Malspam delivers TeamSpy Spyware 10-29-2017

For years, threat actors have been relying on DLL side-loading to load their malicious code into the address space of legitimate applications. PlugX is probably the most prominent example, but there are other malware families [1]. There is a certain order that Microsoft Windows follows in order to find a DLL required by an application [2]. If SafeDLLSearchMode is disabled, the current directory comes before other typical directories such as Systems directory or Windows directory in the search order for a DLL. By dropping their malicious DLL in the same directory as a trusted application, malware authors have a chance to blend in and evade analysis.

TeamSpy leverages the DLL side-loading technique to load its malicious payload into the memory space of TeamViewer; a popular remote desktop application [3]. Avast has a detailed explanation of TeamSpy and its capabilities [4]. In this blog post, we will go over a recent malspam activity delivering TeamSpy to victim machines and will discuss how the activity looks in NetWitness Packets.

Submitting the delivery document NEW_price.xlsm to RSA pre-release What's This File service scores the maximum threat score:

The malicious spreadsheet has an auto-launch script to download a payload from a delivery domain:

When the victim enables the embedded macro, the download activity begins:

Here is the meta registered by NetWitness Packets for the download session:

Here is a list of files downloaded to the victim machine (all downloaded to the C:\ directory):

By dropping the malicious DLL in the same directory as the legitimate application, TeamSpy has a chance to load successfully and to run its payload. It uses a password to de-obfuscate the configuration file at run time in order to start communicating with its C2 server, which in this case is the same as the delivery domain:

Avast has a full list of those parameters in the query strings above [4] but here is some information:

• id: ID of the infected machine
• tout: timeout
• osbt: 32bit/64bit
• osv: OS version
• osbd: OS build version
• uname: user name
• cname: computer name
• tvrv: teamviewer version

Here is the meta registered by NetWitness Packets for the C2 communication:

Delivery document (SHA256):

• 00048ea8873518a5a17ddea0cfee0f1103bf56c07b89b287c6aa60e082d75f99

All the IOC from those HTTP sessions were added to RSA FirstWatch Command and Control Domains on Live with the following meta:

• threat.source = ‘rsa-firstwatch’
• threat.category = ‘malspam’
• threat.description = ‘delivery-domain’
  

References:

1. DLL Side-Loading - enterprise 
2. Dynamic-Link Library Search Order (Windows) 
3. https://www.teamviewer.us/products/teamviewer/ 
4. A deeper look into malware abusing TeamViewer