Malware Analysis Trusted File is actually TA505 Threat Actor (Found by Human)

[Sandbox Breaker]

We found this out in the wild. One of our analysts noted that the file is listed as trusted but further down the execution chain... a malicious DLL is loaded. TA505 is the threat actor behind this threat. This goes to show that not even automatic analyses are perfect. Human + AI is the way.



File Listed As Trusted By Intezer and VT

https://analyze.intezer.com/analyses/f1b65616-30e4-4bce-9e26-eff5e02ee58d/genetic-analysis

VirusTotal

VirusTotal

www.virustotal.com

DLL loaded from Encoded PS Script spawned from the MSI suspect file

VirusTotal

VirusTotal

www.virustotal.com

 

[harlan4096]

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[Sandbox Breaker]

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

View attachment 272355

Im the one who uploaded it haha. Heres the DLL: Kaspersky Threat Intelligence Portal

 

[harlan4096]

I also sent it, found in MB...

 

[struppigel]

Yes, it is a malware downloader. Good find.

The DLL that it receives from the URL is not a valid PE file, the downloader fixes that and then registers the DLL as a server.

 

[harlan4096]

Just tried with KES11.11:

Spoiler

Event: Blocked
Application: File that launches another file
User: HARLAN4096-KES-\HARLAN4096-PC
User type: Initiator
Component: Exploit Prevention
Result description: Blocked
Type: Trojan
Name: PDM:Exploit.Win32.Generic
Threat level: High
Object type: Process
Object path: C:\Windows\Installer
Object name: MSI8765.tmp
Reason: Dangerous action
Databases release date: Today, 23/01/2023 1:37:00
SHA256: 9DBAF4E4632E70652FF72BB7890C35E3B9CD7A6939B29B5EEEC0C636D098C64E
MD5: 6AAC525CFCDD6D3978C451BBA2BB9CB3

 

[Sandbox Breaker]

We found this out in the wild. One of our analysts noted that the file is listed as trusted but further down the execution chain... a malicious DLL is loaded. TA505 is the threat actor behind this threat. This goes to show that not even automatic analyses are perfect. Human + AI is the way.



File Listed As Trusted By Intezer and VT

https://analyze.intezer.com/analyses/f1b65616-30e4-4bce-9e26-eff5e02ee58d/genetic-analysis

VirusTotal

VirusTotal

www.virustotal.com

DLL loaded from Encoded PS Script spawned from the MSI suspect file

VirusTotal

VirusTotal

www.virustotal.com

6 months later and Intezer still lists the file as trusted! Wow

 

[Kongo]

@fakewatchman really interesting threads that you are sharing. Keep on posting updates on your findings!

 

[Sandbox Breaker]

Thanks buddy!