CFC REPORT SPHINX MOTH

CFC REPORT: SPHINX MOTH
2.3. “CUDACRT.DLL” (MD5: D91ED1715DE8EDDD5244565926ED2899)
“Cudacrt.dll” – a tool for persistence and backdoor control
This DLL was attached to “lsass.exe”, and was responsible for the execution of the binary “iastor32.exe” (SSH client) for
communication.
One interesting function of this DLL is its ability to deobfuscate the registry entries (under “SOFTWARE\SsoAuth\Service”).
Again, we are dealing with a simple single-byte “XOR”. This time, deobfuscation was even easier, as the key was “0x01”.
2.4. “KERBEROS32.DLL” (MD5 : FD4C881DF95B67EE2F07ADAD0DCA9C98)
“Kerberos32.dll” – the attackers’ toolset for lateral movements and hiding capabilities
This DLL was also loaded into “lsass.exe”, as the one above, but gave the attackers more control. For example, as already stated
in the Symantec report, it was able to dump the hashes in memory, clean logs, start or stop logs or reboot. The “Kerberos*.dll”
commands are listed in Appendix 4.3.
To interact with this backdoor, a named pipe was created on the host (“\\.\lsassp” in our samples) and the traffic was then obfuscated
with an “XOR” key (see below). We provided a Powershell that can be run (with SCCM for example) to detect if hosts are compromised
on a corporate environment. See Appendix 4.4 for details.
The “XOR” key for traffic was as follows: “\x24\x75\x60\xCA\x94\x40\xA8\x23\xCD\x55\xCE\x66\xCE\x63\x9b\x8E”
The backdoor supported an impressive number of OS:
• Windows 2000
• Windows XP
• Windows 2003
• Windows Vista
• Windows 2008
• Windows 7
• Windows 2008R2
• Windows 8
• Windows 2012
• Windows 8.1
• Windows 2012R2
Cybersecurity unit of Kudelski Group
11
www.kudelskisecurity.com
request@kudelskisecurity.com