MAR-10413062-1.v1 Telerik Vulnerability in U.S. Government IIS Server

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR–Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

CISA received 18 files for analysis from a forensic analysis engagement conducted at a Federal Civilian Executive Branch (FCEB) agency.

When 11 of the dynamic link library (DLL) files are loaded, the files can read, create, and delete files. If the DLL contains a hardcoded Internet Protocol (IP) address, status messages will be sent to the IP. One DLL file will attempt to collect the target system’s Transmission Control Protocol (TCP) connection table, and exfiltrate it to a remote Command and Control server (C2). Five of the files drop and decode a reverse shell utility that can send and receive data and commands. In addition, the files drop and decode an Active Server Pages (ASPX) webshell. Two DLL files are capable of loading and executing payloads.

CISA has provided Indicators of Compromise (IOCs) and YARA rules for detection within this Malware Analysis Report (MAR).

For more information about this compromise, see Joint Cybersecurity Advisory Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server.

Download the PDF version of this report:

For a downloadable copy of IOCs, see

Submitted Files (18)

11415ac829c17bd8a9c4cef12c3fbc23095cbb3113c89405e489ead5138384cd (1597974061[.]4531896[.]png)

144492284bcbc0110d34a2b9a44bef90ed0d6cda746df6058b49d3789b0f851d (1666006114[.]5570521[.]txt)

508dd87110cb5bf5d156a13c2430c215035db216f20f546e4acec476e8d55370 (xesmartshell[.]tmp)

707d22cacdbd94a3e6dc884242c0565bdf10a0be42990cd7a5497b124474889b (1665130178[.]9134793[.]dll)

72f7d4d3b9d2e406fa781176bd93e8deee0fb1598b67587e1928455b66b73911 (1594142927[.]995679[.]png)

74544d31cbbf003bc33e7099811f62a37110556b6c1a644393fddd0bac753730 (1665131078[.]6907752[.]dll)

78a926f899320ee6f05ab96f17622fb68e674296689e8649c95f95dade91e933 (1596686310[.]434117[.]png)

833e9cf75079ce796ef60fc7039a0b098be4ce8d259ffa53fe2855df110b2e5d (1665128935[.]8063045[.]dll)

853e8388c9a72a7a54129151884da46075d45a5bcd19c37a7857e268137935aa (1667466391[.]0658665[.]dll)

8a5fc2b8ecb7ac6c0db76049d7e09470dbc24f1a90026a431285244818866505 (1596923477[.]4946315[.]png)

a14e2209136dad4f824c6f5986ec5d73d9cc7c86006fd2ceabe34de801062f6b (1665909724[.]4648924[.]dll)

b4222cffcdb9fb0eda5aa1703a067021bedd8cf7180cdfc5454d0f07d7eaf18f (1665129315[.]9536858[.]dll)

d69ac887ecc2b714b7f5e59e95a4e8ed2466bed753c4ac328931212c46050b35 (1667465147[.]4282858[.]dll)

d9273a16f979adee1afb6e55697d3b7ab42fd75051786f8c67a6baf46c4c19c2 (SortVistaCompat)

dedf082f523dfcb75dee0480a2d8a087e3231f89fa34fcd2b7f74866a7b6608f (1665214140[.]9324195[.]dll)

e044bce06ea49d1eed5e1ec59327316481b8339c3b6e1aecfbb516f56d66e913 (1667465048[.]8995082[.]dll)

e45ad91f12188a7c3d4891b70e1ee87a3f23eb981804ea72cd23f1d5e331ff5a (1596835329[.]5015914[.]png)

f5cafe99bccb9d813909876fa536cc980c45687d0f411c5f4b5346dcf6b304e4 (1665132690[.]6040645[.]dll)

Additional Files (6)

08375e2d187ee53ed263ee6529645e03ead1a8e77afd723a3e0495201452d415 (small[.]aspx)

11d8b9be14097614dedd68839c85e3e8feec08cdab675a5e89c5b055a6a68bad (XEReverseShell[.]exe)

1fed0766f564dc05a119bc7fa0b6670f0da23504e23ece94a5ae27787b674cd2 (xesvrs[.]exe)

5cbba90ba539d4eb6097169b0e9acf40b8c4740a01ddb70c67a8fb1fc3524570 (small[.]txt)

