Let’s Learn (DIY): Sophisticated Cobalt Strike Gang’s CVE-2017-0199 Loader

Goal: Reverse the first stage loader RTF CVE-2017-0199 loader used by Cobalt Strike gang targeting Russian-speaking financial institutions. This loader’s been seen in conjunction with the Microsoft Word Intruder 8.0.
Source: @xdxdxdxdoa
Tool: rtfdump 0.5, ILspy
CVE-2017-0199: Exploit that allows “remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API” [source].
Observed unique filename:

• Пеня по задолженности.doc -> “Debt collection notification.doc” (from Russian to English)
• Заявление на расторжение договора.doc -> “Application for contract closure.doc” (from Russian to English)

• I. Command: python2.7 rtfdump.py file.rtf

• II. Command: python2.7 rtfdump.py -f O file.rtf

• III. Command: python2.7 rtfdump.py -s 8 file.rtf | more (on the 8 field found in the previous step)

• IV. Command: python2.7 rtfdump.py -s 8 -H file.rtf 

• V. Command: python2.7 rtfdump.py -s 8 -H -i file.rtf 

Name: ‘Package\x00’ Position embedded: 00000020 Size embedded: 0005339f md5: a9039264caf3285bf968849bf84ad951 magic: 02007e57

With option -E, we can extract the embedded object:

• VI. Command: python2.7 rtfdump.py -s 8 -H -E -d file.rtf > binary.exe

The payload is written in Microsoft Visual C# / Basic .NET titled “ExecPS.” Using ILspy, we decompile the embedded binary. The embedded binary has a PDF icon and an internal name as “ExecPS[.]exe.”

p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 8.5px Helvetica}