www.trendmicro.com
Open in
urlscan Pro
23.32.242.31
Public Scan
URL:
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html
Submission: On August 09 via api from DE — Scanned from DE
Submission: On August 09 via api from DE — Scanned from DE
Form analysis
1 forms found in the DOM<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___gjfCC">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>
Text Content
Business search close * Solutions * By Challenge * By Challenge * By Challenge Learn more * Understand, Prioritize & Mitigate Risks * Understand, Prioritize & Mitigate Risks Improve your risk posture with attack surface management Learn more * Protect Cloud-Native Apps * Protect Cloud-Native Apps Security that enables business outcomes Learn more * Protect Your Hybrid World * Protect Your Hybrid, Multi-Cloud World Gain visibility and meet business needs with security Learn more * Securing Your Borderless Workforce * Securing Your Borderless Workforce Connect with confidence from anywhere, on any device Learn more * Eliminate Network Blind Spots * Eliminate Network Blind Spots Secure users and key operations throughout your environment Learn more * See More. Respond Faster. * See More. Respond Faster. Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities Learn more * Extend Your Team * Extend Your Team. Respond to Threats Agilely Maximize effectiveness with proactive risk reduction and managed services Learn more * Operationalizing Zero Trust * Operationalizing Zero Trust Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console Learn more * By Role * By Role * By Role Learn more * CISO * CISO Drive business value with measurable cybersecurity outcomes Learn more * SOC Manager * SOC Manager See more, act faster Learn more * Infrastructure Manager * Infrastructure Manager Evolve your security to mitigate threats quickly and effectively Learn more * Cloud Builder and Developer * Cloud Builder and Developer Ensure code runs only as intended Learn more * Cloud Security Ops * Cloud Security Ops Gain visibility and control with security designed for cloud environments Learn more * By Industry * By Industry * By Industry Learn more * Healthcare * Healthcare Protect patient data, devices, and networks while meeting regulations Learn more * Manufacturing * Manufacturing Protecting your factory environments – from traditional devices to state-of-the-art infrastructures Learn more * Oil & Gas * Oil & Gas ICS/OT Security for the oil and gas utility industry Learn more * Electric Utility * Electric Utility ICS/OT Security for the electric utility Learn more * Federal * Federal Learn more * Automotive * Automotive Learn more * 5G Networks * 5G Networks Learn more * Platform * Vision One Platform * Trend Vision One Our Unified Platform Bridge threat protection and cyber risk management Learn more * Attack Surface Management * Attack Surface Management Operationalize a zero trust strategy Learn more * XDR (Extended Detection & Response) * XDR (Extended Detection & Response) Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Endpoint Security * Endpoint Security * Endpoint Security Overview Defend the endpoint through every stage of an attack Learn more * Workload Security * Workload Security Optimized prevention, detection, and response for endpoints, servers, and cloud workloads Learn more * Industrial Endpoint Security * Industrial Endpoint Security Learn more * Cloud Security * Cloud Security * Trend Cloud One Cloud Security Overview The most trusted cloud security platform for developers, security teams, and businesses Learn more * Cloud Security Posture Management * Cloud Security Posture Management Leverage complete visibility and rapid remediation Learn more * Container Security * Container Security Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection Learn more * File Storage Security * File Storage Security Security for cloud file/object storage services leveraging cloud-native application architectures Learn more * Network Security * Network Security Advanced cloud-native network security detection, protection, and cyber threat disruption for your single and multi-cloud environments. Learn more * Open Source Security * Open Source Security Visibility and monitoring of open source vulnerabilities for SecOps Learn more * Cloud Visibility * Cloud Visibility As your organization continues to move data and apps to the cloud and transform your IT infrastructure, mitigating risk without slowing down the business is critical. Learn more * Network Security * Network Security * Network Security Overview Expand the power of XDR with network detection and response Learn more * Network Intrusion Prevention (IPS) * Network Intrusion Prevention (IPS) Protect against known, unknown, and undisclosed vulnerabilities in your network Learn more * Breach Detection System (BDS) * Breach Detection System (BDS) Detect and respond to targeted attacks moving inbound, outbound, and laterally Learn more * Secure