start	end	text
1210	4050	Hello and welcome to my presentation with the title
4050	6710	Hunting for Blue Mockingbird Coin Miners.
6710	10230	I am Vladislav Bačov and I would like to spend the next 20 or 25 minutes
10230	13090	with talking about incident response and investigation
13090	17350	of the recent incidents attributed to the relatively new trade actor
17350	19250	called Blue Mockingbird.
20030	23070	But because we are in a recon village,
23070	26390	this talk will not be about incident response only.
26390	28670	Instead, I would like to share with you
28670	31310	how our experiences have used reconnaissance
31310	33290	and open source intelligence approaches
33290	37570	to enrich our results from standard forensic and malware analysis.
37590	40830	As often happens, the attackers have deleted
40830	43670	some of their tools after they used them.
43670	47050	However, with our recon and OSing approach,
47050	49990	we were able to find them and reconstruct the original attack
49990	51670	performed by the attackers.
51850	54610	Moreover, we were able to track origin of the malware
54610	57390	and we got insight into the technical capabilities
57390	59690	of the Blue Mockingbird trade actor.
59830	61770	And finally, in some cases,
61770	65970	we could track the incomings of the cryptocurrency wallets
65970	67270	used by Blue Mockingbirds
67270	69750	and we can estimate profit of the attackers
69750	73590	and compare it with the damage they caused to their victims.
74810	76770	So, this is our agenda.
76770	78930	And now, let me allow to introduce myself.
78930	79970	Who am I?
80150	82350	I am Vladislav Bačov and I currently work
82350	85910	as a security senior consultant and malware analyst for Lifers,
85990	90570	a New York City-based incident response and digital forensic company.
90570	93930	In the past, I also worked for the government of one European country
93930	98410	as an analyst in CSIRT, Computer Security Incident Response Team Slovakia.
99670	100630	But now...
101890	102230	Okay...
102570	105170	We can ask one obvious question.
105610	108210	Why a presentation about malware analysis,
108210	110130	threat intelligence and OSing?
110730	114010	There are a lot of automated solutions,
114010	116590	such as antivirus scanners and sandboxes.
116590	119890	So, why do we need to bother with additional malware analysis
119890	124090	and enrichments with info from another public sources,
124090	128370	if those automated solutions can identify most of the common threats?
128370	132090	Well, the answer is hidden in the previous sentence.
132570	136170	They can identify the most of the common threats.
136170	139090	And I would like to emphasize the word common.
139690	141890	When you need to deal with advanced threat actors
141890	147310	or uncommon threats, such as rare or obfuscated malware samples,
147310	153530	they can stay undetected by many of antivirus scanners and sandboxes.
153530	158330	On the other hand, malware analysts can perform a brief analysis of those samples.
158330	163290	And moreover, if they enrich the better results with intelligence info,
163290	169250	they can quickly provide the rest of the team with accurate report.
169250	173490	And this report can include not only the purpose and capabilities of the malware,
173490	178540	but also origin of the samples or attributions to the threat actors.
179190	183410	It can also help to reveal yet undiscovered steps of attacker,
183410	188480	as well as it can recover yet missing pieces of malware puzzle used by attacker.
188850	193030	And last but not least, this brief analysis with intelligence data
193030	199370	can collect more indicator of compromise relevant for threat intelligence,
199370	202170	for threat hunting and monitoring team.
204290	209850	And when we are talking about using threat intelligence fees and other data sources,
209850	212310	we can search for many attributes.
212950	218510	There are obvious ones like URLs, hashes, and so on.
218510	223450	But in addition, very helpful can be searched by file name, regular expressions,
223450	227550	and malware classifications, such as categories and tags.
227550	231730	Also, search for strings embedded in the malware or search by import hashes
231730	238670	can discover more similar samples, which can be linked to the same attacks or to the same threat actors.
239710	241330	And where to search?
241330	247990	Here is a list of couple of examples, which will be covered later during this talk.
247990	251670	And also, some of these tools can be very handy for the analyst.
251670	255310	But these slides will be shared with you, so let's move forward.
255830	262650	And okay, now we are ready to start with advertised incident response and infection with coin miners.
263990	269390	So, it began with a high load of some computers.
