How Is Microsoft Exchange Vulnerability Being Exploited By Prometei Potnet?

Well, the Proxy Logon Microsoft Exchange vulnerability is again in the news. It’s known that attackers always keep trying new ways to exploit the vulnerabilities. This time attackers have been found using Prometei botnet to compromise Proxy Logon Microsoft Exchange vulnerability (CVE-2021-27065 and CVE-2021-26858) in order to penetrate the network and install Monero crypto-mining malware on the targets. Let’s see how Proxy Logon Microsoft Exchange vulnerability is being exploited by the Prometei botnet?

What do we know about the Prometei botnet?

Promote is a crypto miner mostly created by a group of Russian speakers (not backed by the Russian government), which is used for malicious activities. It is a modular multistage cryptocurrency botnet that has been created for both Windows and Linux platforms. The main goal of the Prometei botnet is to mine Monero cryptocurrency. Researchers found that the Prometei botnet has chosen illegal ways to propagate across the network to mine the Monero coins.

Although, Prometei was officially discovered in June 2020. Researchers recently found the existence of the malware back in 2016. Researchers also found that during these few years, the Prometei has seen several advancements. Now the malware is loaded with a lot of sophisticated features like stealthy backdoor, mining Monero coins, and APT-like features.

Researchers also discovered four different command and control servers (C2) which give a boost to the botnet’s infrastructure. This makes the malware more robust against attacks to take the malware down.

What Is Proxy Logon Microsoft Exchange Vulnerability?

To tell about this in short, Recently, a cyberespionage group, HAFNIUM, has compromised several Microsoft’s Exchange servers by exploiting the four vulnerabilities found in Exchange servers. All these four vulnerabilities are collectively called Proxy Logon Microsoft Exchange vulnerability.

CVE-2021-26855: This is a server-side request forgery (SSRF) vulnerability in Exchange, Which allows arbitrary HTTP requests sent and authenticate as a server. 

CVE-2021-26857: This is an insecure deserialization vulnerability In a united messaging service that allows the attacker to run the code on the Exchange Server. This requires administrator privileges or another vulnerability CVE-2021-26858 to exploit.

CVE-2021-26858 & CVE-2021-27065: This is a Post authentication, and arbitrary file writes vulnerabilities allow an attacker to write a script on any location on the exchange server. This vulnerability requires either exploiting the CVE-2021-26855 SSRF vulnerability or compromising a legitimate admin’s credentials.

Who Are The Victims Of Prometei Botnet Malware?

There are no specific targets has seen at this point in time. A wide range of industry sectors has reported the infection, which includes Finance, Insurance, Retail, Manufacturing, Utilities, Travel, and Construction globally. Promote has been observed to be active across the US, the UK, and many other European countries, as well as countries in South America and East Asia. It was also observed that the threat actors appear to be avoiding infecting former Soviet bloc countries. The most concerning aspect is that the targets are random. We warn every industry across the globe.

Threat Actors Behind The Prometei Botnet:

At the time of this report, there is no much information about the threat actors. We believed that the authors of the Prometei botnet are financially motivated and operated by Russian-speaking individuals. Researchers are still collecting evidence to find out more about the threat actors of the Prometei botnet.

Prometei Botnet IoCs:

 China Chopper web shell

1. C:/dell/searchindexer.exe
2. C:/dell/desktop.dat
3. C:/Windows/svchost.exe

C2 Servers:

Promote has four C2 servers. Here is one among them.

1. 178.21.164.68

Files of Prometei Botnet:

1. C:/windows/zsvc.exe: Initial payload downloaded from the C2 servers.
2. C:/windows/Sqhost.exe: is the main bot module.
3. RdpClip.exe: A key component of malware that is used to interact with other components of the malware and make them work all together
4. Miwalk.exe: A customized version of Mimikatz used for Credential harvesting.
5. ExchDefender.exe: it creates a service named “Microsoft Exchange Defender” [MSExchangeDefenderPL] that is set to execute the binary (from C:/Windows)
6. SearchIndexer.exe: It’s an open-source Monero mining software. See if it is illegally installed.
7. Netwalker.7z:: Is an archive application download from the C2
8. Nethelper2.exe and Nethelper4.exe: It creates connections to SQL servers in the network and tries to infect them with the main module
9. Windrlver.exe: It is an OpenSSH and SSLib-based software that the attackers have created so they can spread across the network using SSH

Prometei Botnet Toolset:

Since 2019, the malware keeps evolving over time, adding more and more functionalities. It might have used plenty of tools and may have added even more. Researchers have found only these few tools in their research as attackers don’t use a complete toolset in one attack. Researchers are trying to discover more tools as they investigate more attacks.