Service Edge (SSE) * Secure Service Edge (SSE) Redefine trust and secure digital transformation with continuous risk assessments Learn more * Industrial Network Security * Industrial Network Security Learn more * Email Security * Email Security Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise Learn more * Mobile Security * Mobile Security On-premises and cloud protection against malware, malicious applications, and other mobile threats Learn more * Threat Intelligence * Threat Intelligence Keep ahead of the latest threats and protect your critical data with ongoing threat prevention and analysis Learn more * Small & Midsized Business Security * Small & Midsized Business Security Stop threats with comprehensive, set-it-and-forget-it protection Learn more * All Products, Services and Trials * All Products, Services and Trials Learn more * Research * Research * Research * Research Learn more * About Our Research * About Our Research Learn more * Research, News, and Perspectives * Research, News, and Perspectives Learn more * Research and Analysis * Research and Analysis Learn more * Blog * Blog Learn more * Security News * Security News Learn more * Zero Day Initiatives (ZDI) * Zero Day Initiatives (ZDI) Learn more * Services * Our Services * Our Services * Our Services Learn more * Service Packages * Service Packages Augment security teams with 24/7/365 managed detection, response, and support Learn more * Managed XDR * Managed XDR Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks Learn more * Incident Response * Incident Response Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans Learn more * Support Services * Support Services Learn more * Partners * Channel Partners * Channel Partners * Channel Partner Overview Grow your business and protect your customers with the best-in-class complete, multilayered security Learn more * Managed Security Service Provider * Managed Security Service Provider Deliver modern security operations services with our industry-leading XDR Learn more * Managed Service Provider * Managed Service Provider Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs Learn more * Cloud Service Provider * Cloud Service Provider Add market-leading security to your cloud service offerings – no matter which platform you use Learn more * Professional Services * Professional Services Increase revenue with industry-leading security Learn more * Resellers * Resellers Discover the possibilities Learn more * Marketplace * Marketplace Learn more * System Integrators * System Integrators Learn more * Alliance Partners * Alliance Partners * Alliance Overview We work with the best to help you optimize performance and value Learn more * Technology Alliance Partners * Technology Alliance Partners Learn more * Our Alliance Partners * Our Alliance Partners Learn more * Partner Tools * Partner Tools * Partner Tools Learn more * Partner Login * Partner Login Login * Education and Certification * Education and Certification Learn more * Partner Successes * Partner Successes Learn more * Distributors * Distributors Learn more * Find a Partner * Find a Partner Learn more * Company * Why Trend Micro * Why Trend Micro * Why Trend Micro Learn more * The Trend Micro Difference * The Trend Micro Difference Learn more * Customer Success Stories * Customer Success Stories Learn more * The Human Connection * The Human Connection Learn more * Industry Accolades * Industry Accolades Learn more * Strategic Alliances * Strategic Alliances Learn more * About Us * About Us * About Us Learn more * Trust Center * Trust Center Learn more * History * History Learn more * Diversity, Equity and Inclusion * Diversity, Equity and Inclusion Learn more * Corporate Social Responsibility * Corporate Social Responsibility Learn more * Leadership * Leadership Learn more * Security Experts * Security Experts Learn more * Internet Safety and Cybersecurity Education * Internet Safety and Cybersecurity Education Learn more * Legal * Legal Learn more * Investors * Investors Learn more * Connect with Us * Connect with Us * Connect with Us Learn more * Newsroom * Newsroom Learn more * Events * Events Learn more * Careers * Careers Learn more * Webinars * Webinars Learn more Back Back Back Back * Free Trials * Contact Us Looking for home solutions? Under Attack? 