www.trendmicro.com
Open in
urlscan Pro
23.215.19.10
Public Scan
URL:
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html
Submission: On August 09 via api from DE — Scanned from DE
Submission: On August 09 via api from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___2A0VF">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Cloud Security
* Cloud Security
* Trend Cloud One
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious applications,
and other mobile threats
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach or
looking to proactively improve your IR plans
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Channel Partners
* Channel Partners
* Channel Partner Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Connect with Us
* Connect with Us
* Connect with Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Ransomware
TARGETCOMPANY RANSOMWARE ABUSES FUD OBFUSCATOR PACKERS
In this entry, we detail our analysis of how the TargetCompany ransomware abused
an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect
vulnerable systems.
By: Don Ovid Ladores, Nathaniel Morales August 07, 2023 Read time: 5 min (1215
words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
We found active campaign deployments combining remote access trojan (RAT) Remcos
and the TargetCompany ransomware earlier this year. We compared these
deployments with previous samples and found that these deployments are
implementing fully undetectable (FUD) packers to their binaries. By combining
telemetry data and external threat hunting sources, we were able to gather early
samples of these in development. Recently, we found a victim on which this
technique was deployed and targeted specifically at.
Figure 1. Latest TargetCompany ransomware infection chain
Achieving persistence
Like previously documented TargetCompany ransomware attacks, the latest variant
starts with the exploitation of vulnerable SQL servers to persistently deploy
its first stage. The routine tries various directions to attempt persistence,
such as changing up the URLs or applicable paths until it successfully finds an
area to execute the Remcos RAT.
Table 1. Sample download attempts to deploy Remcos RAT URL Expected drop path
Notes Results _hxxp://80.66.75[.]37/drtse.exe %TEMP%\tzt.exe Executed with
%TEMP%\updt.ps1 Failed /Terminated _hxxp://185.209.230[.]21:8080/lighting.exe
%TEMP%\tzt.exe Executed with %TEMP%\updt.ps1 Failed /Terminated
_hxxp://80.66.75.37/Ayhhny.exe %TEMP%\tzt.exe Executed with %TEMP%\updt.ps1
Failed /Terminated _hxxp://80.66.75[.]37/lawer.exe
%TEMP%\1DKPCKM7.exe
%TEMP%\VOCNDGB2.exe
%TEMP%\tzt.exe
Executed with %TEMP%\updt.ps1 Failed /Terminated _hxxp://80.66.75[.]37/Bwarp.exe
%TEMP%\WIMZJ19D.exe
%TEMP%\YLJ7ZVT0.exe
%TEMP%\tzt.exe
Executed with %TEMP%\updt.ps1 Failed /Terminated
_hxxp://185.209.230[.]21:8080/Auptxums.bat %TEMP%\tzt.bat Executed
with %TEMP%\updt.ps1 Drop and execution of Remcos RAT (Blocked by current Trend
Micro solutions)
Figure 2. Download attempts for the first stage
Since the initial efforts were terminated and blocked by the existing solutions,
the attackers opted to use the FUD-wrapped version of their binaries. The FUD
packer used by Remcos and the one used by the TargetCompany ransomware has a
style of packaging that closely resembles the style used by BatCloak: Using a
batch file as an outer layer and afterward, decoding and loading using
PowerShell to make a LOLBins execution.
Figure 3. PowerShell execution of the Remcos RAT, also showing the typical
routine for malware wrapped in FUD packers
Metasploit usage
This variant’s routine used another unique tool, which our analysis identified
as Metasploit (Meterpreter) usage. This group is not widely known to use such
tools, so it is interesting to see it leverage Metasploit to do the following:
*
* Query/Add a local account
*
* Deploy GMER
*
* Deploy IObit Unlocker
*
* Deploy PowerTool (or PowTool)
Afterward, the Remcos RAT will resume its final routine as it downloads and
deploys the TargetCompany ransomware still wrapped in an FUD packer.
Table 2. Metasploit module for executing shell commands Subject process Child
process Command line C:\temp\straightforward.exe C:\windows\syswow64\net.exe
localgroup administrators [~redacted] /ad
Tracking the loader’s rising popularity
The previous wave of campaigns abusing OneNote made headlines because of the
technique’s novelty: the use of a specific PowLoad and a corresponding CMDFile
(batchfile or.bat) that contained the actual payload. Since it was first
released, the specific “cmd x PowerShell” loader has slowly been gaining
traction. By the end of February 2022, TargetCompany ransomware operators
adopted the tactic.
