www.trendmicro.com
Open in
urlscan Pro
104.75.88.135
Public Scan
URL:
https://www.trendmicro.com/en_us/research/21/a/expanding-range-and-improving-speed-a-ransomexx-approach.html
Submission: On September 06 via api from IN — Scanned from DE
Submission: On September 06 via api from IN — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Security
* File Security
Protect application workflow and cloud storage against advanced threats
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Insights
* Threat Insights
See threats coming from miles away
Learn more
* Identity Security
* Identity Security
End-to-end identity security from identity posture management to
detection and response
Learn more
* On-Premises Data Sovereignty
* On-Premises Data Sovereignty
Prevent, detect, respond and protect without compromising data
sovereignty
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
* Compare Trend Micro
See how Trend outperforms the competition
Let's go
* vs. Crowdstrike
* Trend Micro vs. Crowdstrike
Crowdstrike provides effective cybersecurity through its cloud-native
platform, but its pricing may stretch budgets, especially for
organizations seeking cost-effective scalability through a true single
platform
Let's go
* vs. Microsoft
* Trend Micro vs. Microsoft
Microsoft offers a foundational layer of protection, yet it often
requires supplemental solutions to fully address customers' security
problems
Let's go
* vs. Palo Alto Networks
* Trend Micro vs. Palo Alto Networks
Palo Alto Networks delivers advanced cybersecurity solutions, but
navigating its comprehensive suite can be complex and unlocking all
capabilities requires significant investment
Let's go
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Connect With Us
* Connect With Us
* Connect With Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
4 Alerts
Back
Unread
All
* Imagine with AI. Secure with Trend.
close
Get expert insight >
* Confidence in GenAI: The Zero Trust Approach
close
Read blog >
* Trend 2024 Midyear Cybersecurity Threat Report
close
Read findings >
* Pressing Pause on a Play Ransomware Attack with Managed Detection and
Response
close
Read more >
Folio (0)
Support
* Business Support Portal
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* AI Hub
* Trend Micro vs. Competition
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Vision One
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affiliate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
EXPANDING RANGE AND IMPROVING SPEED: A RANSOMEXX APPROACH
RansomExx is a ransomware variant responsible for several high-profile attacks
in 2020. We take a look at its current techniques which include the use of
trojanized software to deliver malicious payloads and an overall short and fast
attack.
By: Trend Micro January 06, 2021 Read time: 5 min (1445 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
RansomExx, a ransomware variant responsible for several high-profile attacks in
2020, has shown signs of further development and unhampered activity. The most
recently reported development involves the use of newer variants adapted for
Linux servers that effectively expanded its range to more than Windows servers.
Own monitoring efforts found RansomExx compromising companies in the United
States, Canada, and Brazil, as well as the sustained activity of the Linux
variant. This entry details our analysis of a RansomExx campaign that used
IcedID as its initial access vector, Vatet loader as its payload delivery
method, and both Pyxie and Cobalt Strike as post-intrusion tools. This
combination of tools took only five hours to deploy the ransomware from its
initial access.
RansomExx used to be operated by a threat group, which SecureWorks named GOLD
DUPONT, that has been active since 2018. Based on its most recent attacks, the
threat group showed a fast and effective approach to compromising an
environment. Malware like Vatet loader, PyXie, Trickbot, and RansomExx, as well
as some post-intrusion tools like Cobalt Strike, are typically part of this
threat group’s arsenal.
This malware is worth looking into as it demonstrates effective techniques
frequently observed in ransomware attacks in 2020. These methods include the use
of trojanized software to deliver malicious payloads and an overall short and
fast attack.
The Investigation
The incident we observed was first flagged as a phishing email with an attached
password-protected ZIP file, which is actually a Word document (detected as
Trojan.W97M.SHATHAK.A) with a malicious macro. It shows a message that lures
users into enabling macro content:
Figure 1. Malicious Word document content
By allowing the macro inside the document, it will attempt to download the
IcedID trojan (detected as TrojanSpy.Win32.ICEDID.BP) from a malicious URL. If
the download succeeds, the trojan is executed using regsvr32.exe.
Figure 2. Code snippet of the macro
As a common IcedID approach it used steganography as a method to deliver the
payload through a .png file downloaded from a malicious URL. The file is
decrypted, and the payload is injected into memory. For persistence, IcedID
creates a scheduled task to run hourly, in which it again uses regsvr32.exe to
run its malicious DLL:
Figure 3. Malicious scheduled task initializing
On this incident we observed msiexec.exe being used to inject and deploy the
final IcedID payload. With the final payload in place, the attacker was able to
load and execute the Cobalt Strike payload, allowing it to communicate with the
command and control (C&C) server:
Figure 4. Telemetry data of the point-of-entry machine connecting to the C&C
Server
After establishing a connection to the malicious server, the threat actor
started to collect machine information and move laterally. In this entry, we
don’t have evidence to show all the approaches the malware used to move
laterally, except for one that was through SMB.
Figure 5. Some of the information gathered by the attacker from the point of
entry machine
The artifact used to deliver the other components executed in the environment
was a trojanized version of Notepad++ — Vatet loader (detected as
Trojan.Win32.VATET.SM). As described in our previous blog post, Vatet loader
decrypts a file (in our analysis referred to as config.dat) using an XOR-based
method. After the XOR operation, it allocates memory, injects the config.dat
decrypted code into its own memory, and then executes the payload:
Figure 6. Code snippet of Vatet loader routine
Vatet loader loads any payload as long as it follows the correct XOR operation
based on the file path of config.dat. We identified a different config.dat file
being used for different purposes, like information gathering through Pyxie,
Lazagne and Mimikatz as well as RansomExx itself for its last attack phase. One
key observation was that the config.dat used for information gathering contained
an internal IP in the configuration of its payload, specifically in the part
pertaining to the address of the server being used to send the gathered
information. We have evidence showing that this internal IP was used as an
exfiltration point and communicated to the C&C server mentioned earlier. This
behavior leads us to think that the entire attack was indeed very fast, with
some of the components created in the time of the incident.