0 Back Folio (0) Support * Business Support Portal * Virus and Threat Help * Renewals and Registration * Education and Certification * Contact Support * Find a Support Partner Resources * Cyber Risk Index/Assessment * CISO Resource Center * DevOps Resource Center * What Is? * Threat Encyclopedia * Cloud Health Assessment * Cyber Insurance * Glossary of Terms * Webinars Log In * Support * Partner Portal * Cloud One * Product Activation and Management * Referral Affililate Back arrow_back search close Content has been added to your Folio Go to Folio (0) close Ransomware TARGETCOMPANY RANSOMWARE ABUSES FUD OBFUSCATOR PACKERS In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems. By: Don Ovid Ladores, Nathaniel Morales August 07, 2023 Read time: 5 min (1215 words) Save to Folio Subscribe -------------------------------------------------------------------------------- We found active campaign deployments combining remote access trojan (RAT) Remcos and the TargetCompany ransomware earlier this year. We compared these deployments with previous samples and found that these deployments are implementing fully undetectable (FUD) packers to their binaries. By combining telemetry data and external threat hunting sources, we were able to gather early samples of these in development. Recently, we found a victim on which this technique was deployed and targeted specifically at. Figure 1. Latest TargetCompany ransomware infection chain Achieving persistence Like previously documented TargetCompany ransomware attacks, the latest variant starts with the exploitation of vulnerable SQL servers to persistently deploy its first stage. The routine tries various directions to attempt persistence, such as changing up the URLs or applicable paths until it successfully finds an area to execute the Remcos RAT. Table 1. Sample download attempts to deploy Remcos RAT URL Expected drop path Notes Results _hxxp://80.66.75[.]37/drtse.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://185.209.230[.]21:8080/lighting.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://80.66.75.37/Ayhhny.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://80.66.75[.]37/lawer.exe %TEMP%\1DKPCKM7.exe %TEMP%\VOCNDGB2.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://80.66.75[.]37/Bwarp.exe %TEMP%\WIMZJ19D.exe %TEMP%\YLJ7ZVT0.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://185.209.230[.]21:8080/Auptxums.bat %TEMP%\tzt.bat Executed with %TEMP%\updt.ps1 Drop and execution of Remcos RAT (Blocked by current Trend Micro solutions) Figure 2. Download attempts for the first stage Since the initial efforts were terminated and blocked by the existing solutions, the attackers opted to use the FUD-wrapped version of their binaries. The FUD packer used by Remcos and the one used by the TargetCompany ransomware has a style of packaging that closely resembles the style used by BatCloak: Using a batch file as an outer layer and afterward, decoding and loading using PowerShell to make a LOLBins execution. Figure 3. PowerShell execution of the Remcos RAT, also showing the typical routine for malware wrapped in FUD packers Metasploit usage This variant’s routine used another unique tool, which our analysis identified as Metasploit (Meterpreter) usage. This group is not widely known to use such tools, so it is interesting to see it leverage Metasploit to do the following: * * Query/Add a local account * * Deploy GMER * * Deploy IObit Unlocker * * Deploy PowerTool (or PowTool) Afterward, the Remcos RAT will resume its final routine as it downloads and deploys the TargetCompany ransomware still wrapped in an FUD packer. Table 2. Metasploit module for executing shell commands Subject process Child process Command line C:\temp\straightforward.exe C:\windows\syswow64\net.exe localgroup administrators [~redacted] /ad Tracking the loader’s rising popularity The previous wave of campaigns abusing OneNote made headlines because of the technique’s novelty: the use of a specific PowLoad and a corresponding CMDFile (batchfile or.bat) that contained the actual payload. Since it was first released, the specific “cmd x PowerShell” loader has slowly been gaining traction. By the end of February 2022, TargetCompany ransomware operators adopted the tactic. Figure 4. FUD loaders and TargetCompany ransomware deployment activities Analyzing the loader differences The CMDFiles were initially indistinguishable between the other users (malware families AsyncRAT, Remcos, and the TargetCompany ransomware) of the batch file technique. The use of the CMDFiles starts to differ with the execution of the command line and during the load of the main binaries. While AsyncRAT employs decompression and decryption, the loaders related to Remcos and TargetCompany only used decompression to unpack the payload and changed the general appearance of its structure while maintaining the same functionality. Figure 5. The BatLoad appeared similar in structure between the versions found in previous deployment reports and samples. Figure 6. Bare and unobfuscated AsyncRAT loader command line (top) and decoded loader command line of Remcos and the TargetCompany ransomware For the AsyncRAT loader, the CMDFile loads the binary payload successfully regardless of whether the system’s architecture is 32-bit or 64-bit. With the routines in Remcos and TargetCompany, however, the powershell.exe file is hard-coded to find the deobfuscated Remcos CMDFile only in the SysWOW64 folder. Even though the payload binary works in both 32-bit and 64-bit systems, the way that the PowerShell file is hard-coded “almost” guarantees that the routine will fail to execute in 32-bit