WinorDLL64: A backdoor from the vast Lazarus arsenal?

The targeted region, and overlap in behavior and code, suggest the tool is used by the infamous North Korea-aligned APT group

ESET researchers have discovered one of the payloads of the Wslink downloader that we uncovered back in 2021. We named this payload WinorDLL64 based on its filename WinorDLL64.dll. Wslink, which had the filename WinorLoaderDLL64.dll, is a loader for Windows binaries that, unlike other such loaders, runs as a server and executes received modules in memory. As the wording suggests, a loader serves as a tool to load a payload, or the actual malware, onto the already compromised system. The initial Wslink compromise vector has not been identified.

The initially unknown Wslink payload was uploaded to VirusTotal from South Korea shortly after the publication of our blogpost, and hit one of our YARA rules based on Wslink’s unique name WinorDLL64. Regarding Wslink, ESET telemetry has seen only a few detections – in Central Europe, North America, and the Middle East.

The WinorDLL64 payload serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, such as exfiltrating, overwriting, and removing files, and executes additional commands. Interestingly, it communicates over a connection that was already established by the Wslink loader.

In 2021, we did not find any data that would suggest Wslink is a tool from a known threat actor. However, after an extensive analysis of the payload, we have attributed WinorDLL64 to the Lazarus APT group with low confidence based on the targeted region and an overlap in both behavior and code with known Lazarus samples.

Active since at least 2009, this infamous North-Korea aligned group is responsible for high-profile incidents such as both the Sony Pictures Entertainment hack and tens-of-millions-of-dollar cyberheists in 2016, the WannaCryptor (aka WannaCry) outbreak in 2017, and a long history of disruptive attacks against South Korean public and critical infrastructure since at least 2011. US-CERT and the FBI call this group HIDDEN COBRA.

Based on our extensive knowledge of the activities and operations of this group, we believe that Lazarus consists of a large team that is systematically organized, well prepared, and is made up of several subgroups that utilize a large toolset. Last year, we discovered a Lazarus tool that took advantage of the CVE‑2021‑21551 vulnerability to target an employee of an aerospace company in the Netherlands, and a political journalist in Belgium. It was the first recorded abuse of the vulnerability; in combination, the tool and the vulnerability led to the blinding of the monitoring of all security solutions on compromised machines. We also provided an extensive description of the structure of the virtual machine used in samples of Wslink.

This blogpost explains the attribution of WinorDLL64 to Lazarus and provides an analysis of the payload.

Links to Lazarus

We have discovered overlaps in both behavior and code with Lazarus samples from Operation GhostSecret and the Bankshot implant described by McAfee. The description of the implants in both GhostSecret and Bankshot articles contains overlaps in the functionality with WinorDLL64 and we found some code overlap in the samples. In this blogpost we will only use the FE887FCAB66D7D7F79F05E0266C0649F0114BA7C sample from GhostSecret for comparison against WinorDLL64 (1BA443FDE984CEE85EBD4D4FA7EB1263A6F1257F), unless specified otherwise.

The following details summarize the supporting facts for our low confidence attribution to Lazarus:

1. Victimology

  • Fellow researchers from AhnLab confirmed South Korean victims of Wslink in their telemetry, which is a relevant indicator considering the traditional Lazarus targets and that we have observed only a few hits.

Figure 1. Reported South Korean victim, where mstoned7 is the researcher from Ahnlab

2. Malware

  • The latest GhostSecret sample reported by McAfee (FE887FCAB66D7D7F79F05E0266C0649F0114BA7C) is from February 2018; we spotted the first sample of Wslink in late 2018 and fellow researchers reported hits in August 2018, which they disclosed after our publication. Hence, these samples were spotted a relatively short period of time apart.
  • The PE rich headers indicate that the same development environment and projects of similar size were used in several other known Lazarus samples (e.g., 70DE783E5D48C6FBB576BC494BAF0634BC304FD6; 8EC9219303953396E1CB7105CDB18ED6C568E962). We found this overlap using the following rules that cover only these Wslink and Lazarus samples, which is an indicator with a low weight. We tested them on VirusTotal’s retrohunt and our internal file corpus.

rich_signature.length == 80 and
pe.rich_signature.toolid(175, 30319) == 7 and
pe.rich_signature.toolid(155, 30319) == 1 and
pe.rich_signature.toolid(158, 30319) == 10 and
pe.rich_signature.toolid(170, 30319) >= 90 and
pe.rich_signature.toolid(170, 30319) <= 108

