Nodersok

KovCoreG’s attacks are socially engineered malvertisments that lure unwitting users into downloading a software package needed to update their supposedly out-of-date Adobe Flash application.

Analysis of Microsoft Defender ATP telemetry points to compromised advertisements as the most likely infection vector for delivering the HTA files.

When decrypted, the MP4 file is an additional JavaScript snippet that starts PowerShell... it launches PowerShell with an encoded command... Nodersok’s infection continues by launching several instances of PowerShell to download and run additional malicious modules.

KovCoreG’s attacks are socially engineered malvertisments that lure unwitting users into downloading a software package needed to update their supposedly out-of-date Adobe Flash application. However, it instead drops a malicious HTML application (HTA) file named Player{timestamp}.hta . When the victim executes the HTA file...

Other campaigns... were observed installing malicious encoded PowerShell commands in the registry... The malware can also process configuration data in JSON format... this configuration was encoded and stored in the registry in an infected machine

Run binary shellcode that attempts elevation of privilege by using auto-elevated COM interface

It runs a shellcode to bypass User Account Control (UAC) via the CMSTPLUA COM interface (related to connection management).

All of the relevant functionalities reside in scripts and shellcodes that are almost always coming in encrypted, are then decrypted... it hides the malicious PowerShell script in an environment variable named “deadbeef”... All the modules are hosted on the C&C servers in RC4-encrypted form

we uncovered this campaign in mid-July, when suspicious patterns in the anomalous usage of MSHTA.exe emerged... Like the Astaroth campaign, every step of the infection chain only runs legitimate LOLBins, either from the machine itself ( mshta.exe , powershell.exe )

Immediately after its execution, it performs the following anti-debugging and anti-analysis checks: Searching for blacklisted processes and modules... Checking if the number of cores is too small Checking if the process is being debugged Checking if the Sleep function is being manipulated

The PowerShell script is also embedded with Novter, which will be executed filelessly via the PowerShell reflective injection technique.

Other campaigns... were observed installing malicious encoded PowerShell commands in the registry... The malware can also process configuration data in JSON format... this configuration was encoded and stored in the registry in an infected machine

Immediately after its execution, it performs the following anti-debugging and anti-analysis checks: Searching for blacklisted processes and modules... Checking if the number of cores is too small Checking if the process is being debugged Checking if the Sleep function is being manipulated

It has two purposes: Connect back to the remote C&C, and Receive HTTP requests to proxy back to it It supports the SOCKS4A protocol.

one final objective: turn infected machines into zombie proxies... This last JavaScript is the actual final payload written for the Node.js framework that turns the device into a proxy.

Download legitimate node.exe tool from the official nodejs.org website Drop the WinDivert packet capture library components WinDivert.dll , WinDivert32.sys , and WinDivert64.sys

Execute a shellcode that uses WinDivert to filter and modify certain outgoing packets... Nodersok is intercepting packets sent out to initiate a TCP connection... Nodersok modifies them by moving the “SACK Permitted” option to the end of the packet

Download module.avi, a module that attempts to: Disable Windows Defender Antivirus Disable Windows updates