Rewterz Threat Advisory – CVE-2017–11882 Multi-Layered Infection Attack Installs Betabot Malware

This is an advisory on a multi-stage attack installing Betabot Trojan to exploit a 17-year-old vulnerability using malicious office documents.

IMPACT:  CRITICAL

PUBLISH DATE:  19-06-2018

OVERVIEW

The Betabot Trojan is a malware having served many purposes for the hackers. It used to be a banking Trojan evolving into a password stealer and later becoming a botnet for distributing ransomware and other malicious programs. The attack involves exploitation of the 17-year-old vulnerability CVE-2017–11882 which was discovered and manually fixed by Microsoft last year.

BACKGROUND INFORMATION

A vulnerability in the Microsoft’s equation editor (EQNEDT32.EXE) prevalent since November 2000 was identified last year as  CVE-2017–11882 and was patched by Microsoft manually. The bug was not fixed in the source code which is now being  exploited by the Cobalt hackers.

The Cobalt hackers specially crafted an RTF file to execute commands on the compromised device. They embedded an OLE  object (inteldriverupd1.sct, task.bat, decoy.doc, exe.exe, and 2nd.bat) into the RTF file which pretend to be authentic software. The security researchers claim that they managed to create an exploit that would work with all Office versions released over the past 17 years, including Office 365, and which would impact all Windows versions, including Windows 10 Creators Update.

WORK FLOW

The attack is multi-layered and involves many things like remote code execution. The RTF file designed by the Cobalt hackers is  used to contact a remote server and deliver the first payload to the victim’s system. The code is executed using MSHTA.exe which then proceeds to grab another payload from the remote server. The second payload is a script having a final payload embedded in it.

This embedded final payload is the Cobalt Strike backdoor often used by the cobalt hackers group in various attacks they’re associated with.The malware is now ready to execute remote commands on the victim’s system.

IMPACT ANALYSIS

The impact of the Betabot malware is far-reaching as it’s been a tool to attack banks, steal passwords and to deliver ransomware and malware. The multi-purpose Trojan can be used to launch several kinds of damages to a system or organization. The detection of its activity is another complex mechanism as it does not require user interaction to perform its malicious functions. The researchers claim that once the malicious document is opened, the remote code execution will silently  pour its venom into the system without even effecting the user’s activity on Microsoft office.

RESOLVE

The only hinderance in the code execution is observed when the user has enabled protected mode. The protected mode  forbids any active content execution (OLE/ActiveX/Macro). However, this resolution can easily be by-passed using social engineering. A hacker can easily manipulate a user into saving the document on cloud (OneDrive, Google Drive). In such cases, the files obtained from remote sources are not labelled with MOTW (Mark Of The Web), and will not be  opened in the protected mode when a user opens them.

Therefore, great caution is required against social engineering whenever an employee is dealing with office documents to avoid the Betabot malware from running this multi-layered streak of attack on your system.

If you think you are a victim of a cyber-security attack. Immediately send an email to info@rewterz.com for a rapid response.