drIBAN is a web-inject kit used in Italian corporate banking fraud, paired with the sLoad loader to infect Windows workstations and bypass anti-fraud measures. The operation evolved into an APT-like campaign with persistence, LOLBins, DNS checks, and Ramnit payloads, highlighting a sophisticated banking fraud ecosystem in Italy. #drIBAN #sLoad #Ramnit #Italy #Mandiant #Cyberreason
Keypoints
- The drIBAN operation centers on a web-inject kit designed to alter banking page content and bypass MFA/SCA during transfers. (Infection chain and purpose described in the article)
- Initial infection is delivered via PEC malspam, with a downloader and an executable payload (e.g., .wsf, .vbs, or .ps1).
- sLoad serves as a PowerShell-based loader, performing reconnaissance and loading additional payloads, including Ramnit.
- Living Off The Land (LOLBins) techniques are used to hide activity, abusing built-in Windows tools like PowerShell and BITSAdmin.
- The malware performs extensive discovery (system info, network details, running processes) and even takes screenshots during the infection.
- DNS-cache checks are used to determine if the infected host targets specific corporate banking institutes before progressing.
- There is evidence of a large, targeted campaign with ties to Ramnit and possible overlap with threat actors like TA-554, including debugging bank accounts and coordinated infrastructure.
MITRE Techniques
- [T1566.001] Phishing: Attachment – Infects machines via PEC malspam with executable attachments. – ‘The email attachment typically includes a couple of harmless files (e.g., .pdf, .png) and an executable file, typically in the form of .wsf, .vbs, or .ps1, which is the sLoad downloader.’
- [T1059.001] PowerShell – sLoad is a Powershell loader and uses PowerShell for execution and reconnaissance. – ‘sLoad is a Powershell loader, already well-described by technical reports from various security firms, which includes advanced reconnaissance features like: collecting system information (e.g., “computer name”, “network details”, “list of running processes”, etc.)’
- [T1105] Ingress Tool Transfer – The sLoad downloader retrieves and executes the sLoad core Powershell script from a server. – ‘the sLoad downloader will retrieve and execute the sLoad core Powershell script.’
- [T1113] Screen Capture – sLoad performs screen capture as part of its reconnaissance. – ‘taking screenshots’
- [T1082] System Information Discovery – sLoad collects system information during reconnaissance. – ‘collecting system information (e.g., “computer name”, “network details”, “list of running processes”, etc.)’
- [T1057] Process Discovery – sLoad enumerates running processes as part of its information-gathering. – ‘list of running processes’
- [T1562.001] Impair Defenses (Living Off The Land) – LOLBins usage to hide malicious activity using built-in tools like PowerShell and BITSAdmin. – ‘Living Off The Land, also known as LOLBins which consists in abusing legitimate built-in Windows tools and products for hiding its malicious execution and network communications, respectively Powershell and BITSAdmin.’
Indicators of Compromise
- [Hash] Malspam attachment – d5299434aa5119814df6f50d9ddce8e1
- [Hash] sLoad downloader – 7e9280027235462727a9a351429725c6
- [Hash] sLoad core – 2c7a9e3fe582667826510d70b8c79f19
- [Hash] sLoad 2nd stage module (DNS cache checks) – 6c3db9101ead9e8461ae3846c43aa8ec
- [Domain] sLoad C2 – jopkerto[.]tech
- [Domain] sLoad C2 – guituk[.]eu
Read more: https://www.cleafy.com/cleafy-labs/uncovering-driban-fraud-operations-chapter1