APT28 and Upcoming Elections: Evidence of Possible Interference (Part II)

Introduction

The uncertain attribution of the Ukrainian themed malicious document discussed in our past article “APT28 and Upcoming Elections: Possible Interference Signals”, led us to a review of Sofacy’s phishing techniques to confirm or deny the possible involvement of Russian state-sponsored actors in the election interference. We ended up in an old fake Hotel reservation request form, containing dummy interactive text boxes used to lure the victims to enable the macro code execution.

We analyzed this sample two years ago and we linked it to a Sofacy attack operation discovered by FE researchers in the mid of 2017, which hit several hotels in European and Middle Eastern countries.

Technical Analysis

The macro code inside the 2017 document is password protected, just like the last suspicious document we analyzed to investigate a possible Ukraine elections interference by Russian groups. After its opening, the reference sample decodes the extracted Base64 content using a custom “DecodeBase64” function:

The decoded content is actually a DLL file which is written into “%AppData%\user.dat”. After that, it will be executed through an ASR bypass technique (Attack Surface Reduction) allowing attackers to run new child process within the Office environment. This is the same publicly available exploit previously found into the Ukrainian sample (more details in the next section).

In this reference sample, the “user.dat”’s purpose is to create two new artifacts and to set persistence through “HKCU\Environment->UserInitMprLogonScript”. The created files are:

• %AppData%\mrset.bat
• %AppData%\mvtband.dat

The “mrset.bat” file is a short bash file, designed to check the “mvtband.dat” existence and to run it through “rundll32.exe” system utility.

Finally, the “mvtband.dat” file, which actually is a Delphi DLL library, is a well-known malware named “GAMEFISH” (f9fd3f1d8da4ffd6a494228b934549d09e3c59d1). Russian groups were used to use it in recon-phases to steal information from victim machine and to implant new payloads.

Comparison with Ukrainian Elections Sample

Despite some differences between the "Hospitality campaign" vector and the Ukraine elections one, both use similar TTP related to the APT28 group. The link between Hospitality malware and the "FancyBear" actor has been already sifted by Info-Sec community. So, we can exploit the similarities between it and the Ukrainian elections sample to link it to Russian hacker groups.

Both documents under analysis use protected macro code. All the code inside the macro is not obfuscated in any way: Hospitality document surprisingly contains code comments too. Moreover, the main macro function name is “Execute” for both documents and the ASR trick used to create new processes from the Office work-space is substantially the same.

In both cases the real payload is encoded in Base64 and it is stored into an Office hidden section: the first sample uses a document property, the second one employs an XML resource.

The next stages are different: the Ukraine sample deploys some Powershell obfuscated scripts, which at the end carry an Empire stager, allowing the attackers to directly interact with the victim machine; the reference sample, instead, implants the GAMEFISH malware which automatically exfiltrates victim information while waiting for new payloads to install.

Conclusion

Finally, the attribution of the Ukraine elections sample (highlighted in our previous report) can be confirmed due to the strong similarities with the first stage of the Sofacy’s Hospitality malware, because:

• Both use password protection.
• Both have the same function name.
• Both have the same macro code structure.
• Both embeds the real payload in a hidden document section.
• The ASR trick is implemented using the same instructions.

The presence of these similarities between the droppers indicates, with high probability, the attacker is the same and consequentially suggests APT28 is reusing some 2017 tricks and code snippets which, despite their simplicity, make their attacks effective.

Indicators of Compromise

• Hash:
  • b40cbf38284e6a1b9157002ad564e40fad2d85ba36437cf95c3b6326ad142520
  • 353aa1f03b36ee51138b61ef1f91f75de01850d73d619bbe5a0050594eba660d
  • 58b223f74992f371cab8f1df7c03b9b66f2ea9e3c9e22122898a9be62a05c0b4
  • 51eaf3b30c1ea932843cb9f5b6fb41804976d94a53a507ccb292b8392276cfd6
  • 8c47961181d9929333628af20bdd750021e925f40065374e6b876e3b8afbba57
  • e259df89e065c4162b273ebb18b75ea153f9bafe30a8c6610204ccf5e3f4ebcd

Yara Rules

rule APT28_office_document_dropper_GAMEFISH {
    meta:
   	 description = "Yara Rule for office_document dropper (2017)"
   	 author = "ZLAB Yoroi-Cybaze"
   	 last_updated = "2019-04-16"
   	 tlp = "white"
   	 category = "informational"
    strings:
   	 $a = "word\\vbaProject.binPK"
   	 $b = {E3 5D B8 1E 9C C7 11 F4 1E}
   	 $c = {36 B7 DD E9 6F 33 4b D7 E7 7F}
    condition:
   	 all of them
}

import "pe"
rule APT28_user_dll {
    meta:
   	 description = "Yara Rule for user_dll (2017)"
   	 author = "ZLAB Yoroi-Cybaze"
   	 last_updated = "2019-04-16"
   	 tlp = "white"
   	 category = "informational"
    strings:
   	 $a = "MZ"
   	 $b = "GetEnvironmentVariable"
   	 $c = {49 73 50 72 6F 63 65 73 73 6F 72}
    condition:
   	 all of them and pe.number_of_sections == 5
}

rule APT28_mrset_bat {
    meta:
   	 description = "Yara Rule for mrset_bat_file (2017)"
   	 author = "ZLAB Yoroi-Cybaze"
   	 last_updated = "2019-04-16"
   	 tlp = "white"
   	 category = "informational"
    strings:
   	 $a = "inst_pck"
   	 $b = "mvtband.dat"
    condition:
   	 all of them
}

import "pe"
rule APT28_mvtband_dat_dll {
    meta:
   	 description = "Yara Rule for mvtband_dat_dll (2017)"
   	 author = "ZLAB Yoroi-Cybaze"
   	 last_updated = "2019-04-16"
   	 tlp = "white"
   	 category = "informational"
    strings:
   	 $a = "DGMNOEP"
   	 $b = {C7 45 94 0A 25 73 30 8D 45 94} // two significant instructions

    condition:
   	 all of them and pe.sections[2].raw_data_size == 0 and pe.version_info["OriginalFilename"] contains "mvtband"
}