Usage of the Linux variant
Correlating the described incident to more recent attacks involving RansomExx,
we observed the use of a new Linux variant of RansomExx to compromise Linux
servers. We have no information on how the malware was sent to the Linux server,
but we observed it aiming for the VMware environment in general, especially
machines that serve as storage for the VMware files. We have found three
variants of RansomExx for Linux using Trend Micro Telfhash, and all three
samples shared the same behavior. The sample we analyzed from these three is a
64-bit ELF executable with all of the cryptographic schemes from an open-source
library called mbedtls. The sample is multi-thread and goes straight to
encryption. It has no network activities, no anti-analysis techniques, or other
activities outside its main agenda. The sample also has some available debug
information allowing us to check characteristics like the function names and
source code file names:
Figure 7. Examples of RansomExx debug information
Upon execution, the sample starts calling a function referred to as
GeneratePreData, which is responsible for the creation of a 256-bit AES key
using both pseudo-random values from native Linux functions and also mbedtls
operations. The AES key is encrypted using a hardcoded RSA-4096 public key, with
the result written in a global variable. The content of that global variable is
going to be appended to each file for future encryption using AES in ECB mode:
Figure 8. Hardcoded RSA public key
The GeneratePreData function runs in a thread created by the malware on an
infinite loop, attempting to generate encryption keys every 0.18 seconds. The
thread will continue to run until the end of the malware execution.
Figure 9. Code snippet of the Ransomware main function
Figure 10. Code snippet of the AES encryption
The malware only runs if the user specifies a directory as a command line
parameter. The encryption preparation starts in a function referred to as
list_dir. The first action performed by the list_dir function makes sure that
the argument passed through the command line is a directory. If the check
succeeds, the function responsible for the creation of the ransom note is
called.
If the other files inside the same directory are also directories, then the
list_dir function is called again. For regular files, the malware attempts to
check if the file has the occurrence of the ransomware extension string to
determine if it needs to be encrypted. For every file found inside the
directories, the malware adds a task to encrypt the file:
Figure 11. Code snippet showing the list_dir() function
Figure 12. Code snippet of the ransom note creation function
Security recommendations
Threat actors constantly improve their arsenal and approaches to be more
effective. The use of memory-based techniques, legitimate Windows tools, and
well-known post-intrusion tools preceding the deployment of the main payload
seems to result in a higher chance of success for ransomware operators.
For users, preventing attacks from the outset is key to impeding the chance of
successful ransomware attacks. The speed and agility that this campaign banked
on will not matter in the future if initial access is denied from the start.
Learning from this campaign, users should only download files from trusted and
legitimate sources to prevent the entry of malicious files into their system.
Users should avoid enabling macros, and should be wary of documents that prompt
them to do so.
In general, more robust security measures can prevent ransomware and other
threats from having a strong impact on systems. These include employing least
privilege standards and ensuring that systems are up-to-date. If legacy systems
cannot be avoided, solutions that allow virtual patching can help ensure that
legacy systems are nonetheless protected.
Trend Micro Solutions
Trend Micro Cloud One™– Workload Security has a virtual patching feature that
can protect the system against exploits. Since some of the malware’s techniques
can bypass signature-based security agents, technologies like Trend Micro
Behavior Monitoring and Machine Learning can be used to prevent and block those
threats.
Enterprises can also take advantage of Trend Micro XDRTM, which collects and
correlates data across endpoints, emails, cloud workloads, and networks,
providing better context and enabling investigation in one place. This, in turn,
allows teams to respond to similar threats faster and detect advanced and
targeted threats earlier.
Indicators of Compromise
Trend Micro Detection Name SHA256 Ransom.Linux.EXX.YAAK-A
cb408d45762a628872fa782109e8fcfc3a5bf456074b007de21e9331bb3c5849
Ransom.Linux.EXX.YAAK-B
08113ca015468d6c29af4e4e4754c003dacc194ce4a254e15f38060854f18867
Ransom.Linux.EXX.YAAK-B
78147d3be7dc8cf7f631de59ab7797679aba167f82655bcae2c1b70f1fafc13d
Trojan.W97M.SHATHAK.A
6fb5af0a4381411ff1d9c9041583069b83a0e94ff454cba6fba60e9cd8c6e648
TrojanSpy.Win32.ICEDID.BP
3c5af2d1412d47be0eda681eebf808155a37f4911f2f2925c4adc5c5824dea98
TrojanSpy.Win32.ICEDID.BP
87e732bdc3a1ed19904985cfc20da6f26fa8c200ec3b2806c0abc7287e1cdab7
TrojanSpy.Win32.ICEDID.BP
884fe75824ad10d800fd85d46b54c8e45c4735db524c247018743eb471190633
Tags
Articles, News, Reports | Ransomware | Research
AUTHORS
* Trend Micro
Research, News, and Perspectives
Contact Us
Subscribe
RELATED ARTICLES
* TIDRONE Targets Military and Satellite Industries in Taiwan
* Banking Trojans: Mekotio Looks to Expand Targets, BBTok Abuses Utility
Command
* Why NDR is Key to Cyber 'Pest Control'
See all articles
Experience our unified platform for free
* Claim your 30-day trial
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Country Headquarters
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
Copyright ©2024 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
✓
Danke für das Teilen!
AddToAny
Mehr…
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
BDOW!