供应链妥协导致Notezilla, RecentX, Copywhiz的特洛伊木马安装程序

最后更新于2024年6月28日星期五18:00:03 GMT

The following Rapid7 analysts contributed to this research: Leo Gutierrez, Tyler McGraw, Sarah Lee, and Thomas Elkins.

Executive Summary

On Tuesday, June 18th, 2024, Rapid7对客户环境中的可疑活动进行了调查. 我们的调查确定了可疑的行为是从安装Notezilla发出的, a program that allows for the creation of sticky notes on a Windows desktop. Installers for Notezilla, 以及RecentX和Copywhiz等工具, are distributed by the India-based company Conceptworld at the official domain conceptworld[.]com. After analyzing the installation packages for all three programs, Rapid7发现安装程序已被木马化，可以执行窃取信息的恶意软件，该恶意软件具有下载和执行额外有效载荷的能力.

Disclosure

On Monday, June 24th, 2024, Rapid7联系了Conceptworld，披露了托管的后门安装程序 conceptworld[.]com in accordance with Rapid7的漏洞披露策略. Within 12 hours, Conceptworld确认并通过删除恶意安装程序修复了这个问题 conceptworld[.]com 把它们换成合法的，有签名的副本. Rapid7 is grateful to Conceptworld for their prompt action on this issue.

Overview

Conceptworld是一家印度公司，提供三种不同的软件产品:Notezilla, which allows users to create sticky notes on a Windows desktop; RecentX, which stores recently used files/applications/clipboard data; and Copywhiz, 这改进了文件复制和备份操作. 官方提供免费试用下载 conceptworld[.]com 每个软件包的站点.

所提供的安装包 conceptworld[.]com at the time of investigation, however, 与合法安装程序一起执行恶意软件, were not signed, 并且与下载页面上声明的文件大小不匹配. The differences in the file sizes are due to the malware and its dependencies, which increases the size of the compromised installation packages.

Rapid7观察到的恶意软件包含窃取浏览器凭证和加密货币钱包信息的功能, 记录剪贴板内容和按键, 下载并执行额外的有效载荷. After infecting a system, 恶意软件通过每三小时执行一次主有效负载的计划任务持续存在.

基于提交给VirusTotal的文件, the malicious copies of the installers have existed since early June of 2024. 木马安装程序提供的恶意软件有效载荷, however, 似乎属于一个无名的恶意软件家族，至少从2024年1月开始就在传播. Rapid7内部将这个恶意软件家族称为 dllFake because of the naming scheme used for several of the malware payloads.

Technical analysis

要深入了解恶意软件的有效载荷, we will analyze the malicious installer that was served for Notezilla.

Initial Access

Rapid7确定了32位和64位版本的Notezilla的木马安装程序, Copywhiz, and RecentX were, at the time of investigation, 由官方网站提供服务 conceptworld[.]com. 任何用户通过当时流行的搜索引擎搜索这个软件，最可能在第一个结果中找到官方域名, 然后引导他们下载恶意软件吗.

Execution

The installer served by conceptworld[.]com 在调查的时候Notezilla是 NotezillaSetup.exe, which, based on static analysis, is packed using software called Smart Install Maker(5.04).

Figure 1. Software Properties of NotezillaSetup.exe.

Using the sim_unpacker plugin for the tool UniExtract2, 我们能够解包并获得安装包的大部分内容, 例如嵌入的文件和配置信息. 配置文件包含对Notezilla的合法软件安装程序的引用, which is dropped into %TEMP% 在执行过程中，以及将多个文件放入安装目录(i.e., staging folder) % LOCALAPPDATA % \ WindowsApps \ \微软 during execution.

Figure 2. 使用sim-unpacker工具输出.

Figure 3. Contents of installer.config.

Once executed, NotezillaSetup.exe will then execute the file dllCrt32.exe from the staging directory % LOCALAPPDATA % \ WindowsApps \ \微软 via a WINAPI call to ShellExecuteA with the verb open. 然后再打一个电话给 ShellExecuteA to execute the file NotezillaSetup.exe，合法安装程序的副本，来自 %TEMP%. As a result, 最终用户在初始执行后看到的唯一东西是合法安装程序的安装窗口弹出, prompting the user to proceed with the installation process for Notezilla.

Figure 4. Typical Process Tree for Initial Execution of the Trojanized Installer.

Figure 5. The User’s View after the Infection has Already Begun in the Background.

The file dllCrt32.exe is a relatively small (~10KB) program that only serves as a wrapper to call CreateProcessA to execute the file dllCrt.bat.

Figure 6. The Contents of dllCrt.bat.