269390	274990	One could say, nothing strange, maybe only updates were being applied.
274990	281350	But when local IT guys verified these machines, they noticed something unusual.
281350	285830	Abnormally high CPU and memory usage by SVC host process.
285830	292910	Moreover, the SVC host process corresponded with the problem reports and solution control panel support service.
293110	297190	This could be a more serious problem, indeed.
297950	301710	Antivirus did not find anything.
301710	310170	But after manual submission of DLLs, the antivirus company identified them as coin miner or crypto mining variant.
310170	313630	So, that's how the incident response began.
314730	321010	We verified the findings of our client and we started analyzing machine with the coin miner.
321350	326410	We followed the usual procedures and examined the provided evidence.
326410	336850	We also verified signatures of DLLs in Windows System 32 directory and we checked those files against the National Software Reference Library database.
336850	340790	As a result, we found a couple of malicious files.
340790	353290	For example, this unknown file where CPL support E-DLL, which tries to mimics the legitimate one file name without E suffix.
355210	362510	On the infected systems, there were a couple of DLLs marked as wannabe Windows System DLL files.
362510	373890	But their hashes and also their file names were not present in any databases of known software and also in clean Windows systems they were not found.
373890	386870	In addition, we saw that the extracted strings contained many occurrences of xamarin substrings, so we had to deal with infection of xamarin-based coin miner.
387970	394270	And there is another thing common for all of these xamarin-based coin miner DLLs.
394270	405630	They created a mutex called samplexn07 and this mutex ensures that only one instance of coin miner is running on each infected device.
405770	418150	I need to add that this mutex name can be used as an additional indicator of compromise and also it can be used for finding another related samples in public databases.
420480	426740	While the most detected fake DLLs had the same hash, there was only one with different hash.
426880	439810	It executed the command line with the command for creation of scheduled task called windows-problem-collections and as well as other persistence via services.
440280	446020	Thus, it was responsible for one part of persistent mechanism we already found.
446020	452980	But the question is, what else attacker deployed in the client network and how they got access to the network?
454160	462780	First steps of forensic analysis revealed the one batch file called x.bat and couple of suspicious tasks.
463400	471320	The batch file contained the PowerShell downloader, which downloads additional content from JavaScript resource on the local web server.
471320	477580	However, it was not JavaScript, but PowerShell, which created the scheduled task.
477920	482320	And these scheduled tasks used the file called scriptstamp.
482320	487780	In our case, it contains a backdoor, a Netcat backdoor.
488140	490740	And what about its origin?
490740	503560	The threat intelligence search based on file names and strings led us to the four years old scheduled task backdoor GitHub repository with Chinese comments in readme file.
506540	514940	Forensic analysis also revealed DLLs files dropped by IIS worker process.
514940	522020	The DLLs files were mixed mode assembly, so they contained both the managed and unmanaged code.
522020	528240	The .NET part of DLL contains only the empty class. Yes, it was really empty.
528240	536260	On the other hand, in the native code, this DLL main dispatcher spent a reverse shell connected to the attacker.
536260	540640	And as I mentioned, there were more similar DLL files.
540640	548980	However, these files differs only in two strings, which contained the original file name of DLL.
548980	555980	So nothing, no significant differences in the functionality of these files.
556360	570680	With the suspicion that this could be payload delivered after the exploitation of ASP.NET vulnerability because of IIS worker process,
570680	576340	we tried to find something more about it.
577260	589540	With the similarity in original build name, DLL names, it was easy to leverage the thread intelligence and found the particular vulnerability and the tool, which produces the same DLLs.
590200	600640	It turns out that these files had been part of remote code execution exploit for vulnerability in Telerik web user interface for ASP.NET.
600940	604480	This exploit can be found on GitHub, again.
604480	616760	And after review, it was clear that this tool was used for building the DLLs with the reverse shell we just discovered.
617000	624020	So we find the origin of this tool and also the initial letter of compromise.
625580	632660	Further investigation and hunting for other persistence methods revealed the WMI event subscriptions.
632660	639660	The attackers registered the event filter and consumer and also the filter to consumer binding.
640080	646400	And as a result, it executed the same command as we already saw in the DLL files.
646700	653720	Now, we thought that we were ready to start with remediation and removal the malicious artifacts from the network.