This rule can be translated to the following notation that is more readable and used by VirusTotal, where one can see the product version and build ID (VS2010 build 30319), number and type of source/object files used ([LTCG C++] where LTCG stands for Link Time Code Generation, [ASM], [ C ]), and number of exports ([EXP]) in the rule:

[LTCG C++] VS2010 build 30319 count=7
[EXP] VS2010 build 30319 count=1
[ASM] VS2010 build 30319 count=10
[ C ] VS2010 build 30319 count in [ 90 .. 108 ]

  • The GhostSecret article described “a unique data-gathering and implant-installation component that listens on port 443 for inbound control server connections” that additionally ran as a service. This is an accurate description of Wslink downloader behavior, apart from the port number, which can vary based on the configuration. To sum it up, even though the implementation is different, both serve the same purpose.
  • The loader is virtualized by Oreans’ Code Virtualizer, which is a commercial protector that is used frequently by Lazarus.
  • The loader uses the MemoryModule library to load modules directly from memory. The library is not commonly used by malware, but it is quite popular among North Korea-aligned groups such as Lazarus and Kimsuky.
  • Overlap in the code between WinorDLL64 and GhostSecret that we found during our analysis. The results and the significance in attribution are listed in Table 1.

Table 1. Similarities between WinorDLL64 and GhostSecret and their significance in attributing both to the same threat actor

Other similarities between WinorDLL64 and GhostSecret Impact
Code overlap in code responsible to get processor architecture Low
Code overlap in current directory manipulation Low
Code overlap in getting the process list Low
Code overlap in file sending Low
Behavior overlap in listing processes Low
Behavior overlap in current directory manipulation Low
Behavior overlap in file and directory listing Low
Behavior overlap in listing volumes Low
Behavior overlap in reading/writing files Low
Behavior overlap in creating processes Low
Considerable behavior overlap in secure removal of files Low
Considerable behavior overlap in termination of processes Low
Considerable behavior overlap in collecting system information Low

Code overlap in the file sending functionality is highlighted in Figure 2 and Figure 3.

Figure 2. GhostSecret sending a file

Figure 3. Wslink sending a file

Technical analysis

WinorDLL64 serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, and executes additional commands. Interestingly, it communicates over a TCP connection that was already established by its loader and uses some of the loader’s functions.

Figure 4. Visualization of Wslink’s communication

The backdoor is a DLL with a single unnamed export that accepts one parameter – a structure for communication that was already described in our previous blogpost. The structure contains a TLS-context – socket, key, IV – and callbacks for sending and receiving messages encrypted with 256-bit AES-CBC that enable WinorDLL64 to exchange data securely with the operator over an already established connection.

The following facts lead us to believe with high confidence that the library is indeed part of Wslink:

  • The unique structure is used everywhere in the expected way, e.g., the TLS-context and other meaningful parameters are supplied in the anticipated order to the correct callbacks.
  • The name of the DLL is WinorDLL64.dll and Wslink’s name was WinorLoaderDLL64.dll.

WinorDLL64 accepts several commands. Figure 5 displays the loop that receives and handles commands. Each command is bound to a unique ID and accepts a configuration that contains additional parameters.

Figure 5. The main part of the backdoor’s command-receiving loop

The command list, with our labels, is in Figure 6.

Figure 6. The command list

Table 2 contains a summary of the WinorDLL64 commands, where modified, and old categories refer to the relationship to the previously documented GhostSecret functionality. We highlight only significant changes in the modified category.

Table 2. Overview of backdoor commands

Category Command ID Functionality Description
New 0x03 Execute a PowerShell command WinorDLL64 instructs the PowerShell interpreter to run unrestricted and to read commands from standard input. Afterwards, the backdoor passes the specified command to the interpreter and sends the output to the operator.
0x09 Compress and download a directory WinorDLL64 recursively iterates over a specified directory. The content of each file and directory is compressed separately and written to a temporary file that is afterwards sent to the operator and then removed securely.
0x0D Disconnect a session Disconnects a specified logged-on user from the user’s Remote Desktop Services session. The command can also perform different functionality based on the parameter.
0x0D List sessions Acquires various details about all sessions on the victim’s device and sends them to the operator. The command can also perform different functionality based on the parameter.
0x0E Measure connection time Uses the Windows API GetTickCount to measure the time required to connect to a specified host.
Modified 0x01 Get system info Acquires comprehensive details about the victim’s system and sends them to the operator.
0x0A Remove files securely Overwrites specified files with a block of random data, renames each file to a random name, and finally securely removes them one by one.
0x0C Kill processes Terminates all processes whose names match a supplied pattern and/or with a specific PID.
Old 0x02/0x0B Create a process Creates a process either as the current or specified user and optionally sends its output to the operator.
0x05 Set/Get current directory Attempts to set and subsequently acquire the path of the current working directory.
0x06 List volumes Iterates over drives from C: to Z: and acquires the drive type and volume name. The command can also perform different functionality based on the parameter.
0x06 List files in a directory Iterates over files in specified directory and acquires information such as names, attributes, etc. The command can also perform different functionality based on the parameter.
0x07 Write to a file Downloads and appends the stated amount of data to specified file.
0x08 Read from a file The specified file is read and sent to the operator.
0x0C List processes Acquires details about all running processes on the victim’s device and additionally sends ID of the current process.

Conclusion

Wslink’s payload is dedicated to providing means for file manipulation, execution of further code, and obtaining extensive information about the underlying system that possibly can be leveraged later for lateral movement, due to specific interest in network sessions. The Wslink loader listens on a port specified in the configuration and can serve additional connecting clients, and even load various payloads.

WinorDLL64 contains an overlap in the development environment, behavior, and code with several Lazarus samples, which indicates that it might be a tool from the vast arsenal of this North-Korea aligned APT group.

ESET Research offers private APT intelligence reports and data feeds. For any inquiries about this service, visit the ESET Threat Intelligence page.

IoCs

SHA-1 ESET detection name Description
1BA443FDE984CEE85EBD4D4FA7EB1263A6F1257F Win64/Wslink.A Memory dump of discovered Wslink payload WinorDll64.

MITRE ATT&CK techniques

This table was built using version 12 of the ATT&CK framework. We do not mention techniques from the loader again, only the payload.

Tactic ID Name Description
Resource Development T1587.001 Develop Capabilities: Malware WinorDLL64 is a custom tool.
Execution T1059.001 Command and Scripting Interpreter: PowerShell WinorDLL64 can execute arbitrary PowerShell commands.
T1106 Native API WinorDLL64 can execute further processes using the CreateProcessW and CreateProcessAsUserW APIs.
Defense Evasion T1134.002 Access Token Manipulation: Create Process with Token WinorDLL64 can call APIs WTSQueryUserToken and CreateProcessAsUserW to create a process under an impersonated user.
T1070.004 Indicator Removal: File Deletion WinorDLL64 can securely remove arbitrary files.
Discovery T1087.001 Account Discovery: Local Account WinorDLL64 can enumerate sessions and list associated user, and client names, among other details.
T1087.002 Account Discovery: Domain Account WinorDLL64 can enumerate sessions and list associated domain names –among other details.
T1083 File and Directory Discovery WinorDLL64 can obtain file and directory listings.
T1135 Network Share Discovery WinorDLL64 can discover shared network drives.
T1057 Process Discovery WinorDLL64 can collect information about running processes.
T1012 Query Registry WinorDLL64 can query the Windows registry to gather system information.
T1082 System Information Discovery WinorDLL64 can obtain information such as computer name, OS and latest service pack version, processor architecture, processor name, and amount of space on fixed drives.
T1614 System Location Discovery WinorDLL64 can obtain the victim’s default country name using the GetLocaleInfoW API.
T1614.001 System Location Discovery: System Language Discovery WinorDLL64 can obtain the victim’s default language using the GetLocaleInfoW API.
T1016 System Network Configuration Discovery WinorDLL64 can enumerate network adapter information.
T1049 System Network Connections Discovery WinorDLL64 can collect a list of listening ports.
T1033 System Owner/User Discovery WinorDLL64 can enumerate sessions and list associated user, domain, and client names –among other details.
Collection T1560.002 Archive Collected Data: Archive via Library WinorDLL64 can compress and exfiltrate directories using the quicklz library.
T1005 Data from Local System WinorDLL64 can collect data on the victim’s device.
Impact T1531 Account Access Removal WinorDLL64 can disconnect a logged-on user from specified sessions.


Source link

About Tech News

Check Also

Ex-NSA Official Harry Coker Tapped for National Cyber Director Job

Former Navy commander and senior official in the NSA and CIA Harry Coker has been …

Leave a Reply

Your email address will not be published. Required fields are marked *