The batch file dllCrt.bat 然后创建一个名为?的隐藏计划任务 Check dllHourly32 using schtasks.exe and an XML file that was previously dropped into the staging directory at % LOCALAPPDATA % \ \ WindowsApps \ dllCrt微软.xml. The scheduled task Check dllHourly32 will then execute the file % LOCALAPPDATA % \ \ WindowsApps \ dllBus32微软.exe 最初创建后每三小时一次, 也就是说，在用户最初执行木马安装程序至少三个小时后，主恶意软件有效载荷才会被执行.

Figure 7. Command Line Assembly within dllBus32.exe.

When dllBus32.exe 执行时，它还用作调用 CreateProcessA, though it initially retrieves several important command line parameters. 首先，调用CRT库函数 sprintf 连接一个硬编码的IPv4地址. Then, a second call to sprintf 将组装的IPv4地址与要传递给批处理文件的其他几个参数连接起来 dllBus.bat. Finally, CreateProcessA 用完全组装的命令行调用.

Figure 8. The Initial Lines of dllBus.bat.

的命令行参数 dllBus.bat via dllBus32.exe contain an IPv4 address, an SFTP port, ZIP存档有效负载的密码, two sets of SFTP credentials, and the staging directory where the majority of the malware’s files are located.

The batch file dllBus.bat contains functionality to facilitate the theft of information from Google Chrome, Mozilla Firefox, 以及多种加密货币钱包. The copy of curl.exe 也用于连接到托管SFTP服务器的命令与控制(C2)地址列表. The curl commands are used to download an updated list of C2 addresses, 以明文形式存储在文件中 dll_srv.txt，并下载和执行保存在加密ZIP档案中的额外有效载荷 Updt.zip, Apps.zip, and BB.zip. 批处理脚本还将尝试压缩受感染系统上具有特定文件扩展名并存在于不在硬编码黑名单(用于泄露)上的目录中的所有文件。. 所有被盗数据最终都使用 7z.exe and uploaded directly to the selected C2 SFTP server using curl.

The payloads Apps.zip and Updt.zip 创建的可执行文件 PyInstaller, 这意味着用于创建可执行文件的原始Python脚本可以使用 publicly available extractor. The payload dllChrome32.exe, contained within Updt.zip, 是用来方便窃取凭证从谷歌浏览器的数据库，然后保存到文件 %TEMP%\chrm.txt 格式为:URL，用户名，密码.

Figure 9. Primary Functionality of dllChrome32.exe.

The payloads dllTemp32.exe and dllCache32.exe stored within Apps.zip 包含一个剪贴板窃取程序和一个键盘记录程序，结果保存到文件中 cl.txt and kl.txt，分别在暂存目录at % LOCALAPPDATA % \ WindowsApps \ \微软.

Figure 10. 复制到剪贴板的所有数据被转储到 cl.txt when dllTemp32.exe is Running.

Figure 11. dllCache32.exe Logs Keystrokes to kl.txt when Running.

Rapid7没有观察到任何托管第三个有效载荷的已识别SFTP服务器。 BB.zip，在写作的时候，虽然内容 dllBus.bat 指示它包含可执行文件 srvBus32.exe and srvCrt32.exe，其功能未知.

Mitigation Guidance

Rapid7 recommends verifying the file integrity of freely available software. 检查下载文件的文件哈希值和属性是否与官方发行商提供的文件和/或它们是否包含有效和相关的签名相匹配. 在这种情况下观察到的恶意安装程序是无符号的，其文件大小与合法安装程序的副本不一致, 就像官方下载页面上写的那样.

如果是Notezilla安装程序, RecentX, or Copywhiz has been executed on a system within the last month, Rapid7建议检查本博客中详细介绍的恶意安装程序造成的危害迹象. The primary indicators of infection include the hidden scheduled task Check dllHourly32 and a persistent running instance of the Windows Command Prompt, cmd.exe，使出站网络连接通过 curl.exe.

如果发现妥协的证据, Rapid7建议将受影响的系统重新映像到已知的良好基线，以消除恶意软件所做的任何更改.

Rapid7 Customers

InsightIDR, 管理检测和响应, 和Managed Threat Complete客户通过Rapid7扩展的检测规则库拥有现有的检测覆盖范围. Rapid7建议在所有适用的主机上安装Insight代理，以确保对可疑进程的可见性和适当的检测覆盖率. 以下是部署的检测的非详尽列表，并将警告与此活动相关的行为:

MITRE ATT&CK Techniques

Indicators of Compromise

网络指标(nbi)

Host-Based Indicators (HBIs)