Summary

A Ukraine based Account Firm, Crystal Finance Millennium (CFM), has been hacked and is found to be distributing malware, which could be part of an attack in a larger scale. This caused the firm to take down their own website to prevent further spreading of damage.

Infection Chain

1. Attacker sends phishing email containing Zip files with JavaScript Files.
2. The JavaScript files will download load.exe from CFM's compromised web server.
   • URL: http[:]//cfm.com[.]ua/awstats/load.exe
   • IP Address: 194.28.172[.]73
3. Once load.exe triggers, it creates a copy of itself and downloads additional executable files. Below are the Indicators-of-Compromise (IOCs):
   • http[:]//finishirenemoflexvathard[.]com/filesok/443.exe
   • finishirenemoflexvathard[.]com
   • 47.88.52.220
   • 46.20.33.219
   • C:\Users\%имя пользователя%\AppData\Roaming\Microsoft\fbufwrbe\siaeesws.exe
   • C:\Users\%имя пользователя%\AppData\Roaming\Microsoft\fbufwrbe\fbufwrbe
   • C:\Users\%имяпользователя%\AppData\Roaming\Microsoft\Windows\dllcache\logagent.exeC:\Users\%имя пользователя%\AppData\Roaming\Microsoft\Windows\dllcache\RCX4012.tmp
   • C:\Users\%имяпользователя%\AppData\Roaming\Microsoft\Windows\dllcache\RCX4497.tmp
   • C:\Users\%имя пользователя%\AppData\Roaming\Microsoft\Windows\StartMenu\Programs\Startup\logagent.lnk
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jack1024 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\logagent
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\logagent
4. According to an ISSP report, load.exe along with the additional downloaded files were designed to attack various banking client`s applications.