CinaRAT Resurfaces With New Evasive Techniques

Introduction

In this post, we cover the CinaRAT loader's evasive tactics, techniques, and procedures (TTPs), as identified and prevented by Morphisec’s zero-trust endpoint security solution powered by Moving Target Defense technology. 

We review different versions of multi-staged loaders that attempt to inject and execute CinaRAT within a victim’s host memory. CinaRAT code is available on GitHub for download; generally it's just a rebranded QuasarRAT. 

We focus on the evasive components that allowed attackers to sustain zero detection for such a long period of time (VirusTotal).

Technical Analysis

First stage: ISO/VBS script

Our investigation begins with a Visual Basic script identified in a customer environment. We observed its delivery through an ISO archive file.

The script implements reflective loading, persistence, and evasion functionality. 

The first step is a reflective loading of a remote .NET DLL executable, usually from a GitHub user account represented by an image download.

Figure 1:The image download

As soon as the image is downloaded and loaded into memory, it's written into a startup folder using an advanced method:

In order to copy itself into the autoruns, the script calls “NameSpace(7).Self.Path” which retrieves the autoruns path. This is a unique technique which isn’t often used for malware delivery.

Figure 2: NameSpace(7) usage

The obfuscation method for each version is different. Within each version the attacker changes the comment line in each code line so they can avoid hash detection.

Figure 3: Comment as a dynamic artifact

An interesting note is that the string technique utilized in the “GMR” variable evades VirusTotal when it is parsed.

Figure 4: VirusTotal content parsing

These are the main changes between Visual Basic script versions:

• Obfuscation, mainly splitting strings:

Figure 5: Part of a split string

• “If” condition within the Powershell in order to validate the payload was successfully downloaded
• Different payloads with different URLs

The following table lists a few examples that correlate between the URL download domain to the file path saved within the victim host along with our internal version numbering.

Second stage: .NET loader

As described in a previous stage, the Visual Basic script delivers a second .NET file.

The purpose of this .NET file is to decode the final stage .NET CinaRAT payload and inject it into a legitimate Windows process using process hollowing. This is done with several evasion techniques in order to avoid detection and AI. 

The RAT payload resides in a base64 encoded string that, during the execution, is decoded and XORed with string as the key. Once the .NET DLL decodes the RAT, it hollows legitimate images in memory and injects it.

Figure 6: The XOR decoding routine in V2

We observed four different versions along with four subversions between December 8, 2020, and February 2, 2021. The attacker updated the evasion techniques from version to version in order to avoid detection.

The following table lists the different internal versions along the with first seen date either from the attacker’s GitHub or VirusTotal submission.

Code Pattern

In each version the code pattern is different but eventually, the execution flow stays the same except for minor changes. Here are a few examples:

• The called method convention is the same in all of the versions (axx.bxx.cxx()) except V4 ([WorkArea.Work]::Exe()).
• In V1 and V2, the encoded base64 string is loaded from a variable, while in V3 and V4 it’s loaded from a bunch of functions joined together to form the string. 
• The XOR key is the same in all of the versions except in V4.

Figure 7: Encoded payload chunk from V4.1

Code Obfuscator

The attacker obfuscated the code using an unregistered version of Eziriz .NET Reactor, although in V2 and V3 it seems they either switched to a registered version or discarded the remnant code as the following script was not there anymore. In V4 the attacker did not implement any obfuscator, but in V4.1 the obfuscation was implemented again with the “unregistered” remnant code.

Figure 8: Fingerprint string

Code Masquerading

From V1.1, the attacker added legitimate namespaces from popular .NET libraries to the loader. This evasion technique tries to disguise the loader as a legitimate .DLL in order to avoid analysis. It's also possible this technique can bypass AV solutions that implement whitelist rules on chunks from those .NET libraries. The following table lists a few examples of libraries that were used.

Figure 9: Some of the namespaces in V2

Analyzing the submission dates and the first detection dates on all of the loaders in VirusTotal suggests the code masquerading technique succeeds in bypassing AV solutions.

Third stage: RAT Payload

We have observed four different versions of RAT payloads. The first one used was QuasarRAT 1.4, while later on CinaRAT 1.0.1.1 was used instead with some modifications. For the C2 domain, the attacker mostly used a dynamic DNS service from myq-see[.]com

The following table correlates the observed RAT version with the C2 domain and Loader version.

Figure 10: RAT configuration example from V4.1

Conclusion

Morphisec prevents CinaRAT attacks with a zero-trust default-deny approach to endpoint security, powered by Automated Moving Target Defense. Morphisec customers are thus protected from CinaRAT, regardless of the evasive techniques an attacker deploys to bypass EDR and NGAV solutions.  

IOCs