{"id":17294,"date":"2019-12-27T20:56:32","date_gmt":"2019-12-28T04:56:32","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/12\/27\/news-11030\/"},"modified":"2019-12-27T20:56:32","modified_gmt":"2019-12-28T04:56:32","slug":"news-11030","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/12\/27\/news-11030\/","title":{"rendered":"Introducing BIOLOAD: FIN7 BOOSTWRITE\u2019s Lost Twin"},"content":{"rendered":"<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12\">\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>A couple of months ago, <a href=\"https:\/\/www.fortinet.com\/blog\/business-and-technology\/fortinet-acquires-endpoint-security-innovator-ensilo-.html\">enSilo\u2019s endpoint protection platform<\/a> blocked malicious payloads running in legitimate Microsoft Windows processes. A deeper look uncovered that the attacker abused the DLL search order to load their own malicious DLL. Some of the samples in the environment matched ones described in a recent publication by FireEye about FIN7\u2019s new tools and techniques, specifically BOOSTWRITE. Comparing the rest of the samples to BOOSTWRITE revealed they have a common codebase and carry the Carbanak backdoor.<\/p>\n<h2>The Abused Target<\/h2>\n<p>Windows OS uses a <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/dlls\/dynamic-link-library-search-order\">common method<\/a> to look for required DLLs to load into a program. Adversaries may use this behavior to cause the program to load a malicious DLL, a technique known as <a href=\"https:\/\/attack.mitre.org\/techniques\/T1038\">DLL search order hijacking (or binary planting)<\/a>.<\/p>\n<p>The abused application in this case is <i>FaceFodUninstaller.exe<\/i>. It exists on a clean OS installation starting from Windows 10 RS4 (1803) at the \u201c<i>%WINDR%System32WinBioPlugIns<\/i>\u201d folder. The executable is dependent on winbio.dll, which is usually found in the parent directory (\u201c<i>%WINDR%System32<\/i>\u201d).<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn aem-GridColumn--default--12\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image_1913024365.img.png\/1576627583653\/bioload-one.png\" alt=\"Figure 1: FaceFodUninstaller.exe import table\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 1: FaceFodUninstaller.exe import table<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>What makes this executable even more attractive in the eyes of an attacker is the fact that it is started from a built-in scheduled task named <i>FODCleanupTask<\/i>, thereby minimizing the footprint on the machine and reducing the chances of detection even further. This demonstrates the group\u2019s ongoing technological research efforts.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image.img.png\/1576627618673\/bioload-two.png\" alt=\"Figure 2: The built-in task view in Windows Task Scheduler\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 2: The built-in task view in Windows Task Scheduler<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<h2>BIOLOAD<br \/> <\/h2>\n<p>The loader file name is <i>WinBio.dll<\/i> (note the uppercase characters) and is placed by the attacker alongside the executable in the same folder (\u201c<i>WinBioPlugIns<\/i>&quot;), thus leveraging the default DLL search order. Because the file path is under <i>%WINDIR%<\/i>, it means that in order to plant it the attacker needed to have elevated privileges on the victim\u2019s machine such as administrator or a SYSTEM account.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image_780776482.img.png\/1576627733390\/bioload-three.png\" alt=\"Figure 3: WinBioPlugIns folder of an infected machine\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 3: WinBioPlugIns folder of an infected machine<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Like BOOSTWRITE, this loader was also developed in C++. It exports only a single function which is the one <i>FaceFodUninstaller.exe<\/i> imports.<\/p>\n<p>The samples target a 64-bit OS and were compiled in March and July of 2019. BOOSTWRITE targets 32-bit machines and was compiled (and signed) in May 2019. According to previous reports on the group, they do not falsify compilation timestamps of the binaries.<\/p>\n<p>When the DLL is started it checks the number of command line arguments of the process to decide how to act. When the executable is started by the task scheduler it doesn\u2019t have command line arguments and the malware works as follows:<\/p>\n<ol>\n<li>Creates a log file at <i>%TEMP%~bio&lt;epoch_time&gt;<\/i>. Logs are textual and aren\u2019t encrypted.<\/li>\n<li>Starts itself again as a child process with one command line argument comprised of 32 random upper-case letters.<\/li>\n<li>Establishes persistency by using COM objects to access the task scheduler. The malware makes sure the task is enabled, adds a trigger to start it 30 seconds after Windows boots and does not wait for idle state.<\/li>\n<\/ol>\n<p>When <i>WinBioGetEnrolledFactors<\/i> is called, the malware loads the original <i>winbio.dll<\/i> and invokes the original function.<\/p>\n<p>The worker process loads and executes the payload DLL in-memory. It starts by creating a log file at <i>%TEMP%~wrk&lt;epoch_time&gt;<\/i>. It then makes sure only a single instance is currently running by creating a named mutex based on environments variables in this fashion:<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn aem-GridColumn--default--7 aem-GridColumn--offset--default--2\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image_1283275003.img.png\/1576628001890\/screen-shot-2019-12-17-at-4.12.40-pm.png\" alt=\"bioload\"\/>         <\/noscript>                   <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>BIOLOAD also has the encrypted payload DLL embedded in it. In contrast to BOOSTWRITE, it does not support multiple payloads. Furthermore, to decrypt the payload it uses a simple XOR decryption rather than a ChaCha cipher, nor does it access a remote server to fetch the key. Instead, BIOLOAD is tailor-made for every machine it infects as it relies on the machine name to properly derive the decryption key.