What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

More_eggs Activity Persists Via Fake Job Applicant Lures

BY eSentire Threat Response Unit (TRU)

June 6, 2024 | 8 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In May 2024, eSentire's Threat Response Unit (TRU) identified and traced activity related to a more_eggs malware campaign targeting a customer in the industrial services industry. However, eSentire MDR for Endpoint blocked the activity after the user attempted to open the resume-themed loader.

Specifically, the targeted individual was a recruiter that was deceived by the threat actor into thinking they were a job applicant and lured them to their website to download the loader. eSentire observed similar tactics with more_eggs back in early 2022.

More_eggs is a malicious software containing several components engineered to steal valuable credentials, including usernames and passwords for corporate bank accounts, email accounts, and IT administrator accounts and is sold on the Dark Web as a Malware-as-a-Service (MaaS).

The Golden Chickens group (aka Venom Spider) is believed to be the threat operators behind more_eggs, and the malware is known to be utilized by the very capable FIN6, Evilnum, and Cobalt cybercriminals.

Delivery

The delivery of the malware took place from the response to a LinkedIn job listing, where the attacker posed as a potential candidate, providing a link to the fake resume download site. When navigating to the site, the victim was met with a ‘Download CV’ button (Figure 1), which resulted in the download of a malicious Windows Shortcut File (LNK).

This delivery method has been observed by eSentire in previous more_eggs malware campaigns, where attackers have disguised themselves in both roles, as the recruiter and as the potential candidate.

The threat actors behind these campaigns target organizations and individuals by leveraging periods of time where hiring is typically at an increase.

Figure 1: Fake resume download site

Navigating to the same URL days later results in the individuals resume in plain HTML, with no indication of a redirect or download (Figure 2).

Figure 2: Normal resume site

Loading/Loader

Once the victim downloads and opens the .LNK file, in this case “Christian C. Velour.LNK”, the shortcut points to the executable “cmd.exe” followed by a long-obfuscated command. The command uses a lot of string substitutions to make analysis more difficult.

However, once de-obfuscated (Figure 2), the intent of the malicious .LNK file becomes clearer. When opened, the malicious command line generates a series of strings which are added to a new .INF file: “ieuinit.inf”. An INF file is a plain text configuration file used by the Windows operating system to install, uninstall, or configure device drivers, software components, or system settings.

In this case, the Loader uses the configuration as a reference point for the Malicious DLL download URL.

From there, the malicious command line creates a copy of the legitimate Microsoft “ie4unit.exe” executable in the user’s appdata\microsoft directory, which is the same directory the loader saved the malicious .INF file.

The “ie4unit.exe” file is a legitimate Microsoft Windows executable that is responsible for initializing certain settings and components related to Internet Explorer.

Here, it is used to execute commands from the specially prepared “ie4uinit.inf” file and to download the malicious DLL from a8advbiejf[.]christianvelour[.]com.

As seen in Figure 3, Windows’ WMI is invoked to run the hijacked copy of “ie4unit.exe”, which then drops the malicious DLL file named “55609.dll”.

This DLL is then registered into the user’s registry and executed using “regsvr32.exe” to establish persistence, gather data about the infected host, and to drop additional payloads.

Figure 3: De-obfuscated .LNK which uses legitimate Windows processes to download and execute malicious DLL

Payload

Upon inspection of the “55609.dll”, the DLL is highly obfuscated and contains multiple anti-debug and anti-sandbox checks. The DLL’s payload is encrypted and so a key is generated in an iterative fashion for the payload to get decrypted during execution.

Specifically, there is a loop which contains a string with the keyword “SqadTO” followed by a numerical number which starts at 0 and then increases by one until a match is found with a hardcoded hash (Figure 4). This process delays the execution of the payload until a match is generated.

Figure 4: Loops to generate the key for the encrypted payload

As per the Security Brief from Proofpoint UK, the malware uses the RC4 algorithm to decrypt the strings.An example of the decryption can be seen in Figure 5 and 6.

Figure 5: The generated RC4 key is passed along with the encrypted string to the decryption function
Figure 6: Example of a string decrypted after the decrypt function is run

Within the decrypted DLL, the malware sets up persistence on the host’s registry (Figure 7) and is responsible for dropping the “msxsl.exe” binary along with 2 other txt files which contain JavaScript code. These files are dropped in the %appdata%/Roaming/Microsoft folder.

Figure 7: The DLL adds registry keys on the host's machine to setup persistence

The first text file “7E9CB3FBF4FD0B07.txt” (Figure 8), contains obfuscated JavaScript code that is responsible for launching the second text file “1A4D05F30007.txt” using msxsl.exe.

Figure 8: Obfuscated JavaScript code which execute the second text file dropped "1A4D05F30007.txt"

Within “1A4D05F30007.txt” there is a fair amount of JavaScript code with various functions (Figure 9), but in summary the code appears to setup a command and control (C2) client which reaches out to hxxps[://]dcc[.]olcrv[.]com/login/tologin, and sends details from the host’s system such as OS version, local IP, antivirus software installed.

The code also has the capability ability to check whether the malicious script has system privileges, a function called “eTask” that can execute tasks received from the C2 server, and the ability to further download and execute files via the “dExec” function, which are all similar functions previously observed in more_eggs campaigns.

Figure 9: Various functions observed in the more_eggs payload JavaScript code

What did we do?

What can you learn from this TRU Positive?

Recommendations from our Threat Response Unit (TRU):

  1. Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.
    • Employ exhaustive endpoint monitoring for LOLBINs, aka Trusted Windows Binary abuse. LOLBINs of interest include cmd.exe, wscript.exe, wmic.exe, cmstp.exe, msxsl.exe, powershell.exe, and ie4uinit.exe. Ensure endpoint products have rules in place to detect suspicious usage of these Windows processes.
  2. Ensure employees are aware of common phishing tactics and implement a Phishing and Security Awareness Training (PSAT) program that educates and informs your employees on emerging threats in the threat landscape.
    • Be suspicious of attachments from people you don’t know – additional care is required in cases where you must accept documents from the public (such as with employee hiring process).
    • Inspect attachment file types by right clicking the file and selecting properties.
    • Documents should never come as LNK, ISO, or VBS files.
    • Often, these malicious files will be enclosed in a .zip file to bypass email filters.
  3. Have an easy process in place for reporting phishing and suspicious behavior.
    • Leadership is responsible for ensuring a positive and convenient path is in place for reporting suspicious behavior.
    • Develop a collaborative culture of cyber resiliency where employees are comfortable to bring forward questions, and even mistakes when it comes to email behavior and downloads. Punishing employees for falling for phishing scams will reduce the chances that they – and other employees – report them in the future.
  4. Users and administrators must adhere to the principle of least privilege by limiting account permissions strictly to those necessary for their operational roles, helping to minimize potential damage from malware infections.

Indicators of Compromise

You can access the Indicators of Compromise here.

References

eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire