eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
In August 2024, the eSentire Threat Response Unit (TRU) observed a case of LummaC2 stealer malware and the malicious Google Chrome browser infections involving a drive-by download that delivered a malicious ZIP archive named “x64~x32~installer___.zip” containing an MSI app packaging file.
The MSI file contacts the C2 server at get-license2[.]com to retrieve the password needed to extract the malicious DLL “rnp.dll” (MD5: 1825d0310bf5029899f42004c4a1ef83) from the RAR archive “nijboq.rar” (MD5: 63efe86838e7196cedd93d7c10ac40e6). It uses the legitimate executable "rnpkeys.exe", associated with the RNP library – a set of cryptographic tools that implement the OpenPGP (Pretty Good Privacy) standards and commonly used by Thunderbird.
This executable is located under “\AppData\Roaming\Troxbox Publish\TroxApp” and is leveraged to load the malicious “rnp.dll” payload through a DLL side-loading technique (T1574.002). Researchers at Trellix provided analysis of a similar sample.
The malicious DLL led to the loader execution which eventually retrieved LummaC2 stealer and the PowerShell base64-encoded command that is responsible for retrieving the next-stage payload “02074.bs64” (MD5: 3b97f0f4f5a616d19d919c359ebd3086) from the C2 server at two-root[.]com/02074.bs64 and decrypting it using two rounds of XOR operations (Figure 1).
Figure 1: The overview of the PowerShell command and the decrypted next-stage payload
Upon the execution of the PowerShell script, the malicious Chrome extension named “Save to Google Drive” will be installed.
Figure 2: Malicious Chrome extension
The malicious extension handles requests to set and get all balances of Facebook, Coinbase and Google Pay accounts and possibly execute financial transactions such as withdrawals of cryptocurrency funds. This involves sending JSON structured data that could include amounts, account identifiers, and other transaction-specific details provided below:
exchange/create-account
exchange/set-all-balances
exchange/set-balance
exchange/get-address
exchange/set-withdraw
The extension also gathers device information including fetching hardware and system data (Figure 3), details about the current extension and any installed extensions as well as collects the browser's user agent and all cookies and generates the unique UUID for the machine. All the collected data is then sent to the C2 server.
Figure 3: Retrieving machine information
The extension also contains the code that manipulates browser behavior within “getInjections” function by opening specific URLs fetched from the C2 in nearly invisible popup windows and monitoring these for predefined content that contains payments.google, consent.youtube.com, accounts.google.com, and adsmanager.facebook.com.
By monitoring this content, the script can potentially intercept or manipulate sensitive user interactions, such as capturing user input or manipulating the content displayed.
The malicious extension also targets users of popular email platforms like Outlook, Gmail, and Yahoo Mail, where it dynamically injects and manipulates web content based on configurations fetched from chrome.storage.local. The extension can alter email contents (Figure 4), potentially to steal sensitive information such as verification codes sent during two-factor authentication processes.
Figure 4: Function responsible for the modification of the email body content
The script “proxy.js” located in the extension folder appears to be the CursedChrome implant, a Chrome extension that converts compromised Chrome browsers into HTTP proxies, which enables web browsing authenticated as the victims across all their websites.
The “makeScreenShot” function captures a screenshot of the currently visible tab in a Chrome browser. It returns the screenshot data as a base64-encoded image. The screenshot is then sent to the C2 server (Figure 5).
Figure 5: Reference to “makeScreenShot” function and the communication with C2
The C2 addresses are extracted and then Base58-decoded from a Blockchain and mempool URLs, which is structured to return data in JSON format about the Bitcoin address “bc1qvkvzfla6wrem2uf4ejkuja8yp3c6f3xf72kyc9”
In conclusion, the incident showcased an interesting delivery chain that leveraged DLL side-loading to execute the loader that delivered LummaC2 stealer and a malicious Chrome extension to manipulate browser activities and facilitate data theft.
We alerted the customer of the incident and supported them through the remediation process.
What can you learn from this TRU Positive?
The case showcases the importance of endpoint security solutions, such as Endpoint Detection and Response (EDR), and the implementation of security training programs to educate users about such sophisticated threats.
The malware's capability to dynamically manipulate web content, especially within email platforms like Outlook, Gmail, and Yahoo Mail, underscores the need to secure web browsers and email clients. This involves vigilant monitoring for malicious browser extensions and implementing strict controls to prevent unauthorized script executions.
By leveraging legitimate software and processes like rnpkeys.exe from the RNP library, attackers can bypass traditional security measures. This tactic emphasizes the importance of monitoring and securing trusted applications.
Recommendations from the Threat Response Unit (TRU):
We recommend modifying the default 'open-with' settings for script files to ensure they open with a basic text editor like Notepad instead of executing.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