<\/p>\n<p>The length of the key is 16 bytes and is also embedded in the loader. A portion of the key is overwritten with the result of <a href=\"https:\/\/github.com\/aappleby\/smhasher\/blob\/master\/src\/MurmurHash3.cpp#L255\">MurmurHash3<\/a> on the key using a CRC32 checksum of the computer name as the seed. This hinders detection by sandboxes and obstruct researchers from analyzing the payload when the relevant context is missing.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image_1477525408.img.png\/1576628078832\/bioload-four.png\" alt=\"Figure 4: Start of the MurmurHash3 function disassembly\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 4: Start of the MurmurHash3 function disassembly<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>The PE loader implementation is the same as the one in BOOSTWRITE. The format of the log file name is similar as well.<\/p>\n<h2>The Carbanak Backdoor<\/h2>\n<p>As mentioned, the payload this loader carries is the Carbanak backdoor. The samples we extracted from BIOLOAD are newer builds of the backdoor, dated January and April of 2019, according to their timestamps.<\/p>\n<p>One notable addition is that it checks to see if another Anti-Virus (AV) is running on the machine, besides Kaspersky, AVG and TrendMicro. The result, however, has no effect on the operations of the backdoor, unlike with previously detected AVs.<\/p>\n<h2>Final Thoughts<\/h2>\n<p>This is the first public case of FaceFodUninstaller.exe being abused as host process by a threat actor.<\/p>\n<p>The shared codebase with recent tools attributed to FIN7, together with the same techniques and backdoor, allows to attribute this new loader to the cybercrime group. The timestamps, together with simpler functionality, suggest BIOLOAD is a preceding iteration of BOOSTWRITE.<\/p>\n<p>Since the loader is specifically built for each targeted machine and requires administrative permissions to deploy, it suggests the group gathers information about its targets\u2019 networks.<\/p>\n<h2>Solutions<\/h2>\n<p>This malware uses a common, yet stealthy and effective, method to execute its payload in the context of legitimate processes.\u00a0<\/p>\n<p>Countermeasures should be in place to detect this malicious behavior. The recently acquired FortiEDR \u2013 an Endpoint Detection and Response solution integrated into FortiGate firewalls, FortiSIEM and FortiSandbox &#8211; detects and blocks such behavior post-infection to help incident responders quickly mitigate and respond to such threats.<\/p>\n<p>FortiClient detects and blocks the IOCs listed below as<b> W64\/Inject.B!tr.spy<\/b> and <b>W64\/Carbanak.A2EB!tr<\/b>.<\/p>\n<p>In addition, as part of our membership in the\u00a0<a href=\"https:\/\/www.cyberthreatalliance.org\/\">Cyber Threat Alliance<\/a>, details of this threat were shared in real time with other Alliance members to help create better protections for customers.<b><\/b><\/p>\n<h2>IOCs<\/h2>\n<p><b>WinBio.dll (scrubbed key and payload) SHA256<\/b><\/p>\n<p>7bdae0dfc37cb5561a89a0b337b180ac6a139250bd5247292f470830bd96dda7<br \/> c1c68454e82d79e75fefad33e5acbb496bbc3f5056dfa26aaf1f142cee1af372<\/p>\n<p><b>Carbanak SHA256<\/b><\/p>\n<p>77a6fbd4799a8468004f49f5929352336f131ad83c92484b052a2eb120ebaf9a<br \/> 42d3cf75497a724e9a9323855e0051971816915fc7eb9f0426b5a23115a3bdcb\u00a0 \u00a0\u00a0<\/p>\n<p><i>Learn more about\u00a0<a href=\"https:\/\/www.fortinet.com\/fortiguard\/threat-intelligence\/threat-research.html?utm_source=nreleaseblog&amp;utm_campaign=2018-q2-fortiguardlabs-cta\">FortiGuard Labs<\/a>\u00a0and the FortiGuard Security Services\u00a0<a href=\"https:\/\/www.fortinet.com\/support-and-training\/support-services\/fortiguard-security-subscriptions.html?utm_source=blog&amp;utm_campaign=2018-blog-security-services\">portfolio<\/a>.\u00a0<a href=\"https:\/\/www.fortinet.com\/fortiguard\/threat-intelligence\/threat-research.html?utm_source=nreleaseblog&amp;utm_campaign=2018-q2-fortiguardlabs-cta\">Sign up<\/a>\u00a0for our weekly FortiGuard Threat Brief.<\/i><\/p>\n<p><i>Read about the FortiGuard\u00a0<a href=\"https:\/\/www.fortinet.com\/support-and-training\/support-services\/fortiguard-security-subscriptions\/security-rating.html?utm_source=blog&amp;utm_campaign=2018-blog-security-rating-service\">Security Rating Service<\/a>, which provides security audits and best practices.<\/i><\/p>\n<\/p><\/div>\n<div class=\"raw-import aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"text-container\">\n<div id=\"om-qxx1b0gslklfu2kjckea-holder\"><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<p><a href=\"http:\/\/feedproxy.google.com\/~r\/fortinet\/blog\/threat-research\/~3\/9QiJy8dxEOQ\/bioload-fin7-boostwrite-lost-twin.html\" target=\"bwo\" >http:\/\/feeds.feedburner.com\/fortinet\/blog\/threat-research<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"\/blog\/threat-research\/bioload-fin7-boostwrite-lost-twin\/_jcr_content\/root\/responsivegrid\/image_1913024365.img.png\/1576627583653\/bioload-one.png\"\/><br \/>Learn more about BIOLOAD, a malware recently attributed to the cybercrime group FIN7.&lt;img src=&#8221;http:\/\/feeds.feedburner.com\/~r\/fortinet\/blog\/threat-research\/~4\/9QiJy8dxEOQ&#8221; height=&#8221;1&#8243; width=&#8221;1&#8243; alt=&#8221;&#8221;\/&gt;<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378],"tags":[],"class_list":["post-17294","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=17294"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17294\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=17294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=17294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=17294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}