Gefälschte Installationskette endet mit ValleyRAT-Infektion

Ruslan Mikhalov Leiter der Bedrohungsforschung bei SOC Prime

Folgen

Gefälschte Installationskette endet mit ValleyRAT-Infektion

Detection stack

AIDR
Alert
ETL
Query

Bedrohungsbericht
Angriffsablauf
Erkennungen
Simulationen

Zusammenfassung

Ein trojanisiertes Installationsprogramm, das sich als LINE Messenger-Setup ausgibt, wurde beobachtet, wie es einen ValleyRAT Load lieferte. Erstellt mit NSIS und signiert mit einem verdächtigen Zertifikat, aktiviert der Dropper mehrere DLL- und INI-Komponenten, die Code-Injektion and Persistenzunterstützen. Die Malware kommuniziert dann mit zwei in Hongkong gehosteten C2-Servern, um zusätzliche bösartige Binärdateien abzurufen. Die Aktivität scheint sich gegen chinesischsprachige Benutzer zu richten und verwendet fortschrittliche Taktiken, darunter PoolParty Variante 7 Prozess-Injektion.

Untersuchung

Cybereason-Analysten führten eine statische und dynamische Analyse des gefälschten LINE-Installationsprogramms durch und bestätigten die Verwendung von PowerShell, rundll32und benutzerdefinierten DLL-Loadern. Die Kette erstellte Artefakte in %AppData% and %LocalAppData%, etablierte Synchronisierung über Mutexeund registrierte Persistenz durch geplante Aufgaben , die über RPC erstellt wurden. Das Verhalten nach der Installation umfasste die Injektion in explorer.exe and UserAccountBroker.exe, was mit einem auf Tarnung ausgerichteten Remotezugriffs-Workflow übereinstimmt. Netzwerk-Telemetrie identifizierte zwei in Hongkong befindliche C2-IP-Adressen, die für die Befehlsabfrage und die Bereitstellung von Nutzlasten verwendet werden. Die Zuschreibung wurde als konsistent mit Silver Fox Aktivität bewertet und zeigte Code-Überlappungen mit SADBRIDGE.

Minderung

Suchen Sie nach dem mit NSIS gepackten gefälschten Installationsprogramm und geben Sie Alarm bei verdächtigem Zertifikats-Fingerabdruck in der Signierungskette. Überwachen Sie die Erstellung des gedroppten Dateisets des Installationsprogramms, damit verbundene Registrierungsänderungen und Versuche, Windows Defender-Ausnahmenhinzuzufügen. Blockieren Sie den externen Verbindungsaufbau zu den identifizierten C2-IPs und setzen Sie Code-Signing-Kontrollen durch, die ungültige oder nicht vertrauenswürdige Zertifikate ablehnen. Fügen Sie EDR-Erkennungen für PoolParty Variante 7-Stil Injektionsmuster und für Geplante-Aufgaben-Erstellungssequenzen hinzu, die mit RPC-basierter Persistenz konsistent sind.

Antwort

Wenn verdächtige Aktivitäten festgestellt werden, isolieren Sie den Endpunkt, beenden Sie bösartige Prozesse und entfernen Sie das gefälschte Installationsprogramm sowie alle geladenen Artefakte. Führen Sie einen vollständigen Scan auf zusätzliche ValleyRAT Module durch, stellen Sie die Defender-Einstellungen wieder her (einschließlich der Entfernung nicht autorisierter Ausnahmen) und löschen Sie die von Angreifern erstellten geplanten Aufgaben. Überprüfen Sie die aktuelle Benutzer- und Hostaktivität auf Anzeichen von seitlicher Bewegung, bevor Sie die Vorfälle zur Gedächtnisaufnahme und tieferen forensischen Datensammlung eskalieren.