815d262d38a26d5695606d03d5a1a49b9c00915ead1d8a2c04eb47846100e93f (XEReverseShell[.]exe)

a0ab222673d35d750a0290db1b0ce890b9d40c2ab67bfebb62e1a006e9f2479c (Multi-OS_ReverseShell[.]exe)

Domains (3)

hivnd[.]com

xegroups[.]com

xework[.]com

IPs (4)

137[.]184[.]130[.]162

144[.]96[.]103[.]245

184[.]168[.]104[.]171

45[.]77[.]212[.]12

Findings

144492284bcbc0110d34a2b9a44bef90ed0d6cda746df6058b49d3789b0f851d

Tags

wiper

Details

Antivirus

No matches found.

YARA Rules

• rule CISA_10413062_04 : wiper compromises_data_availability
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-21”
         Last_Modified = “20221123_2000”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “compromises-data-availability”
         Malware_Type = “wiper”
         Tool_Type = “n/a”
         Description = “Detect portable executable file that deletes .dll files”
         MD5 = “8e33e1e407fc9ff537b63be3ab78cb40”
         SHA256 = “144492284bcbc0110d34a2b9a44bef90ed0d6cda746df6058b49d3789b0f851d”
     strings:
         $s1 = { (43 | 63) 3a 5c (57 | 77) (49 | 69) (4e | 6e) (44 | 64) (4f | 6f) (57 | 77) (53 | 73) 5c (54 | 74) (65 | 45) (4d | 6d) (50 | 70) }
         $s2 = { 43 72 65 61 74 65 54 68 72 65 61 64 }
         $s3 = { 54 65 6c 65 72 69 69 6b 2e 64 6c 6c }
     condition:
         uint16(0) == 0x5a4d and all of ($s*)
  }
• rule CISA_10413062_07 : wiper compromises_data_availability
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-30”
         Last_Modified = “20221130_1700”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “compromises-data-availability”
         Malware_Type = “wiper”
         Tool_Type = “n/a”
         Description = “Detects managed malware code in C# DLL samples”
         MD5 = “8e33e1e407fc9ff537b63be3ab78cb40”
         SHA256 = “144492284bcbc0110d34a2b9a44bef90ed0d6cda746df6058b49d3789b0f851d”
     strings:
         $s0 = { 4D 61 69 6E 00 61 72 67 73 00 2E 63 74 6F 72 00 57 72 69 74 65 4C 69 6E 65 }
         $s1 = { 46 69 6E 64 46 69 72 73 74 46 69 6C 65 41 00 00 90 01 46 69 6E 64 }
         $s2 = { 43 3A 5C 77 69 6E 64 6F 77 73 5C 74 65 6D 70 }
         $s3 = { 54 65 6C 65 72 69 69 6B 2E 64 6C 6C }
         $s4 = { 76 34 2E 30 2E 33 30 33 31 39 }
     condition:
         all of them
  }

ssdeep Matches

No matches found.

Description

This file is a malicious .NET DLL, which contains malicious unmanaged 64-bit Intel code. This DLL deletes files that end in “.dll” from C:windowstemp.

e044bce06ea49d1eed5e1ec59327316481b8339c3b6e1aecfbb516f56d66e913

Tags

information-stealer

Details

Antivirus

No matches found.

