Affected Platforms: Microsoft Windows
Impacted Users: Microsoft Windows
Impact: Remote attackers gain control of the infected systems
Severity Level: Critical

FortiGuard Labs recently identified the use of a Russian-language Word document equipped with a malicious macro in the ongoing Konni campaign. Despite the document's creation date of September, ongoing activity on the campaign's C2 server is evident in internal telemetry, as shown in Figure 1.

This campaign relies on a remote access trojan (RAT) capable of extracting information and executing commands on compromised devices. Operating for several years, this campaign employs diverse strategies for initial access, payload delivery, and establishing persistence within victims' networks. In this blog, we will elaborate on the behavior of the malware at each stage.

Dropper - Word Document

Upon opening the document, a yellow prompt bar appears, displaying “Enable Content” alongside some ambiguous Russian text (Figure 2). Upon selecting the button, a VBA script is initiated that displays an article in Russian that translates to “Western Assessments of the Progress of the Special Military Operation.”

Preparation—check.bat

The initial script file, named “check.bat” (Figure 4), performs several checks. Initially, it verifies the presence of a remote connection session. If detected, it directly initiates the “netpp.bat” script. The script then assesses whether the current system is running Windows 10, assigning a value of 1 to the variable “%Num%” regardless of the outcome. This variable later plays a role in selecting the UAC bypass method. This UAC setting is different from KONNI campaigns of the past that set either 4 or 1 for different operation systems.

Additionally, it examines whether the system operates on a 64-bit architecture. If so, it renames the corresponding DLL files to “netpp.dll” and “wpns.dll” and removes extraneous DLL files. Finally, it executes “wpns.dll” with three parameters: “QQQQQQQ” as the targeted entry point name, “%Num%” denoting the chosen UAC bypass method, and “netpp.bat” for further action.

UAC Bypass Module—wpns.dll

Each DLL file in the Word document has been compressed using UPX. We will delve into the specifics using the 64-bit version files since their 32-bit counterparts have similar functionalities. Firstly, “wpns.dll” is invoked in the batch file “check.bat.” It is primarily designed for UAC bypass. In the batch file, the parameter is configured as 1, prompting the selection of the sub_180001B90 function, as illustrated in Figure 5.

Figure 5: Assembly code in the entry point of “QQQQQQQ”

Figure 6: UAC bypass module

Figure 7 shows the content of the batch file "netpp.bat." Here is a concise explanation of its functions:

• Service Stop and Check: The script attempts to stop the "netpp" service to prevent redundant execution. It then verifies the presence of the string “system32” in the system.
• Copy Files: If the string “system32” is absent, the script progresses to the “COPYFILE” function. This segment copies multiple files (e.g., netpp.dll, netpp.dat, netpp.ini) to the “System32” directory within the Windows operating system. Once the copying process is completed, specific files are deleted.
• Service Creation: The script then transitions to the “INSTALL” section, where it generates and configures a service named “netpp” using commands like “sc create,” “sc description,” and “sc config.” It configures the service to initiate automatically using a less conspicuous name, “Internet Print Provider Service.”

• Registry Settings: Next, it adds a registry entry in the “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost” key with the new value ”netpp.” This registry setting likely associates the “netpp” service with the Windows Service Host. It then adds the "HKLM\SYSTEM\CurrentControlSet\Services\netpp\Parameters" key and creates a new value named “Serviceb11” of type REG_EXPAND_SZ with the value data “%windir%\System32\netpp.dll.” This registry setting appears to define a parameter for the “netpp” service, specifying the location of the “netpp.dll” file within the Windows system directory.

• Service Start and Cleanup: Finally, the script starts the “netpp” service and performs trace removal.

Final Payload—netpp.dll

Initially, the program verifies several Windows API functions across various libraries, as shown in Figure 8. If it succeeds in loading those functions, the program continues; otherwise, it returns 0 and terminates. The C2 configuration stored in “netpp.ini” is encrypted using AES-CTR, and the key is derived from the service name established in the preceding step, namely, “netpp.” The first 16 bytes of “netpp.ini” are used as the Initialization Vector (IV) to decrypt and unveil the C2 server list, as seen in Figure 9.

Figure 8: Checking Windows API functions

Figure 9: The decrypted C2 list from "netpp.ini"

Figure 10: Converting collected data into a cab file

Figure 11: Creating an HTTP POST request

Figure 12: A POST request for uploading task list data

Figure 13: C2 sessions to dn.php

Figure 14: Process response data from the C2 server

Conclusion

This article explores an advanced toolset employed by a sophisticated threat actor within a Word document using batch scripts and DLL files. The payload incorporates a UAC bypass and encrypted communication with a C2 server, enabling the threat actor to execute privileged commands. As this malware continues to evolve, users are advised to exercise caution with suspicious documents.

Fortinet Protections

The malware described in this report are detected and blocked by FortiGuard Antivirus as:

VBA/Agent.CXE!tr
BASH/Agent.KON!tr
W64/Agent.ATC!tr
W32/Agent.AEQN!tr
W32/Agent.AFRB!tr

FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service. The FortiGuard AntiVirus engine is a part of each of those solutions. As a result, customers who have these products with up-to-date protections are protected.

Fortinet has also released IPS signatures to proactively protect our customers from the threats contained in the exploit list.

The URLs are rated as “Malicious Websites” by the FortiGuard Web Filtering service.

The FortiGuard CDR (content disarm and reconstruction) service can disarm the malicious macros within the document.

We also suggest that organizations go through Fortinet’s free NSE training module: NSE 1 – Information Security Awareness. This module is designed to help end users learn how to identify and protect themselves from phishing attacks.

FortiGuard IP Reputation and Anti-Botnet Security Service proactively block these attacks by aggregating malicious source IP data from the Fortinet distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence about hostile sources.

If you believe this or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.

IOCs

C2 List:

kmdqj1[.]c1[.]biz
ouvxu2[.]c1[.]biz
9b31n8[.]c1[.]biz
3pl0y5[.]c1[.]biz
dpgbep[.]c1[.]biz
7qnbae[.]c1[.]biz
glws5m[.]c1[.]biz
ewqqa4[.]c1[.]biz
3897lb[.]c1[.]biz
558ga9[.]c1[.]biz
b91stf[.]c1[.]biz
bg5pl1[.]c1[.]biz
caoy9n[.]c1[.]biz
rziju6[.]c1[.]biz
pm90p1[.]c1[.]biz
pxyunf[.]c1[.]biz
m2jymd[.]c1[.]biz
aocsff[.]c1[.]biz
6e2nbc[.]c1[.]biz
vqt9i1[.]c1[.]biz

Files:

ac9b814b98a962bc77b2ab862d9c3b1ba5f7e86b80797259b4fcb40bfb389081
f07e55ce20e944706232013241d23282e652de2c9514904dede14d4a711a5d1d
085cdb09aba0024c0cadbefe428817829bbe4ab0f68598572ebccc2f6f25e78f
793b8e72fded73ae6839e678b03bd5c99959f47a1ad632095ba60fb89f66fa91
83e66d912ca592bc2accfd9c275647f287b6dc72a859054a348e616537999b64
656dd6e67a51aebc6c69dc35eaba2e1502f225ae6fd9d0a5ff70879982427844
cfbc7e6a89e4a23a72c7bcd9019197721f18506d9ab842011e0ab9d9eb24c2cc