systems given that it is usually only found in 64-bit systems. Microsoft has required new Windows 10 systems since version 2004 (released in the middle of 2020) to be 64-bit; Windows 11 was never released in a 32-bit version. Running this malware on a 32-bit operating system is therefore something of an edge case which we need not discuss here. Figure 7. Decoded loader command line in Remcos and the TargetCompany ransomware Figure 8. Deobfuscated Remcos CMDFile showing the copying of the PowerShell routine Technique adoption When we investigated the suspicious network connections related to the PowerShell, we discovered the new variant of the TargetCompany ransomware. When we checked the payload binary, we saw that the variant belongs to the second version of the said ransomware family, commonly characterized by a connection to a command-and-control (C&C) server with a “/ap.php” landing page. Figure 9. C&C communication by the TargetCompany ransomware Pivoting from the IP address or URL, we found samples from a public repository verified to be the Remcos RAT. Considering the uses for obfuscation of the different batch files in a previous section, as well as the fact that for every execution of Remcos there is also an instance of an attack by the TargetCompany ransomware, we were not surprised at the use of the technique. Similarly, we found a verified Remcos sample with zero detections on public repositories. Insights The use of FUD malware already limits most available solutions for this said tactic, even more so for off-the-shelf technologies likely susceptible to other attacks (not just ransomware). This set of packers will likely not be the only ones being developed in the near future. Early detection allows security teams and analysts to detect these FUD packers as their respective routines and coding follow a certain flow that makes it easy to prevent. At the same time, this also allows these organizations’ teams to check for increases in usage even through external threat intelligence sources and repositories. Attackers will keep innovating even the simplest means of abuse. While the technique of using FUD packers and Metasploit has been around for a while now, security teams and organizations should not underestimate its effectivity in circumventing current and established security solutions, especially in key features that leave technologies almost blind until a victim is documented. To date, majority of TargetCompany ransomware’s victims still stem from vulnerable SQL Servers being exploited to gain entry. Security teams should have visibility and check all possible attack surfaces to ensure their respective systems are not susceptible to abuse and exploitation. Meanwhile, we deem the FUD packer a tool that can easily be altered without much effort, and current solutions might well be one step behind these developments. Fortunately, AI- and machine learning-based file checking and behavior monitoring solutions, best practices for network blocking, and ransomware detection and blocking measures can act as multiple layers in mitigating the impact of these threats’ risks. Organizations should encourage and implement redundant exercises ensuring users’ awareness of their own systems and networks to prevent intrusion attempts and execution of malicious activities. Indicators of Compromise (IOCs) Download the list of indicators here. Tags Malware | Cyber Crime | Exploits & Vulnerabilities | Cyber Threats | Data center | Endpoints | Ransomware | Network | Articles, News, Reports AUTHORS * Don Ovid Ladores Threats Analyst * Nathaniel Morales Threat Analyst Contact Us Subscribe RELATED ARTICLES * Zero Trust Frameworks for Industry * An Overview of the New Rhysida Ransomware Targeting the Healthcare Sector * Cybersecurity Threat 1H 2023 Brief with Generative AI See all articles Try our services free for 30 days * Start your free trial today * * * * * RESOURCES * Blog * Newsroom * Threat Reports * DevOps Resource Center * CISO Resource Center * Find a Partner SUPPORT * Business Support Portal * Contact Us * Downloads * Free Trials * * ABOUT TREND * About Us * Careers * Locations * Upcoming Events * Trust Center * Select a country / region United States expand_more close THE AMERICAS * United States * Brasil * Canada * México MIDDLE EAST & AFRICA * South Africa * Middle East and North Africa EUROPE * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom ASIA & PACIFIC * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam Privacy | Legal | Accessibility | Site map Copyright ©2023 Trend Micro Incorporated. All rights reserved sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk This website uses cookies for website functionality, traffic analytics, personalization, social media functionality and advertising. Our Cookie Notice provides more information and explains how to amend your cookie settings.Learn more Cookies Settings Accept word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 Sumo