YARA Rules

• rule CISA_10413062_01 : exfiltrates_data
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-21”
         Last_Modified = “20221123_2000”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “exfiltrates-data”
         Malware_Type = “n/a”
         Tool_Type = “n/a”
         Description = “Detect portable executable samples that exfiltrate .config data”
         MD5_1 = “f6f47911ac32afd786a765dcb1f26722”
         SHA256_1 = “e044bce06ea49d1eed5e1ec59327316481b8339c3b6e1aecfbb516f56d66e913”
         MD5_2 = “cd6c11f89b392988e0de3ffe048a561b”
         SHA256_2 = “d69ac887ecc2b714b7f5e59e95a4e8ed2466bed753c4ac328931212c46050b35”
     strings:
         $s1 = { (43 | 63) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $s2 = { (44 | 64) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $s3 = { (45 | 65) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $t4 = { 2e 43 4f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t5 = { 2e 43 6f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t6 = { 2e 63 4f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t7 = { 2e 63 6f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }                
         $s8 = { 70 68 79 73 69 63 61 6c 50 61 74 68 3d }
         $s9 = { 2f 3e }
         $s10 = { 34 35 2e 37 }
         $s11 = { 37 2e 32 31 }
         $s12 = { 32 2e 31 32 }
         $s13 = { 43 72 65 61 74 65 54 68 72 65 61 64 }
     condition:
         uint16(0) == 0x5a4d and 1 of ($t*) and all of ($s*)
  }
• rule CISA_10413062_06 : exfiltrates_data
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-30”
         Last_Modified = “20221130_1700”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “exfiltrates-data”
         Malware_Type = “n/a”
         Tool_Type = “n/a”
         Description = “Detects managed malware code in C# DLL samples”
         MD5 = “f6f47911ac32afd786a765dcb1f26722”
         SHA256 = “e044bce06ea49d1eed5e1ec59327316481b8339c3b6e1aecfbb516f56d66e913”
     strings:
         $s0 = { 4E 65 74 6B 65 6C 2E 64 6C 6C }
         $s1 = { 76 34 2E 30 2E 33 30 33 31 39 }
         $s2 = { 70 68 79 73 69 63 61 6C 50 61 74 68 3D }
         $s3 = { 2E 63 6F 6E 66 69 67 00 2B 5F 2B 5F 2B }
         $s4 = { 43 3A 5C 69 6E 65 74 70 75 62 5C 74 65 6D 70 }
     condition:
         all of them
  }

ssdeep Matches

No matches found.

Relationships

Description

This file is a malicious .NET DLL, which contains malicious unmanaged 64-bit Intel code. Loading this DLL will send “+_+_+” to 45[.]77[.]212[.]12 over port 443. Then, C:inetpubtemp, D:inetpubtemp, and E:inetpubtemp are scanned recursively for files that end in .config.

When a .config file is found, the DLL will look for the strings “physicalPath=” and “/>” within the file. If there is data between those two strings, it will be sent to the IP.

If there was an error calling CreateFileA, “Errorcode: {Error_Code}” will be sent to the IP. If there was an error calling VirtualAlloc, “VirtualAlloc failed” will be sent to the IP. If there was an error while calling ReadFile, “read file failed” will be sent to the IP.

45[.]77[.]212[.]12

Tags

command-and-control

Ports

• 443 TCP

Whois

NetRange:     45[.]76[.]0[.]0 – 45[.]77[.]255[.]255
CIDR:         45[.]76[.]0[.]0/15
NetName:        CONSTANT
NetHandle:     NET-45-76-0-0-1
Parent:         NET45 (NET-45-0-0-0-0)
NetType:        Direct Allocation
OriginAS:     AS20473
Organization: The Constant Company, LLC (CHOOP-1)
RegDate:        2015-04-24
Updated:        2022-09-20
Comment:        Geofeed hxxps://geofeed[.]constant[.]com/
Ref:            hxxps://rdap[.]arin[.]net/registry/ip/45[.]76[.]0[.]0

OrgName:        The Constant Company, LLC
OrgId:         CHOOP-1
Address:        319 Clematis St. Suite 900
City:         West Palm Beach
StateProv:     FL
PostalCode:     33401
Country:        US
RegDate:        2006-10-03
Updated:        2021-03-30
Comment:        hxxp://www[.]constant[.]com/
Ref:            hxxps://rdap[.]arin[.]net/registry/entity/choop-1

OrgNOCHandle: NETWO1159-ARIN
OrgNOCName: Network Operations
OrgNOCPhone: +1-973-849-0500
OrgNOCEmail: network[@]constant[.]com
OrgNOCRef:    hxxps://rdap[.]arin[.]net/registry/entity/netwo1159-arin

OrgAbuseHandle: ABUSE1143-ARIN
OrgAbuseName: Abuse Department
OrgAbusePhone: +1-973-849-0500
OrgAbuseEmail: abuse[@]constant[.]com
OrgAbuseRef:    hxxps://rdap[.]arin[.]net/registry/entity/abuse1143-arin

OrgTechHandle: NETWO1159-ARIN
OrgTechName: Network Operations
OrgTechPhone: +1-973-849-0500
OrgTechEmail: network[@]constant[.]com
OrgTechRef:    hxxps://rdap[.]arin[.]net/registry/entity/netwo1159-arin

