Seamless Campaign Leads to RIG EK at 92.222.48.83 and Drops Ramnit

The infection vector for this Ramnit compromise was RIG exploit kit. The user was redirected to the exploit kit via a malvertising chain using the Seamless campaign. The Seamless campaign has been dropping Ramnit for awhile now. You can read more about the Seamless campaign HERE.

The referer used for this infection was the Seamless gate at 194.58.40[.]252/signup1[.]php. The response from the gate included the following iframe:

The iframe contained the URL for the RIG exploit kit landing page.

Below is an image of some network traffic being filtered in Wireshark:

HTTP and DNS traffic. DNS queries for remote C&C domains generated by DGA.

Payload dropped in %Temp%, as well as additional copies:

Another copy of the malware is placed in newly created subfolder located in %AppData%:

Artifacts relating to the modules are found in %AppData%:

Additional artifact located in ProgramData:

Writes to a start menu file:

Registry:

HKCUSoftwareAppDataLow {guid}
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

Additional Network Based IOCs

Network Traffic:

• 178.21.10.156 – bestcasinomarket.info – GET /usa
• 194.58.40.252 – GET /signup1.php – Seamless gate
• 92.222.48.83 – RIG EK
• 142.4.204.195 – fkbpvfnbhfwedagussg.com – Ramnit C2 traffic via port 443
• 62.173.141.41 – gssbjwhoose.com – Ramnit C2 traffic via port 443

C2 traffic to the valid generated domains.

Hashes:

SHA256: c18a3c9bb7dd8548b782c156a30fcb5fb642a0562c52544f4b91bbb5ea1e164e
File name: RigEK landing page.txt

SHA256: 0f0517c0a25f377b156943ee0f39630c98ce6cf23d8c163323d56131168c7f00
File name: RigEK Flash exploit.swf

SHA256: f08ddaa74bd4c5b9a4761812b713aa12697547d1da75da0ce364859239a20a1f
File name: o32.tmp

SHA256: aaf61372042ffd4c6de3d2568c293d36a24e10241773220446c40e7d2be59e56
Hybrid-Analysis Report
File name: xl4tv1do.exe

Downloads [pass is “infected”]

Landing page and Flash exploit.zip

References

1. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32-ramnit-analysis.pdf
2. https://www.virusbulletin.com/virusbulletin/2012/11/ramnit-bot

• Category: Exploit Kit
• Tag: DGA, IOCs, Malvertising, Ramnit, Rig Exploit Kit, Seamless Campaign

Published by malwarebreakdown

Just a normal person who spends their free time infecting systems with malware. View all posts by malwarebreakdown