{"id":1321,"date":"2022-06-21T11:00:23","date_gmt":"2022-06-21T09:00:23","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=1321"},"modified":"2022-07-26T09:50:57","modified_gmt":"2022-07-26T07:50:57","slug":"muddywaters-light-first-stager-targetting-middle-east","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/muddywaters-light-first-stager-targetting-middle-east\/","title":{"rendered":"MuddyWater’s “light” first-stager targeting Middle East"},"content":{"rendered":"\n

Since the last quarter of 2020 MuddyWater has maintained a “long-term” infection campaign targeting Middle East countries. We have gathered samples from November 2020 to January 2022, and due to the recent samples found, it seems that this campaign might still be currently active. The latest campaigns of the Muddy Water threat group, allegedly sponsored by the Iranian government and linked to the Iranian revolutionary guard (the main armed forces of the Iranian government), could be framed within the dynamics of maintaining Iran’s regional sovereignty.<\/p>\n\n\n\n

This infection campaign always starts with a compressed file wrapping a malicious Word document containing VBA macros.<\/p>\n\n\n\n

\"\"
Malicious document sample<\/figcaption><\/figure><\/div>\n\n\n\n

While our oldest sample looks a little more sophisticated based on the content of the document, which seems more specifically crafted for Arabic speakers as shown in the previous image, the rest of them contain generic English message to enable macros.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"
Malicious document<\/em> sample<\/figcaption><\/figure><\/div>\n\n\n\n
\"\"
Malicious document<\/em> sample<\/figcaption><\/figure><\/div>\n\n\n\n

Although it has not been possible to clearly identify their specific target, it has been observed that these campaigns have been directed against countries such as Pakistan, Kazahstan, Armenia, Syria, Israel, Bahrain, Turkey, South Africa, Sudan, etc. Many of these countries may be of interest to the alleged Iranian threat actor, as some of them have been involved in recent internal conflicts, or are implicated in nuclear energy improvement, or may serve as strategic footholds for the development and influence of Iranian interests in other parts of the world.<\/p>\n\n\n\n

The macros are very concise and their only purpose is to write a not-so-much obfuscated VBS script into a file located in C:\\ProgramData or the Windows Startup folder, with names such as Temp_[3-5 random chars].txt.<\/p>\n\n\n\n

\"\"
Malicious VBA macro code<\/figcaption><\/figure><\/div>\n\n\n\n

The dropped script is a small RAT which allows to execute commands via cmd. It first calls a recon function which executes whoami, and sets a country code which is already present in the script. The result of this will then be part of the URI used for the C2 contact. The set of different country codes found in the gathered samples are the following, and might indeed reveal the targets for each campaign:<\/p>\n\n\n\n