What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

SocGholish Sets Sights on Victim Peers

BY eSentire Threat Response Unit (TRU)

May 8, 2024 | 8 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT
2024-06-15 - This blog has been updated with additional details regarding the purpose behind email signature modification.

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In April 2024, eSentire's Threat Response Unit (TRU) identified and traced hands-on-keyboard activity to a SocGholish infection initiated by a fake browser update. The fake update used obfuscated JavaScript to evade detection and establish a foothold in the environment.

Attackers used living-off-the-land techniques to collect sensitive credentials and notably, configured web beacons in both email signatures and network shares to map out local and business-to-business relationships. This behavior would suggest an interest in exploiting these relationships to target business peers of interest.

The infection began when the user visited a compromised website and downloaded a fake browser update named "Update.js," disguised as a JavaScript file (MD5: 44a0b845b30dcdc26c8017a6714c46e9).

The compromised webpage contained injected JavaScript (Figure 1), and the link led to obfuscated JavaScript code (Figure 2).

Figure 1: Injected JavaScript
Figure 2: Snippet of the obfuscated JavaScript

The snippet of the deobfuscated script is shown below (Figure 3).

Figure 3: Deobfuscated script

The script first checks if the browser is controlled by automation tools, such as Selenium, using the “navigator.webdriver” property. If this property is true, indicating that the browser might be under script or automation control, it triggers a function to load a script from a specified SocGholish URL and then terminates (lines 8-12). This behavior is highly likely designed to evade automated analysis and detection.

Next, the script checks whether the browser window has been manipulated significantly (e.g., if the difference between the outer and inner height or width of the window is unusually large). This can indicate an attempt to detect if it’s running in a potentially monitored or unconventional environment. If the manipulation is detected, it loads another script from a different URL (lines 14-21).

Additionally, the script examines whether the user is logged into a WordPress site by searching for specific cookie identifiers like “wordpress_logged_in” or “wp-settings”. If these cookies are detected, the script refrains from executing any further actions (lines 23-27).

If none of the mentioned conditions trigger, the script sets up an event listener for mouse movements. Upon the first mouse movement detected, it removes this listener and loads another script from yet another URL. This is possibly a technique to only trigger script loading after user interaction, which can help bypass certain types of detection mechanisms that look for malicious activity upon page load (lines 32-37).

The _0x4d8183 function (lines 40-47) is dynamically used to insert a script element into the webpage. This function takes a URL as an argument, creates a <script> element, sets its src attribute to the provided URL, and appends it to the first script tag found in the document. This method of script injection allows external code to be run within the webpage context.

The example of URLs provided in the script are:

These are triggered under specific conditions in the script that have been mentioned, executing external code when certain criteria are met, such as the detection of automation tools or particular user interactions.

The downloaded malicious Update.js file contains an obfuscated JavaScript (Figure 4).

Figure 4: Contents of Update.js

The script makes a POST request to the URL hxxps://tfuq.register.arpsychotherapy[.]com/editContent. The “send” method sends the request to the server with data “lpZw+wmbGiagWaoqNM/HmfLjMBYLsTv26io31cysSA==” (Figure 5).

Figure 5: Deobfuscated Update.js

Post-exploitation Activity

17 minutes after the malicious JavaScript payload was executed by the user, we identified hands-on-keyboard activity on the victim asset. This activity included stored password extraction, decryption, and reconnaissance.

Password Store Extraction

The threat actors extracted saved login data from Microsoft Edge and Google Chrome and copied them to a temporary file for exfiltration using the following commands:

Shortly after, another command was run to copy login data files from both Edge and Chrome browsers to a different user's Downloads directory, then log activity or errors to a temporary file (username – is the primary infected user, usename_2 is another user on the same machine):

Staging the credential data under another user is likely done for redundancy purposes in case the main files are discovered.

Encryption Key Retrieval

Next, the threat actors attempted to run a base64-encoded command via PowerShell. The decoded command retrieves and decrypts Edge’s and Chrome's encryption keys for passwords and cookies using the DPAPI (Data Protection API) and outputs the results in a temporary file.

The decoded commands:

Python Script Execution

Subsequently, the threat actors attempted to execute and run the PowerShell command 10 times, which performs several operations related to downloading, extracting, and setting up a portable version of Python on an infected machine under the “AppDataLocalConnectedDevicesPlatform” path to possibly run additional Python payloads.

Email Contact Reconnaissance

The threat actors then ran a base64-encoded command via Powershell to modify HTML signature files used by Microsoft Outlook.

The command lists above all HTML (.htm) files in the directory used for storing Microsoft Outlook email signatures and replaces the </body> tag with a modified version that includes an <img> tag right before the original </body> tag. This <img> tag inserts an image from a remote server (specified by the URL in the command). The command then redirects any output from the PowerShell command to a temporary file for logging purposes.

The purpose of the command is to steal NetNTLM hashes via the email signatures (special thanks to Max Anderson, an Assistant Vice President at Pondurance, for bringing this to our attention). You can read more about the technique here.

Network Discovery

The threat actors then listed the members of the “domain users” group in a domain environment by running the C:\Windows\system32\net1 group "domain users" /domain command.

The last command is responsible for creating the shortcuts within the network share. The target path points to the network share location. The shortcut icon points to the SocGholish C2 server 170.130.55[.]72/Documentation.ico.

We assume that the purpose of this command is similar to the email signature case mentioned above.

The SocGholish intrusion campaign showcased a social engineering approach to first gain entry through fake updates and then initiate a series of scripted actions to extract sensitive data and monitor user interactions.

What did we do?

Our team of 24/7 SOC Cyber Analysts isolated the affected host and notified the customer of suspicious activities.

What can you learn from this TRU Positive?

Recommendations from our Threat Response Unit (TRU):

We recommend implementing the following controls to help secure your organization against SocGholish malware:

Indicators of Compromise

You can access the indicators here.

eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire