www.esentire.com Open in urlscan Pro
104.20.162.46  Public Scan

Form analysis
0 forms found in the DOM

Text Content

BLOG


MORE_EGGS ACTIVITY PERSISTS VIA FAKE JOB APPLICANT LURES


BY eSentire Threat Response Unit (TRU)

June 6, 2024 | 8 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin





WANT TO LEARN MORE ON HOW TO ACHIEVE CYBER RESILIENCE?

TALK TO AN EXPERT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are
staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate,
contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks
in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical
Threat Response and Advanced Threat Analytics driven by our Threat Response Unit
– the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a
recent threat investigation. We outline how we responded to the confirmed threat
and what recommendations we have going forward.

Here’s the latest from our TRU Team…


WHAT DID WE FIND?

In May 2024, eSentire's Threat Response Unit (TRU) identified and traced
activity related to a more_eggs malware campaign targeting a customer in the
industrial services industry. However, eSentire MDR for Endpoint blocked the
activity after the user attempted to open the resume-themed loader.

Specifically, the targeted individual was a recruiter that was deceived by the
threat actor into thinking they were a job applicant and lured them to their
website to download the loader. eSentire observed similar tactics with more_eggs
back in early 2022.

More_eggs is a malicious software containing several components engineered to
steal valuable credentials, including usernames and passwords for corporate bank
accounts, email accounts, and IT administrator accounts and is sold on the Dark
Web as a Malware-as-a-Service (MaaS).

The Golden Chickens group (aka Venom Spider) is believed to be the threat
operators behind more_eggs, and the malware is known to be utilized by the very
capable FIN6, Evilnum, and Cobalt cybercriminals.


DELIVERY

The delivery of the malware took place from the response to a LinkedIn job
listing, where the attacker posed as a potential candidate, providing a link to
the fake resume download site. When navigating to the site, the victim was met
with a ‘Download CV’ button (Figure 1), which resulted in the download of a
malicious Windows Shortcut File (LNK).

This delivery method has been observed by eSentire in previous more_eggs malware
campaigns, where attackers have disguised themselves in both roles, as the
recruiter and as the potential candidate.

The threat actors behind these campaigns target organizations and individuals by
leveraging periods of time where hiring is typically at an increase.

Figure 1: Fake resume download site

Navigating to the same URL days later results in the individuals resume in plain
HTML, with no indication of a redirect or download (Figure 2).

Figure 2: Normal resume site


LOADING/LOADER

Once the victim downloads and opens the .LNK file, in this case “Christian C.
Velour.LNK”, the shortcut points to the executable “cmd.exe” followed by a
long-obfuscated command. The command uses a lot of string substitutions to make
analysis more difficult.

However, once de-obfuscated (Figure 2), the intent of the malicious .LNK file
becomes clearer. When opened, the malicious command line generates a series of
strings which are added to a new .INF file: “ieuinit.inf”. An INF file is a
plain text configuration file used by the Windows operating system to install,
uninstall, or configure device drivers, software components, or system settings.

In this case, the Loader uses the configuration as a reference point for the
Malicious DLL download URL.

From there, the malicious command line creates a copy of the legitimate
Microsoft “ie4unit.exe” executable in the user’s appdata\microsoft directory,
which is the same directory the loader saved the malicious .INF file.

The “ie4unit.exe” file is a legitimate Microsoft Windows executable that is
responsible for initializing certain settings and components related to Internet
Explorer.

Here, it is used to execute commands from the specially prepared “ie4uinit.inf”
file and to download the malicious DLL from a8advbiejf[.]christianvelour[.]com.

As seen in Figure 3, Windows’ WMI is invoked to run the hijacked copy of
“ie4unit.exe”, which then drops the malicious DLL file named “55609.dll”.

This DLL is then registered into the user’s registry and executed using
“regsvr32.exe” to establish persistence, gather data about the infected host,
and to drop additional payloads.

Figure 3: De-obfuscated .LNK which uses legitimate Windows processes to download
and execute malicious DLL


PAYLOAD

Upon inspection of the “55609.dll”, the DLL is highly obfuscated and contains
multiple anti-debug and anti-sandbox checks. The DLL’s payload is encrypted and
so a key is generated in an iterative fashion for the payload to get decrypted
during execution.

