Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• An information stealing malware called Mars Stealer in a customer’s environment within the consumer services industry.

Summary of the Incident

• The victim downloaded and executed a fake Chrome installer (chromesetup.iso) from >hxxps[:]//googleglstatupdt[.]com/LEND/ChromeSetup.iso.
• The ISO contains chromesetup.exe.
  • When manually executed by the victim, the fake setup process initializes the NetSupportManager RAT (remote access tool) and the legitimate Chrome setup as a decoy (Figure 1).
    • NetSupportManager is commonly used to remotely control systems for malicious purposes.
  • A shortcut is also added to the user’s startup directory for persistence.
  
  
  • Using the NetSupportManager RAT session, the threat actor copied obfuscated scripts with a .wmd extension that are responsible for creating a renamed AutoIT binary and an loading an obfuscated version of Mars Stealer from %TEMP%/IXP<3-digit number> .TMP.
  • One of the obfuscated scripts contains an embedded payload encrypted with RC4 using the hardcoded key ‘344868553478223918282826525’ (Figure 2).
  
  
  • Once loaded, Mars Stealer performs several HTTP requests to retrieve configuration and DLL (Dynamic Link Library) files required for Mars Stealer to operate successfully and upload stolen data (Figure 3).
  
  
  • Lastly, Base64 decoded part of the configuration retrieved from /7AgkTb5xcS.php:
    1|1|1|1|0|5qDlPuVKoR|Telegram|0|%APPDATA%\Telegram
    Desktop\tdata\|*D877F783D5D3EF8C*,*map*,*configs*|1|0|0|rdp|3|%DESKTOP%\
    |*.rdp|0|1|0|cer|3|%DESKTOP%\|*.cer|0|1|0

Background on Mars Stealer

• In June 2021, Mars Stealer was advertised on XSS, the Russian-language criminal forum, by MarsTeam for $140/month or $800 for a lifetime subscription.
• Mars Stealer’s capabilities include:
  • Cryptocurrency theft (“Our software was developed taking into account the wishes of people working in crypto, so at Mars you can find everything you need to work with crypto and more.” – MarsTeam post on XSS forum).
    • The stealer supports dozens of popular browser plugins for popular cryptocurrency platforms, such as Coinbase.
    • Additionally, in December 2021, MarsTeam announced the release of “Mars ClipboardChanger”, which substitutes crypto wallet addresses in the victim’s clipboard cache to hijack payments.
  • Data theft from major web browsers, including two-factor authentication (2FA) Chrome-based browser extensions (“Collects passwords, cookies, cc, autocomplete, browsing history, file download history.” - MarsTeam post on XSS forum).
  • Profiling or fingerprinting the infected system.
  • Exfiltrating files from the infected system.

How did we find it?

• MDR for Endpoint identified the tactics, techniques, and procedures (TTPs) associated with NetSupportManager RAT and AutoIT malware deployment.

What did we do?

• Our team of 24/7 SOC Cyber Analysts alerted the customer of the activity.

What can you learn from this TRU positive?

• Drive-by attacks involving malware masquerading as legitimate software are becoming increasingly common since they require no exploits and rely on a victim running code on the attacker’s behalf.
• Mars Stealer has seen continued development since its release, and targets a wide array of credentials, particularly those used for cryptocurrency exchanges.
• Identifying information stealing malware as early as possible is critical to minimize losses from fraud and hijacked accounts.

Recommendations from our Threat Response Unit (TRU) Team:

While rapid identification and containment of successful exploits is necessary to limit impact, unsuccessful attempts still present an opportunity to shore up defenses. The best approach to preventing drive-by attacks is by using a layered defense, such as:

• Ensure antivirus signatures are up-to-date.
• Use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and contain threats.
• Audit your environment and endpoints regularly to ensure endpoints are patched with the latest vendor security updates.
• Increase awareness of social engineering threat tactics with your users through phishing and security awareness training.
  • Ensure users are aware of risks associated with downloading applications from the web.
  • Always ensure software is downloaded from a legitimate source.

Ask Yourself

• Do you have the capability to rapidly identify and contain malicious code executed unwittingly by users in your environment?
• Are you monitoring your endpoints 24/7 and what degree of control do you have to initiate a kill switch when required?
• What level of managed endpoint support do you have in place?

Indicators of Compromise

Value	Note
googleglstatupdt[.]com	Hosting fake Chrome setup ISO
zrianevakn1[.]com	NetSupportManager RAT C2
115d1ae8b95551108b3a902e48b3f163	‘ChromeSetup.iso’
b15e0db8f65d7df27c07afe2981ff5a755666dce	ChromeSetup.exe
37c24b4b6ada4250bc7c60951c5977c0	NetSupportManager RAT
5[.]45.84.214	Mars Stealer C2
71672a495b4603ecfec40a65254cb3ba8766bbe0	Esitanza.exe.pif (renamed AutoIt)
e3c91b6246b2b9b82cebf3700c0a7093bacaa09b	ANpRAHx.exe (disguised as 3uAirPlayer, drops Mars Stealer and obfuscated AutoIt scripts)
5c4e3e5fda232c31b3d2a2842c5ea23523b1de1a	Installer_ovl.exe
2a2b00d0555647a6d5128b7ec87daf03a0ad568f	consoleappmrss.exe
3c80b89e7d4fb08aa455ddf902a3ea236d3b582a	Fervore.wmd (obfuscated AutoIt script)
26136c59afe28fc6bf1b3aeba8946ac2c3ce61df	Vai.wmd (obfuscated AutoIt script)
e6f18804c94f2bca5a0f6154b1c56186d4642e6b	Una.wmd (obfuscated AutoIt script)

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.