Summary:
A new malware campaign called "Information" has emerged, resembling the QUARTERRIG malware previously analyzed by researchers and associated with APT29 called Dark Halo, a Russian hacker group. The campaign utilizes email as its main entry vector, with attackers sending PDF attachments containing links to download an ISO file. The new campaign showcases updated features compared to previous iterations, including a change in the injection method. The malware is now contained within an ISO file which includes a DLL for injecting the shellcode and a file containing the shellcode itself. Another legitimate binary file signed by Microsoft, is used to load the DLL via DLL Side-Load. The main differences in the new campaign involve the injection technique and modifications to the DLLs involved, aiming to evade detection. The specific command and control (C2) methods employed in this campaign also vary.[/subscribe_to_unlock_form]
Summary:
A new malware campaign called "Information" has emerged, resembling the QUARTERRIG malware previously analyzed by researchers and associated with APT29 called Dark Halo, a Russian hacker group. The campaign utilizes email as its main entry vector, with attackers sending PDF attachments containing links to download an ISO file. The new campaign showcases updated features compared to previous iterations, including a change in the injection method. The malware is now contained within an ISO file which includes a DLL for injecting the shellcode and a file containing the shellcode itself. Another legitimate binary file signed by Microsoft, is used to load the DLL via DLL Side-Load. The main differences in the new campaign involve the injection technique and modifications to the DLLs involved, aiming to evade detection. The specific command and control (C2) methods employed in this campaign also vary.[emaillocker id="1283"]
In the "Information" campaign, the injection technique and execution flow of the malware differ from the previous "Note" campaign. The loading of necessary functions by the dll occurs at a later stage in the execution process compared to the "Note" campaign. The injection process itself is more sophisticated, involving modification of the .text section of legitimate libraries. The malware selects a suitable DLL for injection by iterating through the DLLs stored in System32, checking their size and whether they are already loaded in the executable. The chosen DLL is determined using a randomization function based on the system time. Once a DLL is selected, the malware performs checks on its headers, such as the "Magic" value and the size of the "SizeOfImage" field. If the DLL meets the requirements, a memory section is created, and the DLL is mapped in memory. The write permissions are modified to allow the injection of the shellcode into the .text section, after which the permissions are reverted. The execution process then follows a similar pattern to the QUARTERRIG malware, with a different command and control (C2) using the URL.
Execution Flow
Dark Halo, also known as APT29, is a sophisticated hacker group believed to be affiliated with Russian intelligence agencies. With a history dating back to 2008, Dark Halo has been consistently targeting European governments and diplomatic agencies. The group's evolving campaigns, such as the recent "Information" campaign, demonstrate their ability to adapt and enhance their malware techniques, particularly in the realm of DLL injection. By leveraging legitimate DLLs and employing complex injection methods, Dark Halo aims to evade detection and maximize the effectiveness of their cyber espionage activities. As a persistent and skilled threat actor, Dark Halo poses a significant challenge to targeted organizations and highlights the ongoing need for robust cybersecurity measures and threat intelligence.
Threat Profile:
References:
The following reports contain further technical details:
[/emaillocker]