Introduction
In our recent investigation into the EAGERBEE backdoor, we found that it was being deployed at ISPs and governmental entities in the Middle East. Our analysis uncovered new components used in these attacks, including a novel service injector designed to inject the backdoor into a running service. Additionally, we discovered previously undocumented components (plugins) deployed after the backdoor’s installation. These enabled a range of malicious activities such as deploying additional payloads, exploring file systems, executing command shells and more. The key plugins can be categorized in terms of their functionality into the following groups: Plugin Orchestrator, File System Manipulation, Remote Access Manager, Process Exploration, Network Connection Listing and Service Management.
In this blog, we provide a detailed analysis of the EAGERBEE backdoor’s capabilities, focusing on the service injector, Plugin Orchestrator module and associated plugins. We also explore potential connections of the EAGERBEE backdoor with the CoughingDown threat group.
Initial infection and spread
Unfortunately, the initial access vector used by the attackers remains unclear. However, we observed them executing commands to deploy the backdoor injector named “tsvipsrv.dll” along with the payload file ntusers0.dat, using the SessionEnv service to run the injector, as can be seen below.
//change the creation, last access and write time, timestamp of the file to "1/8/2019 9:57"
attrib.exe -s -h -a C:\users\public
tusers0.dat
powershell.exe -Command "='1/8/2019 9:57'; = 'C:\users\public
tusers0.dat';(Get-Item
).creationtime = ;(Get-Item ).lastaccesstime = ;(Get-Item ).lastwritetime = "
//set the attributes of the file (EAGERBEE backdoor) to archive (+a), system file (+s) and
//hidden (+h)
attrib.exe +s +h +a C:\users\public
tusers0.dat
//set the attributes of the file (loader) to archive (+a), system file (+s) and hidden
//(+h)
attrib.exe +s +h +a system32\tsvipsrv.dll
//the malware runs now because of a DLL hijacking vulnerability, as the libraries in the
//system32 directory where the malicious library is located are the first to load
net.exe stop sessionenv
cmd.exe /c "sc config sessionenv Start= auto"
net.exe start sessionenv
attrib.exe -s -h -a C:\users\public
tusers0.dat
net.exe use \\<>\c$ /user:
attrib.exe +s +h +a C:\users\public
tusers0.dat
attrib.exe +s +h +a \\172.17.1.127\c$\users\public
tusers0.dat
attrib.exe -s -h -a system32\tsvipsrv.dll
attrib.exe +s +h +a system32\tsvipsrv.dll
attrib.exe +s +h +a \\172.17.1.127\c$\windows\system32\tsvipsrv.dll
attrib.exe -s -h -a \\172.17.1.127\c$\windows\system32\tsvipsrv.dll
attrib.exe +s +h +a \\172.17.1.127\c$\windows\system32\
Malware components
Service injector
The service injector targets the Themes service process. It first locates and opens the process, then allocates memory within it to write EAGERBEE backdoor bytes (stored in C:\users\public
tusers0.dat) along with stub code bytes. The stub code is responsible for decompressing the backdoor bytes and injecting them into the service process memory.
To execute the stub code, the injector replaces the original service control handler with the address of the stub code in the service process memory. The stub is then triggered by sending a SERVICE_CONTROL_INTERROGATE control code to the service. After the stub completes its execution, the injector cleans up by removing the stub code from the service memory and restoring the original service control handler.
EAGERBEE backdoor
When we found the backdoor in the infected system, it was named
dllloader1x64.dll. It can create a mutex with the name
mstoolFtip32Wif one doesn’t exist yet. After that, it starts collecting information from the system: the NetBIOS name of the local computer, OS information (major and minor version numbers, build number, platform identifier, and information about product suites and the latest service pack installed on the system), product type for the operating system on the local computer, processor architecture, and list of IPv4 and IPv6 addresses.