NetRange:     45[.]77[.]212[.]0 – 45[.]77[.]213[.]255
CIDR:         45[.]77[.]212[.]0/23
NetName:        NET-45-77-212-0-23
NetHandle:     NET-45-77-212-0-1
Parent:         CONSTANT (NET-45-76-0-0-1)
NetType:        Reassigned
OriginAS:    
Organization: Vultr Holdings, LLC (VHL-59)
RegDate:        2017-11-21
Updated:        2017-11-21
Ref:            hxxps://rdap[.]arin[.]net/registry/ip/45[.]77[.]212[.]0

OrgName:        Vultr Holdings, LLC
OrgId:         VHL-59
Address:        2001 6th Avenue, Suite 300
Address:        2001 Sixth LLC
City:         Seattle
StateProv:     WA
PostalCode:     98121
Country:        US
RegDate:        2015-03-05
Updated:        2015-03-05
Ref:            hxxps://rdap[.]arin[.]net/registry/entity/vhl-59

OrgAbuseHandle: VULTR-ARIN
OrgAbuseName: Vultr Abuse
OrgAbusePhone: +1-973-849-0500
OrgAbuseEmail: abuse[@]vultr[.]com
OrgAbuseRef:    hxxps://rdap[.]arin[.]net/registry/entity/vultr-arin

OrgTechHandle: VULTR-ARIN
OrgTechName: Vultr Abuse
OrgTechPhone: +1-973-849-0500
OrgTechEmail: abuse[@]vultr[.]com
OrgTechRef:    hxxps://rdap[.]arin[.]net/registry/entity/vultr-arin

Relationships

Description

This IP was utilized by multiple malicious applications in this report as a C2 server. It is utilized by the malware to send status information from commands executed on system, as well as a location to exfiltrate sensitive system and network information.

d69ac887ecc2b714b7f5e59e95a4e8ed2466bed753c4ac328931212c46050b35

Tags

information-stealer

Details

Antivirus

No matches found.

YARA Rules

• rule CISA_10413062_01 : exfiltrates_data
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-21”
         Last_Modified = “20221123_2000”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “exfiltrates-data”
         Malware_Type = “n/a”
         Tool_Type = “n/a”
         Description = “Detect portable executable samples that exfiltrate .config data”
         MD5_1 = “f6f47911ac32afd786a765dcb1f26722”
         SHA256_1 = “e044bce06ea49d1eed5e1ec59327316481b8339c3b6e1aecfbb516f56d66e913”
         MD5_2 = “cd6c11f89b392988e0de3ffe048a561b”
         SHA256_2 = “d69ac887ecc2b714b7f5e59e95a4e8ed2466bed753c4ac328931212c46050b35”
     strings:
         $s1 = { (43 | 63) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $s2 = { (44 | 64) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $s3 = { (45 | 65) 3a 5c (49 | 69) (4e | 6e) (45 | 65) (54 | 74) (50 | 70) (55 | 75) (62 | 42) 5c (54 | 74) (45 | 65) (4d | 6d) (50 | 70) }
         $t4 = { 2e 43 4f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t5 = { 2e 43 6f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t6 = { 2e 63 4f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }
         $t7 = { 2e 63 6f (4e | 6e) (46 | 66) (69 | 49) (47 | 67) }                
         $s8 = { 70 68 79 73 69 63 61 6c 50 61 74 68 3d }
         $s9 = { 2f 3e }
         $s10 = { 34 35 2e 37 }
         $s11 = { 37 2e 32 31 }
         $s12 = { 32 2e 31 32 }
         $s13 = { 43 72 65 61 74 65 54 68 72 65 61 64 }
     condition:
         uint16(0) == 0x5a4d and 1 of ($t*) and all of ($s*)
  }

ssdeep Matches

No matches found.

Relationships

Description

This file is a malicious .NET DLL, which contains malicious unmanaged 64-bit Intel code. The file has the same functionality as “1667465048[.]8995082[.]dll” (e044bce06e…).

853e8388c9a72a7a54129151884da46075d45a5bcd19c37a7857e268137935aa

Tags

information-stealer

Details

Antivirus

No matches found.

