Another threat actor day…

### Overview Presented at Pass the SALT 2020 by Paul Rascagnères (introduced as Paul Young in the talk transcript), this presentation details an incident response case study involving an attack on a Belgian hospital environment. The intrusion is attributed to the threat group TA505, known for deploying Clop (or CIOP) ransomware. The response team from Excellium Services was called in after Belgian CERT and NCSC indicators of compromise (IoCs) matched firewall traffic and black command prompt screens were spotted on servers. The talk covers the attacker's infection chain, lateral movement, persistence techniques with the SDBbot backdoor, response containment strategies, and a proactive research methodology developed to track TA505 infrastructure on the internet.

### Key Topics - **Initial Access & Delivery**: TA505 launched two massive phishing campaigns delivering links rather than file attachments via an open relay at a Russian university. Links routed through a URL minification service (mercy.d) to an attacker-controlled backend. Victims downloaded an Office document containing malicious VBA macros and two embedded PE droppers named Get2 (32-bit and 64-bit). - **SDBbot & Staging**: Get2 fingerprinted the machine (reporting hostname, username, OS version, running processes) and subsequently downloaded SDBbot, a registry-based, fileless backdoor executed by a small loader DLL. An intermediary executable named `profile3.7.exe` was also noted in the chain. - **Lateral Movement & Credential Theft**: Within 1 hour and 20 minutes of initial C2 contact, the threat actor exploited MS17-010 (EternalBlue) to achieve System-level privileges on a domain controller. Within 20 hours, they harvested credentials from the SAM database using `reg.exe`, LSASS memory via ProcDump, and a tool called PowerDump. - **Detection & Containment Challenges**: The hospital operated a flat network with hundreds of unpatched Windows 7 systems vulnerable to EternalBlue, decentralized logs, and no proxy or IDS in place. Containment involved network segmentation, blocking C2 addresses, overriding SDBbot configuration using `ip.txt`, and scanning servers using GRR (Google Rapid Response) with YARA rules. - **Proactive Threat Hunting**: Leveraging SDBbot's unique proprietary network handshake, the team created custom Nmap NSE scripts and passive DNS analysis to uncover TA505's C2 infrastructure.

### Technical Details - **Get2 and SDBbot Architecture**: SDBbot uses a loader DLL launched via the `Run` registry key. The loader reads configuration and registry paths using the user's UID to unpack a compressed executable and shellcode stored under `HKCU\Software\Microsoft\[3-letter key]\[1-letter value]`. On servers where SDBbot ran as System, persistence utilized Application Compatibility Shims, injecting the payload directly into `winlogon.exe`. - **Lateral Movement Tooling**: TA505 deployed repackaged Meterpreter stagers (referred to as TinyMet, named `isdw3.exe`), Meterpreter listeners, and SMBExec. SMBExec left telltale artifacts such as `BTOBTO` services and `__output` directories on the root of `C:\`. - **Command and Control Protocol**: SDBbot communicates over raw TCP on port 443 using a binary protocol. Upon startup, it queries `api.ipify.org` for its external IP and initiates a four-byte handshake (`0x00 0x00 0x00 0x00` or `0xDE 0xC0...` magic check) where the server echoes back the four bytes. Any HTTP request sent to the C2 triggers an immediate TCP reset, making these backends invisible to Shodan. - **Config Override via ip.txt**: The team leveraged a built-in fallback feature of SDBbot: if an `ip.txt` file exists in the working directory or `C:\`, the bot overrides its hardcoded C2 (`dream-server-booking.com`). Deploying `ip.txt` helped verify and neutralize dormant infections. - **Infrastructure Hunting**: Analyzing historical naming patterns and autonomous system numbers (ASNs) from passive DNS data, the team generated permutation wordlists of domain labels. Scanning targeted ASNs with an NSE script simulating the four-byte handshake revealed 12 active SDBbot backends across Ubuntu systems.

### Takeaways TA505 acts with remarkable speed, transitioning from initial phishing access to domain admin privileges and full domain credential dumping in under 20 hours. While their endpoint payloads utilize clever fileless registry persistence and shims, their network protocols are straightforward and reusable, allowing defenders to track infrastructure across the internet using simple custom network handshakes and passive DNS analysis. Proactive scanning and incident preparedness are essential to contain intrusions before ransomware deployment.