1. C:/WORK/Tools_2019/walker/DOTNETPlugin/pgbrute/bin/Release/CryptoObfuscator_Output/nethelper.pdb
2. C:/WORK/Tools_2019/walker/bklocal/BlueKeep/bin/Release/CryptoObfuscator_Output/BlueKeep.pdb
3. C:/Work/Tools_2019/walker/netwalker/x64/Release/rdpcIip.pdb
4. C:/Work/Tools_2019/prometei/rdpexec/psexec/Release/psexec.pdb
5. C:/Work/Tools_2019/prometei/rdpexec/shift – bot/Release/shift.pdb
6. C:/Work/Tools_2019/prometei/scan_rdp/rdp_checker/MyRDP/SampleRDC/bin/Release/CryptoObfuscator_Output/socks.pdb
7. C:/WORK/Tools_2019/prometei/RDPBrute2016.NET/RDPDetect/bin/Release/CryptoObfuscator_Output/nvsync.pdb
8. C:/WORK/Tools_2019/prometei/nvstub/Release/nvstub.pdb
9. C:/Work/Tools_2019/prometei/nvstub/Release/nvstub.pdb
10. C:/Work/Tools_2019/prometei/scan_rdp/rdp_checker/RDPDetect (rdp_checker)/RDPDetect/bin/Release/CryptoObfuscator_Output/nethost.pdb
11. C:/Work/Tools_2019/prometei/psbrute/Release/psbrute.pdb
12. C:/Work/Tools_2019/prometei/RDPBrute2016.NET/RDPDetect/bin/Release/CryptoObfuscator_Output/nvsync.pdb
13. C:/Work/Tools_2019/prometei/rdpexec/shift – bot/Release/shift.pdb
14. C:/Work/Tools_2019/misc/tor_hidden_svc/darkread/x64/Release/darkread.pdb
15. C:/Work/Tools_2019/misc/util/chk445/Release/chk445.pdb
16. C:/Work/Tools_2019/misc/util/crawler/Release/crawler.pdb

What Is The Real Motive Behind This Attack?

Not all Attackers, cybercriminals, and threat actors conduct attacks for one reason. Some attacks were carried out to steal sensitive information, some attacks were carried out in causing damage, some attacks for political intent, but one thing is common among all the attacks, profit. All the attacks will carry out to reap some benefit in any form.

The main reason behind this attack is to install Monero crypto-mining malware on the targets. Monero is one of the world’s popular cryptocurrencies. Threat actors want to join more servers to the blockchain network to horn the computing resources from the servers to mine cryptocurrency. Mining cryptocurrencies has become a kind of race as some money will be rewarded to those who first verify the block of transaction. 

Cryptocurrency mining is legal. But in this attack, threat actors compromise the others servers to full fill their high computational requirement, which is needed to verify the block of transactions.

Watch this video to know how does cryptocurrency mining work.

How Is Microsoft Exchange Vulnerability Being Exploited By Prometei Botnet?

Proxy logon vulnerability is made up of four vulnerabilities. When all the four vulnerabilities are chained together, they can create pre-authentication remote code execution (RCE) exploit. This allows attackers to take over the Microsoft Exchange server without credentials. This gives attackers access to email communication and rights to install web shells for further exploitation like hosting ransomware and crypto miners.

In this attack, attackers try to exploit North American companies by using these two proxy login vulnerabilities on exchange servers: CVE-2021-27065 and CVE-2021-26858. These are post-authentication, and arbitrary file writes vulnerabilities allow an attacker to write a script on any location on the exchange server.

An attacker uses these Microsoft exchange vulnerabilities to install and execute the China Chopper web shell. Attackers use this web shell to launch Power Shell, downloading the malware payload from attacker’s shared web URL. The payload then executes and starts Prometei botnet execution.

Technical Details About Prometei Botnet:

1. Promote botnet first starts its execution from ‘zsvc.exe’ file. Then it starts to create a likelihood environment for other modules.
2. Promote botnet copy the ‘zsvc.exe’ file into C:/Windows it rename that file to ‘sqhost.exe’.
3. The malware tries to find a registry key named ‘UPlugPlay’ and deletes that if it is found.
4. The bot then sets a registry key ‘HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/UPlugPlay’ with the image path and command line c:/windows/sqhost.exe Dcomsvc.
5. It then creates multiple registry keys underneath SOFTWARE/Microsoft/Fax/ and SOFTWARE/Intel/support/ with the names MachineKeyId, EncryptedMachineKeyId, and commit, for later use by the different components for C2 communication.

Please visit the Cybereason post for comprehensive technical details.

Conclusion:

Prometric is a complex, multistage, advanced, sophisticated malware loaded with many stealth features. This notorious malware can perform multiple tasks: credential harvesting, self network propagation, communication with C2 servers, and download various models. Prometric also allows its authors to send more modules and expand its capabilities to carry out different types of attacks on the victim. 

Information about the threat actors is unknown at this time of reporting. It’s believed that a Russian-speaking group is funding the attackers to exploit the recently found proxy login vulnerabilities on Exchange servers to install Monero crypto-mining malware on the targets.

According to the author Lior Rochberger, Threat actors targeted more on the US, UK, and many European countries and countries in South America and East Asia. And it’s also observed that threat actors appear to be avoiding the attacks on former Soviet bloc countries.

Thanks for reading this article. Please visit our site if you feel this article is interesting.

• Microsoft Exchange 0 Day cyberattack explained:
• Step by step procedure to detect the Microsoft Exchange 0 Day exploit.
• How to quickly find and fix vulnerabilities on Windows in no time?
• Step by step procedure to fix the new sudo vulnerability (CVE-2021-3156)
• A mathematical explanation of the Diffie-Hellman Key Exchange protocol: