BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy
•
2 likes•1,571 views
Christiaan F Beek, McAfee Jay Rosenberg, Intezer Labs The Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, 10 Days of Rain attacks are all believed to originate from North Korea. But how can they be attributed with certainty? And what connection does a DDoS and disk wiping attack from July 4 2009, have with WannaCry, one of the largest cyber-attacks in the history of the cyber-sphere? We have conducted a comparative research over more than 10 years of malware and tools being used by North Korean adversaries. The results were intriguing and we will share our discoveries but also hunt tactics during our talk. We discovered new links between campaigns and were able to group malware families towards actor groups and discovere interesting patterns.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy
Similar to BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy (20)
More from BlueHat Security Conference
More from BlueHat Security Conference (20)
Recently uploaded
Recently uploaded (20)
BlueHat v18 || The hitchhiker's guide to north korea's malware galaxy
- 1. The Hitchhiker’s guide into North Korean Malware Jay Rosenberg | Sr Security Researcher | Intezer Christiaan Beek | Sr Principal Engineer | McAfee
- 2. Overview Introduction History lesson Cyber Units Let the code speak Practical Example Final thoughts Q & A
- 3. $ WHOIS JAY ROSENBERG • Sr. Security Researcher • Leads research behind code reuse technology • Reverse engineer, malware geneticist & threat hunter @jaytezer
- 4. $WHOIS Christiaan Beek • Sr. Principal Engineer – Lead Scientist • Advanced Threat Research team • Securitysopher, techjunkie, BoT(breaker of things) & mentor @ChristiaanBeek Family/ Sleep Research Innovate Write/teach/ speak/Manage
- 5. Brief overview of historical events Source: http://www.egrafis.com/gambar/south-koreas-moon-jae-in-willing-to-visit-north-korea
- 6. DPRK’s Cyber Warfare Units
- 7. When you are talented in Computer Science Gang 1 and 2 Junior High School Computer Genius Kim Il Sung University Kim Jong Kyo University of Technology Pyongyang Computer College
- 8. DPRK Cyber Units after 2013 Reorg Unit 91 Espionage & Destruction Unit 110 Tools development and Recon Unit 128 HUMINT Unit 180 Financial targeted Operations Unit 413 Tech. Recon & Social Eng.
- 9. Benefits for being a state sponsored hacker Luxury Apartment Internet Access Limousine Bus Lifelong Party Membership Bonus payments Foreign travel
- 10. LET THE CODE SPEAK
- 11. Base set of our research
- 13. Why on earth would this makes sense?
- 14. Multiple banks: same code: same false flags 2016 Poland 2017 Taiwan 2018 Vietnam Correct Russian for “Ustanavlivat” is “Ustanovit” or “Ustanoviti”
- 15. Multiple banks: same code: same false flags…….But…..
- 16. Research on code re-usage
- 17. 2009 to 2017 – MYDOOM to WannaCry – SMB Module
- 18. Common File Mapping – NavRAT & NK Gambling
- 19. Unique net share – SierraBravo & KorDLLBot
- 20. Unique file copy – DarkSeoul/FALLCHILL
- 21. Modify Access Control List – Blockbuster
- 22. How to apply this knowledge? An example
- 23. MITRE ATT&CK Persistence Defense Evasion Credential Access Discovery Lateral Movement Execution Exfiltration C2 Bootkit Access Token manipulation Account Manipulation Application Window Discovery RDP CLi Data Compressed Commonly used port DLL Search Order Hijacking DLL Search Order Hijacking Brute Force File & Dir Discovery Remote File Copy PowerShell Data Encrypted Connection Proxy New Service Disable Security tools Input Capture Process Discovery Windows Remote mgmt. Regsvr32 Exfil over alt. protocol Custom C2 protocol Process Injection File Deletion System Info Service Execution Exfil over C2 channel Custom crypto protocol Valid Accounts Hidden Files & Directories System Network Info WMI Data Encoding Obfuscated Files or Information System User/Owner Info Data Obfuscation Timestomp Fallback channels Valid Accounts Multiband comms Remote File copy Uncommonly used port
- 24. ATT&CK Techniques/TTPs Input Data Campaign 1 Campaign 2 Campaign 3 Process spawning cmd.exe Quick series of suspicious commands Suspicious run locations Running executables with same hash and different names Suspicious Arguments CMD line using of archiving software PowerShell Execution Outlier parents of cmd.exe Execution/CMDline CredentialAccess/Creds Dumping ExfiltrationData/Data Compressed Defensive Evasion/Masquerading Lateral Movement/RDP Defensive Evasion/Scripting Defensive Evasion/Scheduled Task
- 25. Campaign 1 Campaign 2 Campaign 3 Suspicious run locations Running executables with same hash and different names Suspicious Arguments CMD line using of archiving software PowerShell Execution Outlier parents of cmd.exe Execution/CMDline CredentialAccess/Creds Dumping ExfiltrationData/Data Compressed Defensive Evasion/Masquerading Lateral Movement/RDP Defensive Evasion/Scripting Defensive Evasion/Scheduled Task Which code can be used to create an ‘Actor DNA’ profile?
- 27. Yara Hunting rule DPRK backdr1 { strings: $f17d3f40e5306dff = { 8B ?? ?? ?? 5? 8B ?? ?? 5? 8B ?? ?? 3B ?? 75 ?? [0-128] 8B ?? ?? 5? 2B ?? ?? BB ?? ?? ?? ?? 5? 8B ?? F7 ?? 2B ?? 8B ?? 8B ?? ?? 2B ?? F7 ?? 03 ?? C1 ?? ?? 8D ?? ?? ?? 5? 5? [0-128] 5? 5? C2 ?? ?? } $d0e95130897c6d8e = { 5? 8B ?? 81 E? ?? ?? ?? ?? 5? 5? 8D ?? ?? 5? 8B ?? 5? E8 ?? ?? ?? ?? 80 A? ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? 33 ?? 8D ?? ?? ?? ?? ?? 80 A? ?? ?? ?? ?? ?? F3 ?? 66 ?? 8B ?? 33 ?? 8D ?? ?? ?? ?? ?? F3 ?? 66 ?? 8D ?? ?? 5? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 83 ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? 5? 8D ?? ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 ?? [0-128] 33 ?? 5? FF 7? ?? FF 7? ?? 6A ?? 68 ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF D? 39 ?? ?? ?? ?? ?? 75 ?? [0-128] 6A ?? 5? 6A ?? 5? 5? FF 7? ?? FF 7? ?? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF D? 6A ?? 33 ?? 5? 8D ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? F3 ?? 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 5? 6A ?? 8D ?? ?? ?? ?? ?? 6A ?? 5? 68 ?? ?? ?? ?? FF B? ?? ?? ?? ?? FF 1? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? FF D? 8A ?? ?? 88 ?? ?? 8B ?? ?? ?? ?? ?? 8D ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? 5? 6A ?? 5? E8 ?? ?? ?? ?? 8D ?? ?? 6A ?? 5? 5? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? ?? ?? ?? ?? 76 ?? }
- 28. Final Thoughts Code Re-Usage analysis revealed interesting links Code DNA blocks can be used for offense/defense Pay attention to the details of code overlaps Never jump to conclusions without context