A Game-Cheat Team Launches Cyberattacks Against Employees at Numerous Enterprises

September 11, 2020 Lieying Lab Comments 0 Comment 5,817 views

Background

Recently, DBAPPSecurity Threat Intelligence Center's Lieying Lab monitored a large number of malicious samples that stored and distributed attack payloads through free cloud drives. During execution, these samples used legitimately signed programs from several well-known companies to load Trojan programs into memory. Based on the names of the delivered files, the primary targets were judged to be enterprise administrative personnel.

Through detailed analysis and tracing of the samples, we found that this batch of samples was strongly associated with a domestic game-cheat support studio. In addition to conventional information theft, the Trojan also included lateral-spreading capabilities, and users should remain vigilant.

Incident Overview

By continuously monitoring alerts from the DBAPPSecurity Mingyu APT Attack Early Warning Platform, we captured multiple samples of the same type and analyzed one of them in detail. Its complete execution flow is shown below:

Most samples in this batch were disguised with the XLS document icon of the WPS office suite and used enticing filenames—such as VIP data table, membership data, and bank risk control—to launch cyberattacks against specific targets.

Sample Analysis

We analyzed the sample 1.【出账目录】.com (1. Disbursement Directory.com) in detail. It initially spread as an EXE executable and used a disguised filename and icon to entice users to click it.

It countered security analysis through anti-debugging methods such as process detection.

If no relevant security tools were detected, it extracted DDMC.DLL from its own data and loaded it into memory for execution. Its exported function, “_ElevFunc,” retrieved encrypted ZIP archives from its own data and from a cloud drive.

It then used the extraction password (“zxs8866”) to extract them to the “ProgramFile(x86)\DingDing\mGiL1” directory. The ZIP obtained from the sample itself contained an encrypted file named “kk.log.”

The ZIP named “ttk.JPG,” downloaded from the cloud drive, contained multiple executable files.

Our analysis found that the following executables were all signed legitimate files.

It then created shortcut files named “666.lnk” and “kk.lnk.”

666.lnk invokes 666.exe with arguments to start tt.exe. Inside the program, tt.exe calls node.exe to execute main.js, which uses JavaScript code to add kk.lnk to the Run registry key for automatic startup.

kk.lnk invokes DingDebug.exe, which side-loads QMLogEx64.dll from the same directory. Its exported function, “GetQMLogEx,” loads the “kk.log” file and decrypts “EduDll.dll” through repeated XOR and addition operations.

EduDll.dll is the final attack payload (a RAT). Its exported function, “OKXKKGrk,” primarily obtains and uploads basic information about the user's device, then performs different operations based on remote-control commands.

The program first enumerates system processes to determine whether “cmd.exe” exists. If it does not, the program creates and executes “UxhaPxna.bat.”

The BAT file's main function is to repeatedly check whether the “DingDebug.exe” process is running and start the process if it is not. (This acts as a process watchdog.)

It creates an event object, “Cao360,” to ensure that only one instance runs.

It decodes Base64 and then uses XOR to decrypt the C2 (“k.bzsstw.cn”) and port (“1527”).

It obtains system information (computer name, CPU, memory, hard drive, network status, and so on) and sends it back to the C2 server.

Commands are dispatched as follows:

In addition to conventional capabilities such as file upload and download, remote CMD access, and keylogging, the backdoor also includes RDP brute-forcing and port-scanning capabilities.

It also uses a built-in weak-password dictionary to brute-force ports 139 and 445:

Once brute-forcing succeeds, it copies the program to the corresponding directory and executes it:

Sample Evolution Analysis

Through continuous monitoring of this batch of samples, we found slight differences in their attack techniques and execution flows across different periods. For example, a sample from May, 最新风控事项LZ-2020-05-17.exe (Latest Risk-Control Matters LZ-2020-05-17.exe), differed from the current sample in the following ways:

Difference 1: The sample first obtained ZIP archives from its own data instead of downloading them from a cloud drive. After obtaining two archives, it used different extraction passwords (“148820xqwe” and xqq871@x..) to extract and release them to specified directories.

Difference 2: It used PowerShell code to invoke and execute subsequent functions, while persistence was achieved by adding a startup file to the system's Startup menu.

Other aspects were largely the same as in the current sample, such as side-loading a malicious DLL through a signed legitimate file and decrypting kk.log to obtain the final backdoor Trojan for the attack.

Correlation Analysis

A query for “k.bzsstw[.]cn” on the DBAPPSecurity Threat Intelligence Center platform showed that the domains “774520[.]com” and “769658[.]com” pointed to the same server, “103.145.87.65.” The start and end dates for the domain resolution (2020-3-26 / 202-08-12) also aligned with the time of the current sample's attack (sample compilation time: 2020-07-09).

A search showed that the domain belonged to a domestic game-support studio, which was likely strongly associated with this attack.

Conclusion

In past analyses, game-support programs often bundled backdoor Trojans, generally to steal game accounts. Analysis of the samples captured in this incident suggests that the game-support industry is continuously expanding the scope of its illicit business and has made clear technical improvements in attack techniques and Trojan distribution. Enterprise employees and relevant practitioners are reminded to remain vigilant against this type of malicious attack.

IOC

k.bzsstw[.]cn

774520[.]com

156.bzsstw[.]cn

lbs.bzsstw[.]cn

lo.bzsstw[.]cn

hg.bzsstw[.]cn

3k.bzsstw[.]cn

58.dlrdjpz[.]cn

dlrdjpz[.]cn

hg.dlrdjpz[.]cn

3k.dlrdjpz[.]cn

1777.bzsstw[.]cn

05524639762d514d20caa76bac00b2ea

74f8da0b20451c3f89ecdefac7cbf6ca

dcd9a91fe391dd70451875e0c6174b13

3ea14147cc41f538aeb93fbfb2c78398

914f724ca6ccccdb1352f42af751044e

0f252bbc34a109c79a78c0117113ab19

f894cb74a8c0c84a3c6359334ca53d09

fa47f35b66be4affd10d0acd4a462286

e149ab40491d67747923a0f31841e2e6

d5cf014c9c6f0cb04eed340ef4020c1e

cdee926b15dd85c66f6ea8884cc422a6

9a3d89b6e0927a457ac01fb23505ab6f

c5fabe2eba9bab8c23598ee2f4a0ecad

02bc28ed9bf6d0b3758888c3c1e50aad

c3b2e91531bee2f8f796fe61af01ea14

340ecfc644f72bb33d980d2413909010

fb8052a34dbfba14687ce7be8854edd2

ba92ecc5a48fdf8b58d01147d8fcd4ff

9f4dc839b755076b8c01eb5d3f62e9fe

aa24347c1bd8d398a2f0db4ecaaf93f5

2bb5f11ec43a7fb03f6e9bc0ae17e586

50bec172eb2e6b2890d08da33110098b

a80c58a4b25a541cac6b1251ab792795

65e768553b2c566b2dec6a9cdde95aec

55c5e3c0d4ccff899d7f8f3208157ee8

f549738a6eb0882f5b4a409b537c5de7

7e3ce47873c93763f384d52c96e38aa4

e6496f850968fe571627b42535f79dc7

206bd01e5a9bb80b99f5f669f2fe43ff

52da79eb2d500181bf7f0146ba7f6294