653720	667160	We developed a custom PowerShell script for detection of all malicious stuff we were aware, including the malicious files and also the persistent artifacts.
667340	674200	Then we deployed our scripts throughout EDR solution and there was a big surprise.
674200	682580	EDR fired alert that there were detected attempts to install persistence for malicious DLLs we already known.
682580	691640	So, we investigated those alerts and we found that those commands had been spawned by PowerShell process.
692180	697960	Actually, the PowerShell process associated with our removal script.
698220	701180	What? What the hell is this?
701180	707540	We were absolutely sure that our PowerShell script didn't do anything like this.
707540	711900	Its purpose was to remove malicious persistence, not to create new one.
711900	721560	Yet we tested our script in our lab and also our client tested the script in their environment and nothing similar was observed.
721880	725210	Hence, there was only one possible explanation of this.
726100	730700	The attacker established another persistence method we did not find yet.
730700	733660	Therefore, another investigation was needed.
733660	743660	After a while, we found that the malicious DLL is loaded into the PowerShell process shortly after it queried the registry for specific class ID.
743740	747740	And this class ID pointed to one of the malicious DLL files.
748060	750980	Okay, but now there is another question.
750980	755020	Why PowerShell was interested in this malicious class ID?
755100	757880	The answer was hidden in the environment variables.
757880	764940	Especially, there were two environment variables called core enable profiling and core profiler.
764940	772340	They caused that every managed process was connected to the profiler specified by given class ID.
772500	776180	So, the attacker misused the profiling of .NET applications.
776820	780720	Great. Another small victory for defenders. Yeah.
781180	787180	Now, before we continue, let's quickly summarize what we discovered until now.
787180	792200	We already saw thousands of malware samples from four families.
792240	801180	Coin miners, DLL installers for those coin miners, scheduled task backdoors, and reverse shells delivered after the exploitation.
801360	806560	Regarding persistence, we already discovered malicious services and scheduled tasks.
806700	813280	And later, we discovered and analyzed WMI event subscription and core profiler persistence.
814100	817260	At this point, we had a lot of samples and persistence.
817260	823220	But we were faced with the questions how the attacker installed all of these persistence artifacts,
823220	831100	and what they exactly did between the initial exploitation and installation of coin miners on thousands of computers.
831440	839120	Now, we really needed to enrich our results with external data from Threat Intelligence and OSINT.
839120	843420	We used a clever tool called Munin by Florian Erot.
843420	852760	All we needed to do was to create one file with hashes of malware samples and let Munin do its work.
853040	862880	We found several hashes in public repositories, but there were only one public submission of the DLL installer, without any trace detected.
862880	871220	When we did a context search instead of object search, we get another submission, as we can see in the picture.
871440	874680	The zip archive with potentially malicious files.
876900	880140	Now, let's look on the zipkernel file.
880280	887700	It contains several DLLs, batch files, and one MOF file, which stands for Managed Object Format.
887980	890620	We were familiar with some of them.
891780	896880	One DLL was coin miner and the second was installer we already analyzed.
897360	899860	The MOF file was interesting.
899860	902980	Now, you can see its content on the right.
903420	910820	It contained definitions of WMI event subscriptions used for persistence we found earlier.
910820	912720	So, we got it.
912720	915680	We found the WMI persistence.
915680	920700	Now, we are aware how it was created.
922060	924420	But what about the batch files?
924420	931420	They were new for us, but there was a strong assumption that they were also related to the same ethics.
931480	935700	When we examined the RNBAT file, we could say,
935700	936900	Eureka!
936900	944160	This batch file was an installation script for all stuff related to coin miners and persistence we already discovered.
944160	949080	Thus, this is another piece of puzzle we missed until now.
949520	955000	Second batch file, called sn.bat, was unpacker.
955000	962040	It also seemed that the coin miners malicious stuff originally came as a package called set.zip.
962320	973060	We also saw that this installation batch script was executed via a program called let.exe.
973060	980040	But what was the let.exe and what files did the set.zip contain?
980040	982040	We didn't find them yet.
982040	983620	So, let's continue.
984520	992400	We applied the same approach again and we tried to do a reconnaissance about let.exe and installation package.
992400	999400	In some cases, we were able to follow tracks of the let.exe execution in public sources.