graph TB %% Klassendefinitionen classDef technique fill:#99ccff classDef file fill:#ffcc99 classDef process fill:#ff9999 classDef malware fill:#ccffcc classDef network fill:#dddddd %% Knoten tech_user_exec[„Technik – T1204 Benutzer-Ausführung Beschreibung: Das Opfer führt einen bösartigen Fake-Installer (LineInstaller.exe) aus, der sich als legitimer LINE-Installer tarnt.“] class tech_user_exec technique tech_masquerade[„Technik – T1036 Maskierung Beschreibung: Installer ahmt den Namen legitimer Software nach und verwendet ein gültig aussehendes Code-Signing-Zertifikat.“] class tech_masquerade technique tech_event_exec[„Technik – T1546.016 Ereignisgesteuerte Ausführung: Installationspakete Beschreibung: NSIS-basierter Installer wird mit erhöhten Rechten über UAC ausgeführt.“] class tech_event_exec technique tech_powershell[„Technik – T1059.001 PowerShell Beschreibung: PowerShell fügt Windows Defender Ausschlusspfade hinzu und bereitet Persistenz-Skripte vor.“] class tech_powershell technique tech_regsvr32[„Technik – T1218.010 Regsvr32 Proxy-Ausführung Beschreibung: Geplanter Task ruft regsvr32.exe auf, um DllRegisterServer in intel.dll auszuführen.“] class tech_regsvr32 technique tech_rundll32[„Technik – T1218.011 Rundll32 Proxy-Ausführung Beschreibung: rundll32.exe startet DllRegisterServer von intel.dll.“] class tech_rundll32 technique tech_sched_task[„Technik – T1053 Geplanter Task Beschreibung: Bösartige geplante Tasks erstellt via RPC-Aufrufe an den Taskplanungsdienst.“] class tech_sched_task technique tech_sandbox_evasion[„Technik – T1497.002 Virtualisierung/Sandbox-Umgehung Beschreibung: intel.dll prüft Datei-Locks und Mutexes, um Sandbox-Umgebungen zu erkennen.“] class tech_sandbox_evasion technique tech_pe_injection[„Technik – T1055.002 Prozessinjektion: Portable Executable Injection Beschreibung: intel.dll und sangee.ini injizieren Shellcode in Explorer.exe mittels PoolParty Variant 7.“] class tech_pe_injection technique tech_apc_injection[„Technik – T1055.004 Prozessinjektion: Asynchronous Procedure Call Beschreibung: Injektion nutzt ZwSetIoCompletion mit einem I/O Completion Port Handle.“] class tech_apc_injection technique tech_exploit_defense[„Technik – T1211 Ausnutzung zur Verteidigungsumgehung Beschreibung: Malware ruft SetTcpEntry auf, um TCP-Verbindungen von Sicherheitskomponenten zu löschen.“] class tech_exploit_defense technique tech_obfuscation[„Technik – T1027.005 Verschleierte Dateien: Indikatoren entfernen Beschreibung: Anti-Sandbox- und Anti-Analyse-Prüfungen verbergen Artefakte und verhindern die Ausführung in Analyseumgebungen.“] class tech_obfuscation technique tech_web_service[„Technik – T1102 Webdienst Beschreibung: Endgültiges Payload ValleyRat von Remote-C2-Servern über Standard-TCP abgerufen.“] class tech_web_service technique file_lineinstaller[„Datei – Name: LineInstaller.exe Typ: NSIS Installer“] class file_lineinstaller file file_inteldll[„Datei – Name: intel.dll Typ: DLL für Proxy-Ausführung und Injektion“] class file_inteldll file file_sangee[„Datei – Name: sangee.ini Zweck: Konfiguration für Injektionsroutinen“] class file_sangee file file_policyxml[„Datei – Name: policyManagement.xml Zweck: Definiert geplante Task-Details“] class file_policyxml file file_updatedps1[„Datei – Name: updated.ps1 Zweck: PowerShell-Persistenz-Skript“] class file_updatedps1 file malware_valleyrat[„Malware – Name: ValleyRat Rolle: Endgültiges Payload für das Opfer“] class malware_valleyrat malware process_regsvr32[„Prozess – Name: regsvr32.exe“] class process_regsvr32 process process_rundll32[„Prozess – Name: rundll32.exe“] class process_rundll32 process process_explorer[„Prozess – Name: Explorer.exe“] class process_explorer process network_c2[„Netzwerk – C2 Server: 143.92.38.217:18852, 206.238.221.165:443“] class network_c2 network %% Verbindungen tech_user_exec –>|startet| file_lineinstaller file_lineinstaller –>|löst aus| tech_masquerade tech_masquerade –>|aktiviert| tech_event_exec tech_event_exec –>|erhöht zu| process_regsvr32 process_regsvr32 –>|ruft auf| file_inteldll file_inteldll –>|registriert über| tech_regsvr32 tech_regsvr32 –>|verwendet auch| process_rundll32 process_rundll32 –>|lädt| file_inteldll tech_rundll32 –>|lädt ebenfalls| file_inteldll file_inteldll –>|erstellt| tech_sched_task tech_sched_task –>|erstellt Task mit| file_policyxml tech_sched_task –>|führt aus| file_updatedps1 file_updatedps1 –>|führt PowerShell-Befehle für| tech_powershell aus tech_powershell –>|fügt Ausnahmen hinzu und bereitet vor| tech_sandbox_evasion tech_sandbox_evasion –>|prüft Umgebung vor| tech_pe_injection tech_pe_injection –>|injiziert in| process_explorer tech_pe_injection –>|verwendet| tech_apc_injection tech_apc_injection –>|nutzt| tech_exploit_defense tech_exploit_defense –>|stört Sicherheitstools| file_sangee tech_obfuscation –>|versteckt Artefakte für| malware_valleyrat malware_valleyrat –>|abgerufen von| network_c2 network_c2 –>|liefert Payload über| tech_web_service tech_web_service –>|endgültige Lieferung an| process_explorer

