{"id":118,"date":"2019-04-02T09:50:37","date_gmt":"2019-04-02T07:50:37","guid":{"rendered":"https:\/\/192.168.10.2\/blog\/?p=118"},"modified":"2021-10-06T16:21:38","modified_gmt":"2021-10-06T14:21:38","slug":"wirte-group-attacking-the-middle-east","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/wirte-group-attacking-the-middle-east\/","title":{"rendered":"WIRTE Group attacking the Middle East"},"content":{"rendered":"\n

The Intelligence Development Group of S2 Grupo<\/a>\n has carried out an investigation on an actor from whom LAB52 has not \nbeen able to find references or similarities in open sources and who has\n been identified as WIRTE<\/strong>.<\/p>\n\n\n\n

The DFIR (Digital Forensics and Incident Response) team of S2 Grupo \nfirst identified this actor in August 2018 and since then the follow-up \nhas been carried out during the last few months.<\/p>\n\n\n\n

This group attacks the Middle East and does not use very \nsophisticated mechanisms, at least in the campaign started in August \n2018 which was monitored. It is considered unsophisticated by the fact \nthat the scripts are unobtrusive, communications go unencrypted by HTTP,\n they use Powershell (increasingly monitored), and so on. Despite this \napparently unsophisticated modus operandi compared to other actors, they\n manage to infect their victims and carry out their objectives. In \naddition, as will be seen during the report, the detection rate of some \nof the scripts in December 2018 by the main antivirus manufacturers is \nlow, an aspect that must be highlighted. We must be aware that once \nthese scripts are executed, it is when the behavior analysis of many \nsolutions will detect them, but this fact has not been studied by LAB52.<\/p>\n\n\n\n

This actor in all the artifacts analyzed shows his victims a decoy \ndocument in Arabic with different themes. During the report these \ndocuments will be analyzed and who could be the objectives depending on \nthe topic dealt with in the document.<\/p>\n\n\n\n

Technical analysis<\/h3>\n\n\n\n

As indicated above, during the month of August 2018 S2 Grupo CERT we \nmanaged an incident aimed at the diplomacy of different Middle Eastern \ncountries.<\/p>\n\n\n\n

The attackers used a malware made in Visual Basic Script (VBS) as a \ntool to control the victim. Starting from the study of this VBS from S2 \nGrupo CERT, the monitoring of this group was started, finding in other \nsources other artifacts from the same group but with different decoy \ndocuments and with different strategies of execution, persistence, and \nso on. S2 Grupo does not have enough information to make any type of \nattribution or authorship. It is associated that these artifacts are \nrelated because they reflect similarities from a technical and temporal \npoint of view and because of the decoy documents used, since sometimes \nthey are identical.<\/p>\n\n\n\n

One aspect observed during the investigation is that the attackers \nafter running the VBS used it as an Empire post-exploitation framework (https:\/\/github.com\/EmpireProject\/Empire<\/a>).<\/p>\n\n\n\n

A total of five scripts plus the one involved in the incident could \nbe collected. Below we detail the main characteristics of each.<\/p>\n\n\n\n

Script 1: 617bbc71e5f0a645cbb8eeb6d4a1ece96ba0860c8ab5deda6a795e6ad244607a<\/h4>\n\n\n\n

This first file can be seen in Virus Total and has a low detection (4\/58). The last analysis took place on 12\/12\/2018.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

In this case the file was uploaded from Palestine to Virus Total:<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

In the image you can see that it was uploaded through the web, from \nPS (Palestine) and also that it was uploaded for the first time on 5 Aug. 2018<\/strong>.<\/p>\n\n\n\n

Network communication occurs over HTTP to the micorsoft[.]store<\/strong> domain to TCP\/2082 port. This domain since it exists has resolved to the following ip addresses:<\/p>\n\n\n\n