Specifically, there is a loop which contains a string with the keyword “SqadTO”
followed by a numerical number which starts at 0 and then increases by one until
a match is found with a hardcoded hash (Figure 4). This process delays the
execution of the payload until a match is generated.

Figure 4: Loops to generate the key for the encrypted payload

As per the Security Brief from Proofpoint UK, the malware uses the RC4 algorithm
to decrypt the strings.An example of the decryption can be seen in Figure 5 and
6.

Figure 5: The generated RC4 key is passed along with the encrypted string to the
decryption function Figure 6: Example of a string decrypted after the decrypt
function is run

Within the decrypted DLL, the malware sets up persistence on the host’s registry
(Figure 7) and is responsible for dropping the “msxsl.exe” binary along with 2
other txt files which contain JavaScript code. These files are dropped in the
%appdata%/Roaming/Microsoft folder.

Figure 7: The DLL adds registry keys on the host's machine to setup persistence

The first text file “7E9CB3FBF4FD0B07.txt” (Figure 8), contains obfuscated
JavaScript code that is responsible for launching the second text file
“1A4D05F30007.txt” using msxsl.exe.

Figure 8: Obfuscated JavaScript code which execute the second text file dropped
"1A4D05F30007.txt"

Within “1A4D05F30007.txt” there is a fair amount of JavaScript code with various
functions (Figure 9), but in summary the code appears to setup a command and
control (C2) client which reaches out to
hxxps[://]dcc[.]olcrv[.]com/login/tologin, and sends details from the host’s
system such as OS version, local IP, antivirus software installed.

The code also has the capability ability to check whether the malicious script
has system privileges, a function called “eTask” that can execute tasks received
from the C2 server, and the ability to further download and execute files via
the “dExec” function, which are all similar functions previously observed in
more_eggs campaigns.

Figure 9: Various functions observed in the more_eggs payload JavaScript code


WHAT DID WE DO?

 * eSentire MDR for Endpoint blocked the malicious activity after the user
   attempted to open the resume-themed loader.
 * Our team of 24/7 SOC Cyber Analysts isolated the affected host and notified
   the customer to provide support with complete remediation.


WHAT CAN YOU LEARN FROM THIS TRU POSITIVE?

 * More_eggs campaigns are still active and their operators continue to use
   social engineering tactics such as posing to be job applicants who are
   looking to apply for a particular role, and luring victims (specifically
   recruiters) to download their malware.
   * The malware continues to use LinkedIn for distribution, which allows for
     the targeting of specific industries and organizations.
   * It utilizes heavy obfuscation as well as other techniques to evade possible
     detections, showing the level of sophistication more_eggs maintains.
   * It maintains a stealthy profile by abusing legitimate Windows processes and
     feeds those process instructions via script files.
 * As these campaigns have occurred multiple times over the last several years
   with significant overlap from previous versions, it is probable the threat
   actors behind the malware are finding success with their current methods.
 * Additionally, campaigns like more_eggs, which use the MaaS offering appear to
   be sparse and selective in comparison to typical malspam distribution
   networks.


RECOMMENDATIONS FROM OUR THREAT RESPONSE UNIT (TRU):

 1. Confirm that all devices are protected with Endpoint Detection and Response
    (EDR) solutions.
    * Employ exhaustive endpoint monitoring for LOLBINs, aka Trusted Windows
      Binary abuse. LOLBINs of interest include cmd.exe, wscript.exe, wmic.exe,
      cmstp.exe, msxsl.exe, powershell.exe, and ie4uinit.exe. Ensure endpoint
      products have rules in place to detect suspicious usage of these Windows
      processes.
 2. Ensure employees are aware of common phishing tactics and implement a
    Phishing and Security Awareness Training (PSAT) program that educates and
    informs your employees on emerging threats in the threat landscape.
    * Be suspicious of attachments from people you don’t know – additional care
      is required in cases where you must accept documents from the public (such
      as with employee hiring process).
    * Inspect attachment file types by right clicking the file and selecting
      properties.
    * Documents should never come as LNK, ISO, or VBS files.
    * Often, these malicious files will be enclosed in a .zip file to bypass
      email filters.
 3. Have an easy process in place for reporting phishing and suspicious
    behavior.
    * Leadership is responsible for ensuring a positive and convenient path is
      in place for reporting suspicious behavior.
    * Develop a collaborative culture of cyber resiliency where employees are
      comfortable to bring forward questions, and even mistakes when it comes to
      email behavior and downloads. Punishing employees for falling for phishing
      scams will reduce the chances that they – and other employees – report
      them in the future.
 4. Users and administrators must adhere to the principle of least privilege by
    limiting account permissions strictly to those necessary for their
    operational roles, helping to minimize potential damage from malware
    infections.


