{"id":221234,"date":"2020-11-12T13:43:58","date_gmt":"2020-11-12T12:43:58","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=221234"},"modified":"2020-11-12T13:43:58","modified_gmt":"2020-11-12T12:43:58","slug":"egregor-prolock","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/egregor-prolock\/","title":{"rendered":"Egregor \u2013 Prolock: Fraternal Twins?"},"content":{"rendered":"\n

CERT Intrinsec has faced since the beginning of September several cases involving Egregor and Prolock ransomwares. This article aims at presenting Egregor and Prolock techniques, tactics and procedures, as well as sharing indicators of compromise and highlighting actions of the threat actor operating both ransomwares, according to collected intelligence and TTPs analysis.<\/em><\/p>\n\n\n\n

On one hand, Egregor has a similar strategy to other ransomwares, as it exfiltrates data, encrypts files and publishes them on its website in order to make victims pay the ransom. It is active since the beginning of September 2020 and impacts many sectors from insurance to transport. Its goal is lucrative.<\/em><\/p>\n\n\n\n

On the other hand, Prolock, successor of PwndLocker, is active since March 2020. As many other ransomwares, it targets big companies with ransoms going from 35 to 255 bitcoins (400 000 to 3 000 000 $). Its goal is, as far as we know, only lucrative. Prolock is active mainly in Northern America and in Europe and impacts several sectors, such as health, construction, finance, legal, etc.<\/em><\/p>\n\n\n\n

\n\n\n\n

Kill chain<\/h2>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
\n\n\n\n

Egregor ransomware analysis<\/h2>\n\n\n\n

<\/p>\n\n\n\n

Initial access<\/h4>\n\n\n\n

We were not able to find identified specific initial accesses, we found traces of Qakbot during investigations but we could not identify how it was dropped on information systems. We observed many potential intrusion vectors on patient 0 (many malwares were found on the machine).<\/p>\n\n\n\n

Internal reconnaissance<\/h4>\n\n\n\n

Prior to privilege escalation, Egregor proceeds to Active Directory reconnaissance using tools such as Sharphound or AdFind. These tools are used to gather information about users, groups, computers, and so on. They aim as well at finding the best compromission paths.<\/p>\n\n\n\n

Privilege escalation<\/h4>\n\n\n\n

During investigations, Egregor compromises Active Directory in order to become domain admin.<\/p>\n\n\n\n

Lateral movement<\/h4>\n\n\n\n

Egregor moves laterally on information systems using CobaltStrike SMB beacons. This feature allows an attacker to use SMB named pipes (logical connections between a client and a server) to communicate commands through the information system revealing C2 IP address.<\/p>\n\n\n\n

The following command line is a service created by CobaltStrike and can be found in Windows Event Logs (event id 7045). It runs an encoded powershell command.<\/p>\n\n\n\n

\"\"
CobaltStrike service execution<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n

It is possible to deobfuscate CobaltStrike payloads (base64, gunzip and XOR operations) using CyberChef[1]<\/a>:<\/p>\n\n\n\n

\"\"
CobaltStrike payload deobfuscation<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n

C2 Communication<\/h4>\n\n\n\n

Once settles on victim\u2019s information systems, Egregor communicates with its Command and Control servers via HTTPS protocol so as to drop scripts or dynamic link libraries on infected hosts. You can find the list of C2 identified during investigations in section \u00ab\u00a0IP Addresses\u00a0\u00bb<\/strong>.<\/p>\n\n\n\n

Data exfiltration<\/h4>\n\n\n\n

Egregor masquerades svchost.exe<\/em> process to launch an RClone <\/em>client in order to exfiltrate data. RClone<\/em> aims at managing files in cloud, it deals with multiple systems and protocols. The RClone<\/em> configuration file, in plain text, is dropped by the attacker with the binary. Based on investigations and OSINT, we know that Egregor used at least three different configurations to exfiltrate data.<\/p>\n\n\n\n

\"\"
RClone Configuration File (WebDav)<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
RClone Configuration File (sFTP)<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
RClone Configuration File (DropBox)<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n

Defense evasion<\/h4>\n\n\n\n

To evade protections, Egregor create a Group Policy Object to disable Windows Defender and try to takedown any anti-virus console prior to ransomware execution:<\/p>\n\n\n\n

Display name: New Group Policy Object\nVersion: 1\nregistry.pol content:\n-\tKey path: Software\\Policies\\Microsoft\\Windows Defender\n-\tData name: DisableAntiSpyware\n-\tValue type: 0x04 (REG_DWORD)\n-\tData value: 0x01\n<\/code><\/pre>\n\n\n\n
Ransomware execution<\/h4>\n\n\n\n
Egregor downloads custom dynamic link libraries (b.dll, q.dll, etc) using bitsadmin and execute them on victim\u2019s systems to encrypt data.<\/p>\n\n\n\n
\"\"
DLL download and execution<\/span><\/em><\/figcaption><\/figure><\/div>\n\n\n\n
\n\n\n\n
Prolock ransomware analysis<\/h2>\n\n\n\n
<\/p>\n\n\n\n
Initial Access<\/h4>\n\n\n\n
One of the intrusion vectors is malspam. Indeed, Emotet<\/strong> is used to initiate infection on several user workstations and to drop Qakbot<\/strong>. Emotet used legitimate documents after taking control of some user\u2019s email accounts. These documents contain a payload which tries to download a binary file from different URLs, as following. On infected systems, after the execution of the binary retrieved by Emotet code, few files are created (typical Qakbot operation):<\/p>\n\n\n\n