YARA Rules

• rule CISA_10413062_02 : information_stealer information_gathering
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-21”
         Last_Modified = “20221123_2000”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “n/a”
         Malware_Type = “n/a”
         Tool_Type = “information-gathering”
         Description = “Detect portable executable file that creates and deletes a file”
         MD5 = “cece36ea4e328f093517ff68d0ed085c”
         SHA256 = “853e8388c9a72a7a54129151884da46075d45a5bcd19c37a7857e268137935aa”
     strings:
         $s1 = { 34 35 2e 37 }
         $s2 = { 37 2e 32 31 }
         $s3 = { 32 2e 31 32 }
         $s4 = { (45 | 65) 3a 5c (57 | 77) (45 | 65) (42 | 62) (53 | 73) (49 | 69) (54 | 74) (45 | 65) (53 | 73) 5c (4d | 6d) (45 | 65) (49 | 69) (53 | 73) 5c }
         $s5 = { 43 72 65 61 74 65 46 69 6c 65 }
         $s6 = { 57 72 69 74 65 46 69 6c 65 }
         $s7 = { 44 65 6c 65 74 65 46 69 6c 65 }
         $s8 = { 43 72 65 61 74 65 54 68 72 65 61 64 }
     condition:
         uint16(0) == 0x5a4d and all of ($s*)
  }
• rule CISA_10413062_08 : information_stealer information_gathering
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10413062”
         Date = “2022-11-30”
         Last_Modified = “20221130_1700”
         Actor = “n/a”
         Family = “n/a”
         Capabilities = “n/a”
         Malware_Type = “n/a”
         Tool_Type = “information-gathering”
         Description = “Detects managed malware code in C# DLL samples”
         MD5 = “cece36ea4e328f093517ff68d0ed085c”
         SHA256 = “853e8388c9a72a7a54129151884da46075d45a5bcd19c37a7857e268137935aa”
     strings:
         $s0 = { 43 72 65 61 74 65 46 69 6C 65 20 45 72 72 6F 72 }
         $s1 = { 57 72 69 74 65 46 69 6C 65 20 45 72 72 6F 72 }
         $s2 = { 44 65 6C 65 74 65 46 69 6C 65 41 20 66 61 69 6C }
         $s3 = { 45 3A 5C 77 65 62 73 69 74 65 73 5C 4D 45 49 53 }
         $s4 = { 76 34 2E 30 2E 33 30 33 31 39 }
     condition:
         all of them
  }

ssdeep Matches

No matches found.

Relationships

Description

This file is a malicious .NET DLL, which contains malicious unmanaged 64-bit Intel code. Loading this DLL will send “+_+_+” to 45[.]77[.]212[.]12 over port 443. The DLL will then create E:websites\ico[.]txt and write “111” to that file. If there was an error creating the file, “CreateFile Error code: {Error_Code}” will be sent to the IP and execution ends. If there was an error writing to the file, “WriteFile Error code: {Error_Code}” will be sent to the IP and execution ends. If there are no errors, “CreateFileA OK” will be sent. The DLL will then delete E:websites\ico[.]txt. If successful, “DeleteFileA OK” will be sent to the IP. If there was an error “DeleteFileA failed” will be sent to the IP.

Analysis indicates the purpose of this application is to provide a remote operator the ability to determine whether or not they can write files to the system’s web server directory. This capability will likely allow the operator to determine whether or not they can remotely install a webshell to allow convenient and persistent remote access to the compromised system.

Screenshots

Figure 1 – This code illustrates the malware attempting to create a file on the targeted system within the E:\websites directory. This appears to be a test to ensure the remote operator can remotely install web application code onto the target.

a14e2209136dad4f824c6f5986ec5d73d9cc7c86006fd2ceabe34de801062f6b

Tags

trojan

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This file is a malicious .NET DLL, which contains malicious unmanaged 64-bit Intel code. Static analysis indicates that the primary purpose of this code is to obtain a copy of the targeted system’s TCP connection table via the GetTcpTable API, and export it to the malware’s remote C2 server 45[.]77[.]212[.]12.

The purpose of this application is to allow a remote operator to determine what systems the targeted system currently has an established TCP session with. This capability will allow the operator to more efficiently profile the targeted network.

Screenshots

Figure 2 – The malicious binary loading its C2 IP 45[.]77[.]212[.]12 onto the stack.