No More Macros? Better Watch Your Search Results!

By Pham Duy Phuc and Max Kersten · February 08, 2023

Threat actors often rely on the same techniques until their hand is forced, usually due to defensive changes or chance-based opportunities, to leverage a new technique. Malicious macros in Microsoft Office have long been the “industry standard” to initially compromise devices. As such, Microsoft’s default blocking of internet-originating macros caused threat actors to find new methods to infect victims, leading to the rise of search engine optimization (SEO) poisoning. This blog will dive into the increasing trend of SEO poisoning, and describe what steps likely follow an infection. Afterwards, a trend overview of the Gootkit loader is given, based tracking efforts of the Trellix Advanced Research Center.

What is search engine optimization?

To fully understand the change in actor behavior, one must understand that malicious macros embedded within lure documents, have been spread massively over past decades. The global scale, both in terms of regions as well as sectors, allowed actors to thrive, since millions upon millions of macros with malicious were sent via phishing. While the usage of malicious macros hasn’t yet declined based on our email telemetry, it is likely to lessen in the future due to Microsoft’s measures. Actors have to, after all, find a new way to get their malware onto a victim’s machine, which is where SEO poisoning comes into play.

When used as intended, SEO achieves a higher rank on search engines for a given set of keywords. While its use started as an additional resource to be better identifiable in search results, nowadays sites require at least some form of SEO to be ranked high enough to be seen by users.

SEO poisoning is a technique where threat actors get into top results, be it via advertisements and/or via high(er) ranked websites. HP recently detailed how actors spread multiple different malware families to victims. Recently, this tactic made headlines when Twitter user NFT_GOD accidentally downloaded a malicious version of Open Broadcaster Software (OBS) via one such malicious site, which upended his digital life and stole most of his digital assets, such as crypto currency and NFTs. NFT_GOD has been very transparent about the impact of this attack, which has sparked a debate within the infosec community regarding these tactics, techniques, and procedures (TTPs).

More malware-laden SEO results loom on the Horizon

One such malware family which utilizes SEO poisoning is the Gootkit loader (also known as Gootloader). This malware is used to spread and launch arbitrary malware, often leading to a Cobalt Strike beacon. The spreading is accelerated as the malware is spread via compromised benign websites. By piggybacking off the existing benign reputation of a hijacked website, spam and abuse filters will judge such a website less harsh than a newly registered domain without a reputation, or an already known domain with a negative reputation. The most interesting steps the malware takes are laid out in the analysis below.

The malware’s entry point is at function “modernkj”, and the main encoded variable is “speedk”. The “btkmym” function can be used to decode “speedk” to obtain the first decoded payload, which is shown in the figure below.

The “gmxes” function then decodes the second payload, which is then executed. The second payload’s internals are based upon encoded strings, which are recovered using a function named “v”. This function takes a single argument, the index of the string to recover, after which a string is converted into a string array based on the pipe that splits the different strings. The required string is then obtained by taking the given string and moving the first character to the end of said string. This is done as many times as the given index within the array. To illustrate, as can be seen in the figure below, the first string “sFileExist” becomes “FileExist” + “s”, making it “FileExists”. The fourth string is four characters long, which means its already shown in the same order as it would be when repeating this step four times.

The original values of the array are given below, in the format of “index:value”:

Next, the third stage invokes WScript to execute the next stage. The obfuscation makes the code harder to read, as can be seen below.

But once it is (partially) deobfuscated, the code itself becomes more apparent. The next stage is another script, in this case PowerShell based, but given the usage of cscript, other languages can be possible, marking the loader’s versatility.

The stages thereafter perform different steps but are not relevant enough to be explained in-full within this blog. The malware collects information about the operating system, running processes, grabs open window titles, the amount of free disk storage, and information about the user’s default folders and the content thereof (i.e. the user’s Desktop folder). The final connection to the Command & Control (C&C) server is interesting, as it contains a built-in redundancy check, along with a built-in sleep timer to avoid connecting to the C&C domains in rapid succession.

The C&C URLs, ten of which are present within the array, can all be used by the malware. There is no specific order in which they are used, as the generated index to fetch a URL from is a random entry from the given array. The random number is generated based on the Get-Random cmdlet, with the array as input. Due to the “while(1)”, where the 1 equals “true”, loop which is never broken, this process continues endlessly. The C&C URLs used in this sample, aren’t shared, since the Gootkit loader also includes decoy domains. Since our tracking mechanism didn’t verify which domains returned a payload, listing all domains is likely to lead to benign domains being marked as malicious. Please refer to our Insights preview page or our own instance of Trellix Insights for more context to the given domains. Mandiant’s detailed report about the Gootkit loader also mentions the usage of decoy domains, along with additional technical insights.

Tracking Gootkit Loader

The Gootkit loader is used to target different sectors with different malware, based on what malware it spreads. Based on our Advanced Research Center’s tracking efforts, it becomes apparent that the malware is spread based on specific keywords. Most notable, as can be seen in the table below, is the “agreement” keyword.

The names in the figure are based upon the Gootkit loader file names, which show that the malware targets victims who look for information on contracts and similar documents. This doesn’t necessarily mean that the financial sector is targeted, but rather that the financial gain from such agreements is of interest to the threat actor(s). A recent investigation by TrendMicro shows that the Australian healthcare industry was targeted.

Not all samples utilize the same number of C&C domains (be it with or without decoy domains), based on which some interesting trends can be seen. Firstly, the used top-level domains of all domains within the loaders, the top 20 of which can be seen in the figure below.

The most frequent domain is “.com”, with 2615 occurrences within the given data set. This peak dwarfs the other results, which can be best viewed in a graph which excludes the most used top-level domain, as can be seen below.

The top-level domains which aren’t bound to a country code (non ccTLDs) make up the top three, after which most of the domains are European, barring a few exceptions. Do note that while the United States has a ccTLD, the commercial (.com) domain is often used. Since this domain is used globally, it is difficult to define which of these domains belong to which country, without drawing wrong conclusions.

The domains which are listed in the graph below, show that some of the C&C domains are re-used, while others aren’t. Three out of the top four domains utilizes the “.com” TLD, which is likely to skew the above TLD related results somewhat, although they are present in numerous samples, meaning the numbers are still based on the samples themselves.

The re-used domains can be useful when looking for indicators of compromise, but do note that these domains can be benign as they have not been verified: they are included here merely because the samples included the domains, and can thus reach out to them, regardless if they are benign or malicious.

Lastly, the scheduled tasks, via which persistence is achieved, seem to be generated semi-random. Their names aren’t random characters taken from an alphanumeric alphabet, but rather by combining words, such as “Nuclear Pharmacy” or “Organic Geochemistry”. This might seem benign to a certain extend (given how some IT tools have rather odd names), especially to users who aren’t as technologically advanced, but they surely are malicious in nature.

Conclusion

To conclude, the malware itself is used in numerous ways, mostly with a focus on financial gain. The regular updates show that the developer(s) are actively working to maintain and upgrade the malware for their customers. The tracking efforts over time provide a unique insight into malware families and the developments thereof, which Trellix uses to better its products and protect its customers.

Threat actors will continue to innovate their techniques to infect their victims, with SEO poisoning being one of the recent trends. The Trellix Advanced Research Center is aware of this, and is closely tracking new trends, techniques, and attempts thereof.

Hashes

Below, all hashes for the used data are given.

Source: https://www.trellix.com/en-us/about/newsroom/stories/research/no-more-macros-better-watch-your-search-results.html