Figure 4. FUD loaders and TargetCompany ransomware deployment activities
Analyzing the loader differences
The CMDFiles were initially indistinguishable between the other users (malware
families AsyncRAT, Remcos, and the TargetCompany ransomware) of the batch file
technique. The use of the CMDFiles starts to differ with the execution of the
command line and during the load of the main binaries. While AsyncRAT employs
decompression and decryption, the loaders related to Remcos and TargetCompany
only used decompression to unpack the payload and changed the general appearance
of its structure while maintaining the same functionality.
Figure 5. The BatLoad appeared similar in structure between the versions found
in previous deployment reports and samples.
Figure 6. Bare and unobfuscated AsyncRAT loader command line (top) and decoded
loader command line of Remcos and the TargetCompany ransomware
For the AsyncRAT loader, the CMDFile loads the binary payload successfully
regardless of whether the system’s architecture is 32-bit or 64-bit. With the
routines in Remcos and TargetCompany, however, the powershell.exe file is
hard-coded to find the deobfuscated Remcos CMDFile only in the SysWOW64 folder.
Even though the payload binary works in both 32-bit and 64-bit systems, the way
that the PowerShell file is hard-coded “almost” guarantees that the routine will
fail to execute in 32-bit systems given that it is usually only found in 64-bit
systems. Microsoft has required new Windows 10 systems since version 2004
(released in the middle of 2020) to be 64-bit; Windows 11 was never released in
a 32-bit version. Running this malware on a 32-bit operating system is therefore
something of an edge case which we need not discuss here.
Figure 7. Decoded loader command line in Remcos and the TargetCompany ransomware
Figure 8. Deobfuscated Remcos CMDFile showing the copying of the PowerShell
routine
Technique adoption
When we investigated the suspicious network connections related to the
PowerShell, we discovered the new variant of the TargetCompany ransomware. When
we checked the payload binary, we saw that the variant belongs to the second
version of the said ransomware family, commonly characterized by a connection to
a command-and-control (C&C) server with a “/ap.php” landing page.
Figure 9. C&C communication by the TargetCompany ransomware
Pivoting from the IP address or URL, we found samples from a public repository
verified to be the Remcos RAT. Considering the uses for obfuscation of the
different batch files in a previous section, as well as the fact that for every
execution of Remcos there is also an instance of an attack by the TargetCompany
ransomware, we were not surprised at the use of the technique. Similarly, we
found a verified Remcos sample with zero detections on public repositories.
Insights
The use of FUD malware already limits most available solutions for this said
tactic, even more so for off-the-shelf technologies likely susceptible to other
attacks (not just ransomware). This set of packers will likely not be the only
ones being developed in the near future. Early detection allows security teams
and analysts to detect these FUD packers as their respective routines and coding
follow a certain flow that makes it easy to prevent. At the same time, this also
allows these organizations’ teams to check for increases in usage even through
external threat intelligence sources and repositories.
Attackers will keep innovating even the simplest means of abuse. While the
technique of using FUD packers and Metasploit has been around for a while now,
security teams and organizations should not underestimate its effectivity in
circumventing current and established security solutions, especially in key
features that leave technologies almost blind until a victim is documented.
To date, majority of TargetCompany ransomware’s victims still stem from
vulnerable SQL Servers being exploited to gain entry. Security teams should have
visibility and check all possible attack surfaces to ensure their respective
systems are not susceptible to abuse and exploitation. Meanwhile, we deem the
FUD packer a tool that can easily be altered without much effort, and current
solutions might well be one step behind these developments. Fortunately, AI- and
machine learning-based file checking and behavior monitoring solutions, best
practices for network blocking, and ransomware detection and blocking measures
can act as multiple layers in mitigating the impact of these threats’ risks.
Organizations should encourage and implement redundant exercises ensuring users’
awareness of their own systems and networks to prevent intrusion attempts and
execution of malicious activities.
Indicators of Compromise (IOCs)
Download the list of indicators here.
Tags
Malware | Cyber Crime | Exploits & Vulnerabilities | Cyber Threats | Data center
| Endpoints | Ransomware | Network | Articles, News, Reports
AUTHORS
* Don Ovid Ladores
Threats Analyst
* Nathaniel Morales
Threat Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Zero Trust Frameworks for Industry
* An Overview of the New Rhysida Ransomware Targeting the Healthcare Sector
* Cybersecurity Threat 1H 2023 Brief with Generative AI
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo