Fortinet FortiGuard Labs details a sophisticated multi-stage attack where an Excel file with a VBA macro drops a DLL downloader to fetch the Cobalt Strike beacon, employing evasion and anti-analysis techniques to reach Ukrainian targets. The operation chains HEX-encoded strings, RC4/AES decryption, registry persistence, and process injection to establish a foothold and communicate with C2 servers. #CobaltStrike #PicassoLoader #UAC0057 #Ukraine #FortiGuard #CERT-UA
Keypoints
- Attack uses a Ukrainian-themed Excel document with macros to lure users into enabling macros and starting the chain.
- The VBA macro deploys a HEX-encoded DLL downloader designed to evade basic string detection.
- The downloader fetches the next-stage payload from a Ukraine-restricted URL and saves it with a random name in TEMP.
- Persistence is established via a registry Run key and a regsvr32-based execution chain using an LNK file.
- The DLL injector component decrypts payloads with RC4 (and AES later) and injects into processes to run the final Cobalt Strike beacon.
- Final beacon configuration reveals C2 URLs and demonstrates location-based checks to target Ukraine.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The malicious Excel document contains elements in Ukrainian designed to lure the user into enabling its macros. ‘The malicious Excel document contains elements in Ukrainian designed to lure the user into enabling its macros.’
- [T1059.005] VB/VBA – The VBA macro deploys a DLL downloader, which is encoded in HEX. ‘The primary function of the VBA macro is to deploy a DLL downloader, which is encoded in HEX.’
- [T1105] Ingress Tool Transfer – The downloader constructs a web request to get the next stage payload from the URL. ‘constructs a web request to get the next stage payload from the URL …’
- [T1218.011] Regsvr32 – The LNK file uses regsvr32 to execute the DLL file. ‘regsvr32 to execute the DLL file.’
- [T1027] Obfuscated/Compressed Files and Information – HEX-encoded strings are used to evade basic string detection. ‘HEX-encoded strings to evade basic string detection mechanisms.’
- [T1070.004] Indicator Removal on Host – The malware features self-deletion to remove traces. ‘self-deletion feature aids evasion tactics.’
- [T1547.001] Registry Run Keys/Startup Folder – Persistence is added via a Run key in the registry. ‘registry value … Run for persistence.’
- [T1055] Process Injection – The final payload is injected into processes to execute Cobalt Strike. ‘injects the decrypted data into itself and employs various APIs … to execute the final Cobalt Strike.’
- [T1071] Web Protocols – The beacon communicates with C2 servers over web protocols. ‘establish communication with a command and control (C2) server.’
- [T1140] Deobfuscate/Decode Files or Information – The loader decrypts data with RC4 and AES to obtain the next-stage payload. ‘decrypt the data using an RC4 algorithm and writes the data to the newly created file’ and ‘decrypts the final payload with an AES algorithm.’
Indicators of Compromise
- [Domain] goudielectric.shop – C2-related domain used in the payload delivery chain.
- [Domain] simonandschuster.shop – C2-related domain used for the Beacon configuration.
- [Files] 88c97af92688d03601e4687b290d4d7f9f29492612e29f714f26a9278c6eda5b, 815c1571356cf328a18e0b1f3779d52e5ba11e5e4aac2d216b79bb387963c2be, and 6 more hashes.