi.

The threat group’s effort is directed at organizations with locations in Taiwan, Thailand, the Philippines, and Fiji, according to the official report.  Upon monitoring of the CERT-PH, It was discovered that this was the first time the threat group had targeted businesses in Fiji.

_____________________________

A. Nature of Attack

The new campaign leverages vulnerable public-facing web applications, and servers such as Internet Information Services (IIS) servers, and Microsoft Exchange servers to install Behinder, a well-known web shell.

Once the exploitation on the targeted system is successful, adversaries use this to gather network information and install additional malware and hacking tools to it.

Based on their investigation, the malware is being loaded via DLL sideloading technique wherein MpClient.dll was disguised as a legitimate DLL file and launched through legitimate Windows Defender binaries, MpDlpCmd.exe and MpCmdRun.exe.

Two different types of malware have been seen loaded using the technique. 

1. Croxloader

Earth Longzhi’s new campaign launched Windows Defender binaries as a system service. The new Croxloader variant, disguised as MpClient.dll, was subsequently loaded. Once launched, Croxloader reads the payload named MpClient.bin and decrypts its content. The new variant is almost identical to the older ones, except that it uses a different decryption algorithm. The algorithm used in the original variant is (SUB 0xA) XOR 0xCC, while the algorithm for the new variant is (ADD 0x70) XOR 0xDD. The final payload is identified as a Cobalt Strike beacon.

2. SPHijacker

SPHijacker, a new tool designed to disable security products, adopts two approaches to achieve this purpose. One approach terminates the security product process by using a vulnerable driver, zamguard64.sys, published by Zemana (vulnerability designated as CVE-2018-5713). Meanwhile, another approach disables process launching by using a new technique that we named stack rumbling, which is a type of DoS attack that abuses undocumented MinimumStackCommitInBytes values in the IFEO registry key.

_____________________________

B. Indicator of Compromise

The new campaign leverages vulnerable public-facing web applications, and servers such as Internet Information Services (IIS) servers, and Microsoft Exchange servers to install Behinder, a well-known web shell.

File7910478d53ab5721208647709ef81f503ce123375914cd504b9524577057f0ec
Fileebf461be88903ffc19363434944ad31e36ef900b644efa31cde84ff99f3d6aed
File21ffa168a60f0edcbc5190d46a096f0d9708512848b88a50449b7a8eb19a91ed
File942b93529c45f27cdbd9bbcc884a362438624b8ca6b721d51036ddaebc750d8e
File75a51d1f1dd26501e02907117f0f4dd91469c7dd30d73a715f52785ea3ae93c8
File4399c5d9745fa2f83bd1223237bdabbfc84c9c77bacc500beb25f8ba9df30379
File8327cd200cf963ada4d2cde942a82bbed158c008e689857853262fcda91d14a4
File9eceba551baafe79b45d412c5347a3d2a07de00cc23923b7dee1616dee087905
File630bb985d2df8e539e35f2da696096e431b3274428f80bb6601bbf4b1d45f71e
Fileef8e658cd71c3af7c77ab21d2347c7d41764a68141551938b885da41971dd733
Filee654ecc10ce3df9f33d1e7c86c704cfdc9cf6c6f49aa11af2826cbc4b659e97c
File16887b36f87a08a12fe3b72d0bf6594c3ad5e6914d26bff5e32c9b44acfec040
File39de0389d3186234e544b449e20e48bd9043995ebf54f8c6b33ef3a4791b6537
C&C194[.]31[.]53[.]128
C&C198[.]13[.]47[.]158
C&C172[.]67[.]139[.]61
C&C207[.]148[.]115[.]125
C&C64[.]227[.]164[.]34
C&Cevnpowerspeedtest[.]com
C&Cwww[.]updateforhours[.]com
C&Cdns[.]eudnslog[.]com
C&Casis[.]downloadwindowsupdate[.]co
Download site194[.]31[.]53[.]128
Download site198[.]13[.]47[.]158

_____________________________

C. Actions to be Taken

CERT-PH recommends the following actions be taken:

  • Proactively monitor and secure identified systems and devices for any suspicious/malicious activities. Security personnel may check the listed Indicator of Compromise(IoCs) to detect any malicious activities related to the campaign.
  • Regularly check and apply the latest patch of software, especially to public-facing applications.
  • For additional information, kindly refer to the official report
    • https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html