999400	1002460	It seemed that it was a kind of local privilege exploit.
1002460	1009560	Then, suddenly, we found the one submission of set.zip on hybrid analysis.
1009720	1014340	And this submission could be related to our investigation.
1014360	1020620	And yes, this file was exactly the one we were hunting for, the installation package.
1020880	1024040	And the program let.exe was included.
1024180	1029140	As it turned out that our hypothesis was correct.
1029140	1038100	The program let.exe was the juicy potato local privilege exploit with source codes available on GitHub.
1038100	1040600	Again. Again on GitHub.
1043890	1047370	There left only last sample.
1047890	1050430	We don't analyze it until now.
1050430	1055310	The nw.gold.dll from previous zip archive from any run.
1055690	1058030	It was mixed-mod.dll file.
1058030	1062130	Its name was composed from noun, timestamp, and architecture.
1062450	1071670	And the managed code contains only empty .NET class, while the native code contains a dropper of unpacker batch file we saw before.
1071670	1077470	But wait. Doesn't this nw.gold.dll file look familiar?
1077790	1083410	Of course. We already saw the mixed-mod.dll with empty C-sharp class.
1083410	1089970	It was reverse shell payload delivered by the Telerik WebUI exploitation.
1090250	1093970	So let's compare these two files side by side.
1095090	1099070	We can see that they contain a lot of similarity stuff.
1099070	1106970	And we could assume that this dll had been also created with build scripts from Telerik WebUI exploit.
1106970	1110750	But now, it was developed by TreadActor.
1113130	1117330	Okay. We found all missing pieces of puzzle.
1117330	1122770	We also collected all samples needed for attack reconstruction or simulation.
1122770	1126250	And in that moment, we went one step further.
1126250	1133370	We also collected the whole set of needed samples from public sources.
1133370	1144650	Therefore, we could demonstrate this attack using public sandboxes without revealing any sensitive info from the private samples shared by our client.
1145030	1148630	So, let's allow me to play a short video demonstration.
1288730	1291290	Okay. Thank you for watching the video.
1291290	1296310	And now, before we summarize our findings, let's proceed with the last part of this talk.
1296310	1297850	The attacker's profit.
1297850	1306010	We extracted crypto mining pool's parameters and configuration either from captured pickups or from memory dumps.
1306010	1312630	Then, we used these parameters for hunting for more and more samples and repeated this process again and again.
1312630	1317850	Finally, we collected several workers' IDs, but only two account IDs.
1317850	1321710	These account IDs were reused in several cases.
1321710	1328930	In the table, there are amounts of monero coin mines mined by attackers on various pools.
1328930	1333250	As a footnote, some workers were still active last week.
1333650	1335590	But back to the case.
1335850	1349190	In the cases we discovered, attackers have mined approximately 150 monero coins in total, which is now approximately 13,000 USD.
1349190	1358190	For comparison, average damages per day victim varies between $50,000 and $500,000.
1358190	1368870	And this includes only the direct costs, such as incident response and remediation process, investigation and reinstallation of their systems.
1368870	1377830	The indirect costs, such as reputation loss and disruption or damages due to downtime, aren't included in this estimation.
1379330	1381590	And last, but not least.
1381590	1384590	What do we discovered in our analysis and research?
1384590	1394130	First of all, thanks to online databases and feeds, we are able to find missing pieces and reconstruct the whole attack performed by this red actor.
1394310	1401310	In the meantime, this red actor got a name, Blue Mockingbird, given by Red Canary Company.
1401310	1412750	We observed that they were capable to adapt and customize various tools from GitHub and put all the data in their unpacker and installation scripts.
1412930	1419470	It is unusual to see so many persistence methods used in one attack.
1419610	1423610	This probably required research performed by Blue Mockingbird.
1423610	1432830	After that, they were able to earn thousands of dollars, but the victim damages are much greater than the attackers' profit.
1433570	1439330	So, that's all from my side. Here are provided some resources related to this talk.
1440390	1447510	And additionally, you can read something about my work or research on our company website or on my personal blog.
1447510	1450110	And you can find me also on Twitter.
1450110	1456030	So, thank you very much for attending this talk, and if you have any questions, please feel free to ask me.