Persistent Connection Established: Nitrogen Campaign Leverages DLL Side-Loading Technique for C2 Communication

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In June 2023, we identified and effectively responded to security incidents involving multiple hosts associated with Python-based post-exploitation. We named the campaign Nitrogen after the PDB path and the strings found in the malicious msi.dll employed during the initial infection.

The threat actor(s) established initial access via a drive-by download, wherein the victim downloaded an ISO image from a compromised WordPress website.

Below is a description of the observed initial infection chain.

The process begins with the manual execution of the install file by the end user from within an ISO image. Subsequently, the installer proceeds to load the msi.dll file and decrypts the accompanying data file. A more comprehensive analysis of this campaign will follow this blog.

The malicious installer drops an embedded Python distribution as well as the malicious DLL that is used for sideloading (T1574.002) under the “C:\Users\Public\Music\python” path.

The scheduled task,“OneDrive Security Task-S-1-5-21-5678566754-9123742832-2638705499-2003”, is created as a persistence mechanism to run the pythonw.exe binary. The task is set to trigger at system startup and expires on 12/1/2029 at midnight.

The threat actor(s) have been observed employing the DLL sideloading technique to execute a malicious payload and establish a persistent connection with C2 servers. The screenshot below reveals the utilization of python310.dll as the DLL for sideloading.

We found the code responsible for establishing a connection to a remote host, retrieving compressed and encoded data, and executing it locally.

We were able to extract the C2 from the malicious DLLs:

• 166.0.94[.]216:8880
• 45.61.128[.]133:1042

The threat actor(s) were able to run Bloodhound-py and LaZagne on patient zero via one of the malicious Python files (work2.py). During the investigation, our in-house Incident Response team retrieved a copy of the work2.py script for further analysis.

The Python script contained the Pyramid module; Pyramid is a Python-based HTTP/HTTPS C2 server equipped with the ability to distribute encrypted payloads. Additionally, Pyramid incorporates numerous modules to facilitate the loading of offensive tools such as LaZagne, Bloodhound-py, secretsdumps, and more.

The snippet of the Pyramid module below makes an encrypted HTTP request to a server, providing authorization credentials and executing the received response payload as code.

Another file that the attacker(s) utilized to drop a Cobalt Strike DLL was work7.py, which contained Python code with a marshal module to execute a payload that has been marshaled or serialized.

Upon disassembling the bytecode, we were able to retrieve the Cobalt Strike DLL that the attacker(s) ran on one of the hosts. You can find the Cobalt Strike beacon configuration at the end of this article.

It is important to note that within a span of 2 hours, the threat actor(s) engaged in lateral movement, deploying several malicious Python files onto compromised hosts.

Our Threat Response Unit (TRU) conducted further research and identified other samples involved in the Nitrogen campaign, including the malicious DLLs used for sideloading. We were also able to extract additional C2s for the campaign that you can find in the Indicators of Compromise section.

How did we find it?

• eSentire MDR for Endpoint identified Python-based post-exploitation activities.

What did we do?

• Our Incident Handling Team responded to the threat and took containment actions, such as quarantining the infected hosts.
• Further infection was prevented by eSentire MDR for Endpoint.

What can you learn from this TRU positive?

• The threat actor(s) used DLL sideloading to execute the malicious payload. DLL side-loading attacks can help bypass security mechanisms and evade detection.
• By abusing legitimate processes or loading DLLs from trusted locations, attackers can blend their malicious activities with legitimate operations, making it harder for security solutions to identify the malicious behavior.
• Pyramid, a covert and stealthy tool, played a crucial role in facilitating post-exploitation activities conducted by the threat actor(s).
• The Cobalt Strike payload was loaded and executed stealthily in memory within one of the Python processes, demonstrating an effective technique to evade EDR detections.

Recommendations from our Threat Response Unit (TRU) Team:

• Encouraging good cybersecurity hygiene among your users by using Phishing and Security Awareness Training (PSAT) when downloading software from the Internet.
• Protect endpoints against malware by:
  • Ensuring antivirus signatures are up-to-date.
  • Using a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) tool to detect and contain threats.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Indicators of Compromise

Yara rule

{
  "BeaconType": [
    "HTTPS"
  ],
  "Port": 8443,
  "SleepTime": 10000,
  "MaxGetSize": 2801745,
  "Jitter": 37,
  "C2Server": "85.217.144[.]234,/jquery-3.3.1.min.js",
  "HttpPostUri": "/jquery-3.3.2.min.js",
  "Malleable_C2_Instructions": [
    "Remove 1522 bytes from the end",
    "Remove 84 bytes from the beginning",
    "Remove 3931 bytes from the beginning",
    "Base64 URL-safe decode",
    "XOR mask w/ random key"
  ],
  "HttpGet_Verb": "GET",
  "HttpPost_Verb": "POST",
  "HttpPostChunk": 0,
  "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe",
  "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe",
  "CryptoScheme": 0,
  "Proxy_Behavior": "Use IE settings",
  "Watermark": 587247372,
  "bStageCleanup": "True",
  "bCFGCaution": "False",
  "KillDate": 0,
  "bProcInject_StartRWX": "False",
  "bProcInject_UseRWX": "False",
  "bProcInject_MinAllocSize": 17500,
  "ProcInject_PrependAppend_x86": [
    "kJA=",
    "Empty"
  ],
  "ProcInject_PrependAppend_x64": [
    "kJA=",
    "Empty"
  ],
  "ProcInject_Execute": [
    "ntdll:RtlUserThreadStart",
    "CreateThread",
    "NtQueueApcThread-s",
    "CreateRemoteThread",
    "RtlCreateUserThread"
  ],
  "ProcInject_AllocationMethod": "NtMapViewOfSection",
  "bUsesCookies": "True",
  "HostHeader": ""
}