The backdoor has an execution day and time check. It compares the current system day and hour to the hardcoded string
0-6:00:23;6:00:23;, where the numbers mean the following:
- 0: start day of the week;
- 6: end day of the week;
- 00: start hour;
- 23: end hour.
If the execution day and hour do not match, it sleeps for 15 seconds and checks again. In the cases we’ve seen, the backdoor is configured to run 24/7.
The backdoor configuration is either stored in C:\Users\Public\iconcache.mui or hardcoded within the binary. If stored in the file, the first byte serves as the XOR key to decode the remaining data. When hardcoded, the configuration is decoded using a single-byte XOR key (0x57). This configuration includes the command-and-control (C2) hostname and port.
The backdoor retrieves the proxy host and port information for the current user by reading the registry key Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer. If proxy details are available, the backdoor connects through the proxy; otherwise it connects to the C2 server directly.
To establish communication, the backdoor creates a TCP socket capable of operating over both IPv4 and IPv6. If the C2 port has an “s” appended, an SSL session is initiated. Depending on the configuration, it may use the SCHANNEL security package, which supports SSL and TLS encryption on Windows. In this mode, it can validate server credentials (passive mode) or use local client credentials to prepare an outgoing token (active mode).
Once a connection is established, the backdoor transmits the previously collected victim-specific details to the C2 server. The server responds with a string followed by a payload known as the Plugin Orchestrator. If the response string matches a hardcoded value in the backdoor (unique to each sample), the backdoor retrieves the raw address of the first export method in the received payload and invokes it. Notably, at this stage, the payload (Plugin Orchestrator) is not yet mapped into memory.
Plugin Orchestrator
The payload downloaded by the EAGERBEE backdoor is a plugin orchestrator in the form of a DLL file with the internal name “ssss.dll” which exports a single method: “m”. As previously mentioned, EAGERBEE does not map the plugin orchestrator DLL directly into memory. Instead, it retrieves the raw address of the “m” export method and invokes it.
The “m” method of the plugin orchestrator DLL is responsible for injecting the orchestrator into memory and subsequently calling its entry point. In addition to the victim-specific data already collected, the plugin orchestrator gathers and reports to the C2 server the following additional information:
- The NetBIOS name of the domain;
- Current usage of physical and virtual memory;
- System locale and time zone settings;
- Windows character encoding;
- The current process identifier;
- Identifiers for any loaded plugins.
After transmitting this information, the plugin orchestrator also reports whether the current process has elevated privileges. It then collects details about all running processes on the system, including:
- Process identifiers;
- The number of execution threads started by each process;
- The identifier of the parent process;
- The fully qualified path of each process executable.
Once the information is sent, the plugin orchestrator waits for commands to execute. The following commands are supported:
| Command | Description |
| 06 | This command supports several sub-commands: 2: Receive and inject plugins into memory. There can be multiple plugins loaded one after another. Each plugin has an identifier. 3: Unload a specific plugin from memory, remove the plugin from the list, and free the plugin code bytes. 4: No operation. 5: Remove all plugins from the list and free the plugin code bytes. |
| 07 and 09 | Check if the plugin is loaded or not. If the plugin is loaded, then call the specified export method of the plugin. If the plugin is not loaded, then check if the plugin has been received, then load it, and call the specified export method. Otherwise, just make a plugin entry. |
Plugins
The plugins are DLL files and export three methods using ordinals. The plugin orchestrator first calls the exported method of the plugin with the ordinal number 3. This method is responsible for injecting the plugin DLL into memory. After that, the orchestrator calls the exported method of the plugin with the ordinal number 1, which is the
DllMainmethod. This method initializes the plugin with the required data structures. Finally, it calls the exported method of the plugin with the ordinal number 2. This method implements the functionality of the plugin.
All the plugins are responsible for receiving and executing commands from the orchestrator. Below, we provide brief descriptions of the analyzed plugins and the commands supported by each of them.
