Abused COM Objects

Berbew

• {79ECA078-17FF-726B-E811-213280E5C831}

• {79FEACFF-FFCE-815E-A900-316290B5B738}

• {79FAA099-1BAE-816E-D711-115290CEE717}

RATs

RATs w/ vulnerabilities

EventID:13 
EventType:SetValue
Details:%windir%SysWOW64rundll32.exe /sta {D4D4D7B7-1774-4FE5-ABA8-4CC0B99452B4} "USB_Module"
TargetObject:HKUS-1-5-21-575823232-3065301323-1442773979-1000SoftwareMicrosoftWindowsCurrentVersionRunRunDllModule

Why use one when you can use many?

• {EBEB87A6-E151-4054-AB45-A6E094C5334B}

• {57477331-126E-4FC8-B430-1C6143484AA9}

• {241D7F03-9232-4024-8373-149860BE27C0}

• {C07DB6A3-34FC-4084-BE2E-76BB9203B049}

Adware

Citrio, an adware web browser designed by Catalina Group, uses in its more recent versions a COM object for persistence with CLSID {F4CBF20B-F634-4095-B64A-2EBCDD9E560E}. It drops several harmful DLLs, one masquerades as Google Update (goopdate.dll), also observed as psuser.dll, that possesses the capability to establish services on the system along using a COM object for persistence.

Common folders used to store the payloads

• qmacro

• mymacro

• MacroCommerce

• Plugin

• Microsoft

• The C:WindowsSysWow64 is a folder found in 64-bit versions of Windows, containing legitimate 32-bit system files and
  libraries, and is oftenly used to conceal malicious DLLs. Its prevalence makes it an attractive
  hiding place, complicating detection efforts. However, permissions are required to create files in
  it.

• The
  C:Program Files (x86)
  folder is another legitimate directory used to store malicious COM hijacking payloads. Similar to
  AppDataRoaming, in this case we have observed that the malicious DLLs are stored under specific
  subfolders, such as “Google”, “Mozilla Firefox”, “Microsoft”, “Common Files” or “Internet
  Download Manager”.

• C:Users<user>AppDataLocal
  is another folder used for storing these payloads, including the “Temp”, “Microsoft” and “Google”
  subfolders.

Detection

• Potential
  Persistence Via COM Hijacking From Suspicious Locations
  (high risk level). Detects suspicious when creating a registry key using COM objects.

• Potential
  Persistence Via COM Search Order Hijacking
  (medium risk level). Similar to the previous rule, it also filters out paths associated with
  legitimate behaviors.

import "vt"

rule CLSID_COM_Hijacking:  {
  meta:
    target_entity = "file"
    hash = "a19472bd5dd89a6bd725c94c89469f12cdbfee3b0f19035a07374a005b57b5e0"
    author = "@Joseliyo_Jstnk"
    mitre_technique = "T1546.015"
    mitre_tactic = "TA0003"

  condition:
    vt.metadata.new_file and vt.metadata.analysis_stats.malicious >= 5 and 
    for any vt_behaviour_registry_keys_set in vt.behaviour.registry_keys_set: (
      vt_behaviour_registry_keys_set.key matches /\CLSID\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}}\InProcServer32\(Default)/
    )  
}

and not 
    (
        for any engine, signature in vt.metadata.signatures : (  
        signature icontains "berbew"  
        )  
    )

import "vt"

rule CLSID_COM_Hijacking:  {
  meta:
    target_entity = "file"
    hash = "a19472bd5dd89a6bd725c94c89469f12cdbfee3b0f19035a07374a005b57b5e0"
    author = "@Joseliyo_Jstnk"
    sigma_authors = "Maxime Thiebaut (@0xThiebaut), oscd.community, Cédric Hien"
    mitre_technique = "T1546.015"
    mitre_tactic = "TA0003"

  condition:
    vt.metadata.new_file and vt.metadata.analysis_stats.malicious >= 5 and 
    for any vt_behaviour_sigma_analysis_results in vt.behaviour.sigma_analysis_results: (
      vt_behaviour_sigma_analysis_results.rule_id == "7f5d257abc981b5eddb52d4a9a02fb66201226935cf3d39177c8a81c3a3e8dd4"
    )
}

Wrapping up

APPENDIX

Abused CLSIDs

Common paths

.my-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: Black;
color: White;
/*padding: 24px;*/
border-collapse: collapse;
}

.my-yara-code{
font-family: “Courier”, sans-serif;
font-size: medium;
width: 100%;
background: #F7F9F9;
color: Black;
/*padding: 24px;*/
border-collapse: collapse;
/*font-weight: bold;*/
}

mark.green {
color:#3cb371;
background: none;
}
mark.gray {
color:Gray;
background: none;
}
mark.yellow {
color:Yellow;
background: none;
}
mark.orange {
color:Orange;
background: none;
}
mark.red {
color:Red;
background: none;
}
mark.blue {
color:#33BEFF;
background: none;
}

mark.dark-blue {
color:Blue;
background: none;
}

.table-fields {
background: #86aaf9;
}

th:first-child { width: 24%; }
th:first-child+th { width: 39%; }

/*
.table-container table td,
.table-container table th {
padding: 16px 32px;
}
*/

table.no-spacing {
border-spacing:0; /* Removes the cell spacing via CSS */
border-collapse: collapse; /* Optional – if you don’t want to have double border where cells touch */
}

.pmargin {
margin: 0;
}

a {
color: blue!important;
}

.central_img {
position: relative;
display: block;
margin-left: auto;
margin-right: auto;
}

.central_img img {
border: 1px solid #000000;
}

.central_img p {
text-align: center;
font-style: italic;
}

.width_10 {
width: 10%;
}

.width_15 {
width: 15%;
}

.width_20 {
width: 20%;
}

.width_30 {
width: 30%;
}

.width_40 {
width: 40%;
}

.width_50 {
width: 50%;
}

.width_60 {
width: 60%;
}

.width_80 {
width: 80%;
}

pre {
background: #f4f4f4;
border: 1px solid #ddd;
border-left: 3px solid #7ad3ff;
color: #666;
page-break-inside: avoid;
font-family: monospace;
font-size: 15px;
line-height: 1.6;
margin-bottom: 1.6em;
max-width: 100%;
overflow: auto;
padding: 1em 1.5em;
display: block;
word-wrap: break-word;
}

.width_90 {
width: 90%;
}

.width_100 {
width: 100%;
}

ul{
margin-bottom: 5px!important;
}

.interval_12{
margin-bottom: 12px!important;
}

Related posts:

CloudSorcerer – A new APT targeting Russian government entities Threat Spotlight: WarmCookie/BadSpace How LLMs could help defenders write better and faster detection Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401