Angriffsfluss

Angriffserzählung & Befehle:
Ein Angreifer, der bereits ein niedrig-privilegiertes Konto kompromittiert hat, möchte eine Nutzlast auf dem kompromittierten Host bereitstellen, während er die Überprüfung durch Antiviren-Programme umgeht. Der Angreifer:
1. Verwendet PowerShell, um eine Windows Defender-Ausnahme hinzuzufügen, die das gesamte C: Laufwerk umfasst, wodurch sichergestellt wird, dass alle dort platzierten bösartigen Binärdateien für Defender unsichtbar sind.
2. In derselben PowerShell Ausführung registriert eine geplante Aufgabe, die die versteckte Nutzlast startet (C:Malwarepayload.ps1) jedes Mal, wenn ein bestimmter legitimer Prozess (z. B. explorer.exe) gestartet wird, wodurch Persistenz gewährleistet wird.
3. Weil beide Aktionen zu einem einzigen Kommandozeilen-Befehl kombiniert wurden, entspricht die Telemetrie der Sigma-Regel Auswahl1 und Auswahl2 Bedingung, was einen Alarm auslöst.

Regressionstest-Skript:

# -------------------------------------------------
# Gefälschte Installationssimulierung – Löst Sigma-Regel aus
# -------------------------------------------------
# 1. Definieren Sie den Ausschlusspfad (gesamtes C: Laufwerk)
$exclusion = "C:"
# 2. Definieren Sie Details der geplanten Aufgabe
$taskName = "UpdateScheduler"
$action   = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File C:Malwarepayload.ps1"
$trigger  = New-ScheduledTaskTrigger -AtLogOn
# 3. Kombinieren Sie beide Befehle zu einer einzigen PowerShell-Kommandozeile
$combined = "Add-MpPreference -ExclusionPath `"$exclusion`"; Register-ScheduledTask -TaskName `"$taskName`" -Action `$action -Trigger `$trigger -Force"
# 4. Rufen Sie den kombinierten Befehl auf
Invoke-Expression $combined

Bereinigungskommandos:

# -------------------------------------------------
# Bereinigung – Entfernen Sie die Ausnahme und die geplante Aufgabe
# -------------------------------------------------
# Entfernen Sie die Defender-Ausnahme für C:
Remove-MpPreference -ExclusionPath "C:"
# Löschen der geplanten Aufgabe
Unregister-ScheduledTask -TaskName "UpdateScheduler" -Confirm:$false

Treten Sie der Detection as Code-Plattform von SOC Prime bei um die Sichtbarkeit der für Ihr Unternehmen relevantesten Bedrohungen zu verbessern. Um Ihnen den Einstieg zu erleichtern und unmittelbaren Mehrwert zu erzielen, buchen Sie jetzt ein Treffen mit den Experten von SOC Prime.

Kostenlos beitreten

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.