CHM Malware Disguised as North Korea-related Questionnaire (Kimsuky)

AhnLab Security Emergency response Center (ASEC) has recently discovered a CHM malware which is assumed to have been created by the Kimsuky group. This malware type is the same as the one covered in the following ASEC blog posts and the analysis report on the malware distributed by the Kimsuky group, its goal being the exfiltration of user information.

The CHM file has been compressed and is being distributed as an email attachment. The first email that is sent pretends to be an interview request about matters related to North Korea. If the email recipient accepts the interview, then a password-protected compressed file is sent as an attachment. Not only is this email pretending to be a North Korea-related interview identical to the one previously analyzed, but it also follows the same format of sending the malicious file only when a recipient replies to the email.

Figure 1. Distributed email

Figure 2. Original email

Figure 3. Inside the compressed file

When the InterviewQuestionnaire(***).chm file is executed, a help document with actual questions appears as shown below, making it difficult for users to realize that the file is malicious.

Figure 4. CHM disguised as a questionnaire

The CHM holds a malicious script, and, like the CHM malware covered before, it uses a shortcut object (ShortCut). The shortcut object is called through the Click method and the command in Item1 is executed. The command executed through ‘InterviewQuestionnaire(***).chm’ is as follows.

  • Executed Command
    cmd, /c echo [Encoded Command] > “%USERPROFILE%\Links\Document.dat & start /MIN certutil -decode “%USERPROFILE%\Links\Document.dat” “%USERPROFILE%\Links\Document.vbs” & start /MIN REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Document /t REG_SZ /d “%USERPROFILE%\Links\Document.vbs” /f’

Figure 5. Malicious Script within CHM

Thus, the encoded command is saved to %USERPROFILE%\Links\Document.dat when the CHM is executed. The command that has been decoded by Certutil is saved to %USERPROFILE%\Links\Document.vbs. The threat actor also registered Document.vbs to the Run key (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) to ensure the malicious script would run persistently. Ultimately, Document.vbs executes the PowerShell script in hxxp://mpevalr.ria[.]monster/SmtInfo/demo.txt.

Figure 6. (Top) A portion of Document.vbs’s code / (Bottom) A portion of the vbs code uncovered in a past report

The URL that Document.vbs connects to is currently unavailable, but a script assumed to have been downloaded from this address has been found. The confirmed script file is responsible for intercepting a user’s key inputs before saving them in a certain file and sending that file to the threat actor. In addition to reading the caption of the currently running ForegroundWindow and keylogging, it periodically checks the clipboard contents and saves them to the %APPDATA%\Microsoft\Windows\Templates\Pages_Elements.xml file. Afterward, it sends this file to hxxp://mpevalr.ria[.]monster/SmtInfo/show.php.

Figure 7. (Top) A portion of demo.txt / (Bottom) A portion of the PowerShell script code from a past report

As can be seen from Figure 6 and Figure 7, Document.vbs (VBS script file) and demo.txt (PowerShell script file) have the same format as the malware that was analyzed in the ‘Analysis Report on Malware Distributed by the Kimsuky Group’ published on ATIP last year. With this in mind, users should take extreme caution as the Kimsuky group appears to be distributing phishing emails with malware strains in various forms like Word files and CHM.

[File Detection]
Dropper/CHM.Generic (2023.03.07.00)
Data/BIN.Encoded (2023.03.07.00)
Downloader/VBS.Agent.SC186747 (2023.03.07.00)
Trojan/PowerShell.Agent.SC186246 (2023.02.09.00)

[Behavior Detection]

726af41024d06df195784ae88f2849e4 (chm)
0f41d386e30e9f5ae5be4a707823fd78 (dat)
89c0e93813d3549efe7274a0b9597f6f (vbs)


Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.

The post CHM Malware Disguised as North Korea-related Questionnaire (Kimsuky) appeared first on ASEC BLOG.

Article Link: