LMNTRX vs Egregor Ransomware

Egregor ransomware is a new strain of ransomware found in the wide range of attacks seen in many global organizations in the last couple of weeks. They found to be using similar code obfuscation and packed payloads to escape security detection as Sekhmet. It is a clear indication that Egregor ransomware is a variant of Sekhmet malware, many threat researchers acknowledged that Egregor seems to be derived from the Sekhmet malware family. The threat group brags about their attacks on the dark web by leaking stolen data and other activities.

INFECTION

In this article, our researchers collected the samples prevented by the LMNTRIX Active Defense solution from production client networks and conducted their analysis for documenting the techniques used by the adversaries.

Sample details:

‘q.dll’ is the main ransomware file and other two non-PE files are batch scripts. Let’s check the batch files:

Batch file’s MD5: 2A7FD15EBE1A1AC21E5F2AA889F26E46

Contents:

This script uses bitsadmin tool to transfer the ransomware dll file from the malicious IP address and stores the file inside the windows folder as ‘q.dll’. Then it calls for registering the dll file to perform the encryption. 

Once the batch file registers this malicious dll (q.dll), the above snapshot shows cryptic data found in the subroutine.

The IP address found inside this batch script: hxxp:// 45.153.242(.)129/q.dll. The second batch file is a truncated file of the first batch, and it contains the command for registering the ransomware dll.

Analysis of the Ransomware sample

Ransomware file q.dll – MD5: 3C18331989CB006506338ED1F838430D

The file compiled using VC++ as like variants of Maze and Netwalker ransomware.

The export details can be found in the below snapshot:

Based on our analysis to find out the tactics and techniques used by this sample, we found it to be employing the following techniques:

• Process Injection and Virtualization/Sandbox Evasion (System Checks) as the part of defence evasion tactic
• File and directory discovery as the discovery tactic
• Shared modules as the execution tactic

These techniques are often seen in ransomware malware sample using dll file. The sample has the functionality to detect the presence of virtual environment (VM aware functionality), it executes the anti-VM instructions which can be spotted in the dissected code mentioned in the snapshot.

We found the usage of FNV hashing to probably hide the strings in the code. The same technique we have observed in the ransomware families like Netwalker and Maze variants, (found the similar encoded strings), please refer the below snapshot:

Further, we observed CryptstringtobinaryA – from the API of crypt32.dll.

CryptStringToBinaryA – Same tactics used as Maze ransomware

In order to perform the decryption, there are levels of decryption that needs to be performed. We performed XOR operation in this code and found the below data.

It appears to be base64 encoded data and decoding of that base64 encoded was carried out with the help of CryptStringToBinary. The same tactics which we have already written about for the Maze ransomware.  The Maze ransomware reference sample details:

MD5: BD9838D84FD77205011E8B0C2BD711E0

Latest Victim of Egregor Ransomware

The most recent victim of the Egregor ransomware is Kmart, and prior to that it was TransLink from Vancouver and a popular game developer from Japan called Capcom.

Reference link: https://www.bleepingcomputer.com/news/security/metro-vancouvers-transit-system-hit-by-egregor-ransomware/

Reference link: https://www.tripwire.com/state-of-security/featured/capcom-hacked-resident-evil-game-developer-discloses-cyber-attack/

Threat Indicators

IOC details:

We collected the hash details of the same variants in the following list:

YARA rules:

import “pe”

import “hash”

rule ransom_egregor {

hash = “5f9fcbdf7ad86583eb2bbcaa5741d88a”

strings:

$p1 = “ewdk.pdb” fullword ascii

$p2 = “testbuild.pdb” fullword ascii

$s1 = “M:\\” nocase ascii

$s2 = “1z1M9U9” fullword wide

$s3 = “C:\\Logmein\\{888-8888-9999}\\Logmein.log” fullword wide

condition:

uint16(0) == 0x5a4d and filesize < 2000KB and

hash.sha256(pe.rich_signature.clear_data) == “b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c” or

(pe.sections[4].name == “.gfids” and pe.sections[5].name == “.00cfg”) and

(any of ($p*) or 2 of ($s*))

}

Screenshot of Egregor tor site: