FortiGuard Labs’ ransomware roundup analyzes CatB, detailing its Windows-focused dropper, DLL sideloading, anti-analysis checks, and a high ransom demand. It also covers infection methods, payload behavior, and Fortinet protections and guidance. #CatB #FortiGuardLabs #MicrosoftWindows #ProtonMail #DLLSideloading #MSDTC #Bitcoin #Fortinet
Keypoints
- CatB is a relatively new ransomware variant with samples dating back to late 2022, possibly linked by cryptocurrency (Bitcoin wallet) to the same actor.
- Infection vectors are not fully disclosed, but are presumed similar to other ransomware groups.
- The dropper uses DLL sideloading (via a DLL in the same directory as a trusted executable) and is executed with rundll32.exe.
- The dropper is UPX-packed to obfuscate its contents and unpacked during execution.
- Multiple anti-analysis checks are implemented (e.g., VM/sandbox checks, CPU/RAM validation, and disk geometry checks). If checks fail, execution terminates.
- The ransom note is effectively embedded by prepending content to encrypted files; ransom starts at 50 BTC on day 1 and increases daily.
MITRE Techniques
- [T1574.002] DLL Side-Loading – Dropper packed into a Windows DLL and uses DLL sideloading to execute the payload; “This particular version of CatB uses DLL sideloading to execute the payload’s code.”
- [T1218.011] Signed Binary Proxy Execution: Rundll32 – Execution of the dropper is accomplished using the Windows “rundll32.exe” application; “Execution of the dropper is accomplished using the Windows “rundll32.exe” application.”
- [T1027] Obfuscated/Compressed Files and Information – Dropper is packed using UPX, which unpacks the file and executes the code inside; “The dropper is packed using UPX, which unpacks the file and executes the code inside.”
- [T1497] Virtualization/Sandbox Evasion – Anti-VM checks and barriers to prevent analysis; “create an array of barriers to prevent analysis and execution on virtual machines/sandboxes. To validate that the malware has been loaded on a legitimate target, each barrier must be met before the payload is dropped and executed.”
- [T1543.003] Create or Modify System Process: Windows Service – Alters the service username to LocalSystem and starts MSDTC; “alter the username of the service to “LocalSystem” and then starts MSDTC.”
- [T1486] Data Encrypted for Impact – Encrypts files on the victim’s machine; “encrypts files on the compromised machine and demands ransom for file decryption.”
Indicators of Compromise
- [SHA256] File-based IOCs – CatB Dropper, Unpacked CatB Dropper, and CatB Payloads; 6 total listed hashes including two example hashes: 3661ff2a050ad47fdc451aed18b88444646bb3eb6387b07f4e47d0306aac6642, 83129ed45151a706dff8f4e7a3b0736557f7284769016c2fb00018d0d3932cfa, and 4 more hashes
Read more: https://www.fortinet.com/blog/threat-research/ransomware-roundup-catb-ransomware