Cybercriminal Group FIN7 Updates Toolset

FIN7, a notorious cybercriminal group with significant resources that target the retail, restaurant and hotel industries, has been deploying new tools within their arsenal. Incident responders at FireEye's Mandiant released a post outlining two new tools - dubbed RDFSNIFFER and BOOSTWRITE. BOOSTWRITE is an in memory dropper for malware, and RDFSNIFFER is a malicious DLL that hijacks a remote administration client built by NCR Corporation.

Recommendations

Never click links or open attachments in suspicious email. FIN7 uses spearphishing to deliver payloads to their targets
Consider enabling ZeroFOX email security rules to detect indicators associated with this campaign
Blacklist file hashes, domains and URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed

Details

Recent incident response engagements performed by the company unveiled a number of these tools. BOOSTWRITE is an in-memory dropper used to deliver payloads, such as RDFSNIFFER. In-memory malware, also called 'fileless' malware, uses a technique where the malware carves out space within already-running processes and executes within the target process. BOOSTWRITE abuses DLL search orders for applications that load Dwrite.dll. This aims to find an application to first load the DLL, then execute the malware. Once executed, the malware reaches out to a hardcoded address and retrieves an encryption key to decrypt two additional payloads. The associated samples decrypts two payloads, a CARBANAK backdoor as RDFSNIFFER.

RDFSNIFFER is a payload that uses a similar DLL loading technique as BOOSTWRITE. Once the payload is delivered, the RDFSNIFFER DLL is loaded by NCR Corporations 'Aloha Command Center', a remote access tool. It also hooks a number of Win32 API functions to tamper with the Aloha Command Center. The tampering of the client includes intercepting communications, issuing arbitrary code execution commands on the victim machine as well as hijacking the client UI.

One of the BOOSTWRITE samples contained a signed binary by a valid certificate authority, or CA. This is consistent with FIN7 tactics, as they are known to use signed binaries from valid CA's to help reduce detection probabilities of their toolsets.

IOCs

MD5
==

a67d6e87283c34459b4660f19747a306
af2f4142463f42548b8650a3adf5ceb2

SHA1
==
a873f3417d54220e978d0ca9ceb63cf13ec71f84
09f3c9ae382fbd29fb47ecdfeb3bb149d7e961a1

SHA256
==
8773aeb53d9034dc8de339651e61d8d6ae0a895c4c89b670d501db8dc60cd2d0
18cc54e2fbdad5a317b6aeb2e7db3973cc5ffb01bbf810869d79e9cb3bf02bd5

C2s
==
109.230.199.227

Threat Feed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/105/list_indicators/