File Manager Plugin
This plugin performs a wide range of file system functions, including:
- Listing drives, files and folders in the system;
- Renaming, moving, copying and deleting files;
- Setting ACLs to manage file and folder permissions;
- Reading and writing files to and from the system;
- Injecting additional payloads into memory.
The table below contains commands it accepts.
| Command | Description |
| 0x02 |
|
| 0x06 |
|
| 0x07 |
|
| 0x08 |
|
| 0x09 |
|
| 0x0A (10) |
|
| 0x0B (11) |
|
| 0x0C (12) |
|
| 0xD (13) |
|
| 0x0F (15) |
|
| 0x14 (20) |
|
| 0x22 (34) |
|
| 0x23 (35) |
|
| 0x24 (36) |
|
| 0x26 (38) |
|
Process Manager
This plugin manages process-related activities such as:
- Listing running processes in the system;
- Launching new modules and executing command lines;
- Terminating existing processes.
It accepts four commands.
| Command | Description |
| 0x10 (16) |
|
| 0x11 (17) |
|
| 0x1E (30) |
|
| 0x26 (38) |
|
Remote Access Manager
This plugin facilitates and maintains remote connections, while also providing command shell access.
| Command | Description |
| 0x0B (11) |
|
| 0x0D (13) |
|
| 0x1D (29) |
|
| 0x1E (30) |
|
| 0x21 (33) |
|
The attackers launch the command shell by injecting
cmd.exeinto the
DllHost.exeprocess. The commands below were seen executed by the threat actor:
//list all users and users in the local admin group
net user
net localgroup administrators
//obtain system- and account-related information; the "dsquery" command implies that the
//attacker got hold of a Windows server machine with the Active Directory Domain Services
//(AD DS) server role installed.
dsquery computer
dsquery server
dsquery users
dsquery user
systeminfo
ping -n 1 <>
//establish a connection to a shared resource using stolen credentials
net use \\<>\admin$ /user:
//archive the information from the shared resource
rar.exe a -v100M idata001.rar -ta"20240101000000" -r -x"*.mp3" -x"*.dll" -x"*.exe" -
x"*.zip" -x"*.mxf" -x"*.rar" "\\<>\c$\Users\< >\Documents"
"\\<>\c$\Users\< >\Desktop"
rar.exe a -v100M idata001.rar -ta"20240101000000" -r -x"*.mp3" -x"*.dll" -x"*.exe" -
x"*.zip" -x"*.mp4" -x"*.rar" "\\<>\c$\Users\< >\Documents"
"<>\c$\Users\< >\Desktop"
Service Manager
This plugin manages system services, including installing, starting, stopping, deleting and listing them.
| Command | Description |
| 0x11 (17) |
|
| 0x12 (18) |
|
| 0x13 (19) |
|
| 0x14 (20) |
|
| 0x1E (30) |
|
Network Manager
This plugin lists the network connections in the system.
| Command | Description |
| 0x1E (30) | Get information about the list of IPv4 and IPv6 TCP and UDP connections:
|
Attribution
EAGERBEE was deployed in several organizations in East Asia. Two of these organizations were breached via the infamous ProxyLogon vulnerability (CVE-2021-26855) in Exchange servers, after which malicious webshells were uploaded and utilized to execute commands on the breached servers.
In May 2023, our telemetry indicated the execution of multiple commands to start and stop system services at one of the affected organizations in East Asia. The attackers abused the legitimate Windows services
MSDTC,
IKEEXTand
SessionEnvto execute malicious DLLs:
oci.dll,
wlbsctrl.dlland
TSVIPSrv.dll, respectively.
tasklist.exe
net stop IKEEXT
net start IKEEXT
net start msdtc
net stop msdtc
net start msdtc
NETSTAT.EXE -ano
tasklist.exe
ARP.EXE -a
net.exe use \\[[IP REDACTED
Source: secureList
Source Link: https://securelist.com/eagerbee-backdoor/115175/
