EXECUTIVE SUMMARY

This is the analysis report of a sample which is tied to a campaign conducted against South Korean Unification Ministry – 1 January 2019. We have identified that the aforementioned malware possesses information collection capabilities. We also suspect that the malware possesses remote command execution capabilities. Anti analysis techniques are employed. Considering this information, we are confident that the implant functions as a spyware. Although having several distinctive features, the tradecraft of this implant is similar to those from “Operation Kimsuky”.

GENERAL INFORMATION

FILE SECTIONS

ACTIVITY SUMMARY

1. Drop HWP document in the same directory
2. Attempt to open HWP document
3. Drop %TEMP%\[0-9A-F]{4}.dll
4. Load dropped DLL
5. Invoke EmptySub Method
   • Drop C:\ProgramData\Hnc\HncChecker.dll
   • Create C:\ProgramData\Hnc\serial.info
   • Create C:\ProgramData\Hnc\status.dat
   • Add New Service
     1. HKLM\System\CurrentControlSet\Services\HncCheck
   • Log keystrokes
     1. Write into C:\ProgramData\Hnc\userdata.cab

ANALYSIS

Sample has unusual section names and sections with high entropy, which usually indicates some form of executable packing and/or encryption. Also, we observed that this sample reacts in the presence of tools and environment related to malware analysis. A signature scan and further behavior analysis revealed that this file is protected by a software protection tool called VMProtect.

• Sample terminates itself when a debugger is attached to it.
• Sample terminates itself in the presence of a process named “Wireshark.exe”
• Sample terminates itself when it detects a Virtual Machine environment.
• Sample employs executable protection and encryption.

It is observed that the sample modifies the system registry in an attempt to add itself as a service and ensure persistence.

Following registry keys are modified:

• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\HncCheck
• HKLM\System\CurrentControlSet\services\HncCheck\Parameters\ServiceDll

The sample contains two DLL files in its resources which is assessed to be the second stage payload. Two DLL files are essentially the same payload compiled for different architectures x86 and x86-64. It is observed that malware first determines the architecture of the infected system and then drops the according to DLL file.

When EmptySub method of dropped HncChecker.dll module is invoked the malware starts to capture keystrokes and writes to local file C:\ProgramData\Hnc\userdata.cab it has created. Although it is not observed we suspect that this malware also contains other collection capabilities.

We have encountered strings indicating HTTP requests to API of an online E-mail service. This could mean that malware is communicating with its command and control servers through this E-mail service. We also suspect that malware could be using this service for file transfer. However, we have not yet observed this behavior in dynamic analysis environment.

We have encountered strings indicating remote command execution capabilities. However, we have not yet observed this behavior in dynamic analysis environment.

Cmd [%d]
Executing cmd...

We have encountered strings indicating file transfer capabilities. However, we have not yet observed this behavior in dynamic analysis environment.

We have encountered strings indicating process injection capabilities. We suspect that this malware can inject any executable into a process, an attacker’s request. However, we have not yet observed this behavior in dynamic analysis environment.

ADVERSARY TACTICS

Several tactics used by this sample is mapped accordingly with MITRE’s Adversarial Tactics, Techniques & Common Knowledge.