INDICATORS OF COMPROMISE

You can access the Indicators of Compromise here.


REFERENCES

 * Security Brief: TA4557 Targets Recruiters Directly via Email
 * GOLDEN CHICKENS: Evolution of the MaaS
 * https://github.com/esThreatIntelligence/iocs/blob/main/more_eggs/more_eggs_iocs_5-29-2024.txt



ESENTIRE THREAT RESPONSE UNIT (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research
team committed to helping your organization become more resilient. TRU is an
elite team of threat hunters and researchers that supports our 24/7 Security
Operations Centers (SOCs), builds threat detection models across the eSentire
XDR Cloud Platform, and works as an extension of your security team to
continuously improve our Managed Detection and Response service. By providing
complete visibility across your attack surface and performing global threat
sweeps and proactive hypothesis-driven threat hunts augmented by original threat
research, we are laser-focused on defending your organization against known and
unknown threats.




READ THE LATEST FROM ESENTIRE

Sep 23, 2024

AI MAY BE A POWERFUL TOOL, BUT IT’S NO SUBSTITUTE FOR CYBER EXPERTS

Learn More
Sep 19, 2024

GO INJECTOR LEADING TO STEALERS

Learn More
Sep 17, 2024

ESENTIRE RECOGNIZED AS CROWDSTRIKE’S 2024 GLOBAL MSSP PARTNER OF THE YEAR…

Learn More

Cookies allow us to deliver the best possible experience for you on our website
- by continuing to use our website or by closing this box, you are consenting to
our use of cookies. Visit our Privacy Policy to learn more.

Accept
ARE YOU EXPERIENCING A SECURITY INCIDENT OR HAVE YOU BEEN BREACHED?
Call 1-866-579-2200


THE PROVEN CHOICE FOR
MANAGED DETECTION AND RESPONSE

GET STARTED → PARTNER LOGIN →


SALES AND
CUSTOMER SUPPORT

NORTH AMERICA 1-866-579-2200 EMEA (0)8000-443242 ANZ/APAC 1-519-651-2200

WHAT WE DO

Managed Detection and Response Digital Forensics and Incident Response Exposure
Management Services Extended Detection and Response (XDR) Security Operations
Center (SOC) Technology Integrations Threat Response Unit (TRU) Cyber Resilience
Team MDR for Microsoft MDR for AWS MDR for GenAI Response and Remediation MDR
Pricing

HOW WE DO IT

Network Endpoint Log Cloud Identity

INDUSTRIES

Insurance Construction Finance Legal Manufacturing Private Equity Healthcare
Retail Food Supply Government and Education Automotive Dealerships

USE CASES

Ransomware Third-Party Risk Sensitive Data Security Cloud Misconfiguration Zero
Day Attacks Cyber Risk Cybersecurity Compliance Do More With Less Cyber
Insurance Security Leadership Cyber Threat Intelligence

RESOURCES

Security Advisories Blog Resource Library Video Library TRU Intelligence Center
Case Studies Switch to eSentire Real vs. Fake MDR Compare MDR Vendors
Cybersecurity Glossary

TOOLS

Cybersecurity Assessment MDR ROI Calculator SOC Calculator MITRE ATT&CK® Tool

COMPANY

About Us Leadership Newsroom Event Calendar Careers Partners Australia & New
Zealand United Kingdom

2024 eSentire, Inc. All Rights Reserved.

Sitemap Terms and Conditions Privacy Policy Accessibility Legal
Get Started

What We Do
How We Do It
Resources
Company
Partners
Get Started
What we do
How we do it
Resources
Company
Partners
Get Started