SparrowDoor

the compromised network revealed not one, but two previously undocumented versions of SparrowDoor... Both of these versions of SparrowDoor constitute marked progress over earlier ones...

In order to gain initial access to the affected network, FamousSparrow deployed a webshell on an IIS server. While we were unable to determine the exact exploit used to deploy the webshells, both victims were running outdated versions of Windows Server and Microsoft Exchange, for which there are several publicly available exploits.

ESET's experts found that the China-aligned cyberespionage outfit has hit its targets with two previously undocumented versions of their flagship backdoor called SparrowDoor. Importantly, the group was also observed using the ShadowPad backdoor for the first time.

In the cases we observed, this was used to spawn an interactive remote PowerShell session. Once this session was established, attackers used legitimate Windows tools to obtain information about the host and the Active Directory domains to which it was joined.

First, the backdoor sends back an acknowledgment message... It then spawns a cmd.exe process and uses a pair of threads and named pipes to relay commands and their output between the C&C server and the shell.

MITRE ATT&CK techniques ... SparrowDoor uses the CreateProcess API to launch an interactive shell.

Additionally, the same approach was used for both: leveraging a legitimate executable file vulnerable to DLL search-order hijacking, which would load a malicious DLL dropped into the same path as the legitimate executable.

When executed without any arguments, the malware establishes persistence. It first tries to do so by creating a service named K7Soft that is set to run automatically on startup.

If this fails, a registry Run key with the same name is used instead.

When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.

Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .

When executed without any arguments, the malware establishes persistence. It first tries to do so by creating a service named K7Soft that is set to run automatically on startup.

If this fails, a registry Run key with the same name is used instead.

When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.

Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .

The script contains a base64-encoded .NET webshell that it writes to C:\users\public\s.txt . It then decodes it using certutil.exe and saves the decoded output to C:\users\public\s.ashx .

MITRE ATT&CK techniques ... SparrowDoor launches the process into which it injects the loader, with its window hidden.

Additionally, the same approach was used for both: leveraging a legitimate executable file vulnerable to DLL search-order hijacking, which would load a malicious DLL dropped into the same path as the legitimate executable.

Plugins are sent by the server as PE files and are never stored on disk... After such a plugin is received, it is manually mapped in memory and its fmain export is called.

0x32341132 List files. Directory path. File information, one response per file.

Information about the host machine is sent automatically after the initial connection message and includes a list of installed security products in addition to what was sent in previous versions.

MITRE ATT&CK techniques ... FamousSparrow transferred SparrowDoor to other machines on the network.

The resulting plaintext is the C&C server configuration, which consists of three pairs of addresses and ports... After loading this configuration, the backdoor will try to connect to the first server... then the next server, and so on.

The threat actor initially downloaded a batch script over HTTP from a download server... They then downloaded PowerHub... Finally, the attacker used PowerShell’s built-in Invoke-WebRequest to download three files from the same server.

SparrowDoor uses raw TCP sockets to communicate with its C&C server.

They then downloaded PowerHub, an open-source post-exploitation framework, from an attacker-controlled server... Finally, the attacker used PowerShell’s built-in Invoke-WebRequest to download three files from the same server that comprise SparrowDoor’s trident loader.

On the network communication side, the command header is sent separately from the body and that data is RC4 encrypted with the hardcoded key iotrh^%4CFGTj .