Attackers are distributing LockBit 3.0 by leveraging Amadey Bot as a downloader, using malicious Word documents and executables disguised as Word files to drop the malware. Amadey is used to contact a C2 server and fetch LockBit payloads, including PowerShell-based components and an executable, enabling encryption and ransom messaging.
#AmadeyBot #LockBit3.0 #GandCrab #TA505 #Clop #FlawedAmmyy
#AmadeyBot #LockBit3.0 #GandCrab #TA505 #Clop #FlawedAmmyy
Keypoints
- Amadey Bot is used to install LockBit 3.0 on compromised systems.
- Distribution occurs via two methods: a malicious Word document with a VBA macro and an executable disguised as a Word file icon.
- Case 1 leverages a malicious Word file (Sia_Sim.docx) that downloads a VBA macro, which creates a LNK downloader.
- The LNK downloader uses a PowerShell-based workflow to fetch Amadey and ultimately the LockBit payload.
- Case 2 involves an executable masquerading as a Word file (Resume.exe), likely delivered by email attachment.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – Distribution via malicious Word documents and email attachments described as Case 1/Case 2: “There is also a case where the malware was found as “Resume.exe.” The e-mail used in the attack has not been confirmed yet, but the file was run as “Resume.exe.” It was also disguised as an innocuous Word file icon…”
- [T1023] LNK – LNK file is created and used as downloader: “The LNK file is created in the “C:UsersPublicskeml.lnk” pathway and is executed via the following command. > rundll32 url.dll,OpenURL C:UsersPublicskeml.lnk”
- [T1218] Signed Binary Proxy Execution: Rundll32 – Use of rundll32 to run the LNK/loader: “rundll32 url.dll,OpenURL C:UsersPublicskeml.lnk”
- [T1059.001] PowerShell – Download and execute Amadey via PowerShell commands: “The LNK file is a downloader that runs powershell command to download and run Amadey.”
- [T1027] Obfuscated/Compressed Files and Information – Powershell scripts are obfuscated before execution: “The powershell files are initially obfuscated, and are structured to be executed after being unobfuscated in the memory.”
- [T1053.005] Scheduled Task/Job – Persistence via Task Scheduler: “c:windowssystem32schtasks.exe” /create /sc minute /mo 1 /tn rovwer.exe /tr “c:users[username]appdatalocaltemp…rovwer.exe” /f
- [T1036] Masquerading – Files disguised as innocuous Word items: “Amadey Bot disguised as innocuous Word file icon”
- [T1071.001] Application Layer Protocol: Web Protocols – C2 communications and downloads from web addresses: “Amadey receives three commands from the C&C server, and they are all commands that download and execute malware from the external source.”
- [T1486] Data Encrypted for Impact – LockBit encryption behavior: “Lockbit ransomware infects files … creates a ransom note in each folder.”
Indicators of Compromise
- [MD5] Malicious Word Document – 13b12238e3a44bcdf89a7686e7179e16, ae59e82ddd8d9840b79bfddbe4034462
- [MD5] Downloader LNK – bf4d4f36c34461c6605b42c456fa4492
- [MD5] Amadey (1234.exe) – 56c9c8f181803ece490087ebe053ef72
- [MD5] Amadey (Resume.exe) – bf331800dbb46bb32a8ac89e4543cafa
- [MD5] Amadey Stealer Plugin – ad444dcdadfe5ba7901ec58be714cf57
- [MD5] LockBit – f9ab1c6ad6e788686509d5abedfd1001 (cc.ps1)
- [MD5] LockBit – 1690f558aa93267b8bcd14c1d5b9ce34 (dd.ps1)
- [MD5] LockBit – 5e54923e6dc9508ae25fb6148d5b2e55 (LBB.exe)
- [URL] External and download URLs – http://188.34.187[.]110/v5sqpe.dotm and http://188.34.187[.]110/1234.exe (and other Amadey/C2 URLs)
- [Filename] Sia_Sim.docx; skeml.lnk; Resume.exe – referenced file names used in distribution and payloads
Read more: https://asec.ahnlab.com/en/41450/