Analyzing the Awaken Likho APT group implant: new tools and techniques

Introduction

In July 2021, a campaign was launched primarily targeting Russian government agencies and industrial enterprises. Shortly after the campaign started, we began tracking it, and published three reports in August and September 2024 through our threat research subscription on the threat actor we named Awaken Likho (also named by other vendors as Core Werewolf).

While investigating the activity of this APT group, we discovered a new campaign that began in June 2024 and continued at least until August. Analysis of the campaign revealed that the attackers had significantly changed the software they used in their attacks. The attackers now prefer using the agent for the legitimate MeshCentral platform instead of the UltraVNC module, which they had previously used to gain remote access to systems. The group remains focused on targeting Russian government organizations and enterprises.

Technical details

During the investigation, using our Yara rules, we identified a new implant that we hadn’t seen previously in this group’s arsenal. Based on our telemetry, we concluded that the implant was delivered to victims’ devices via a malicious URL, likely obtained through phishing emails. Awaken Likho operators typically use search engines to gather as much information as possible about their victims and prepare convincing messages. We weren’t able to obtain the original phishing emails used to distribute this implant, but email attachments in previous campaigns included self-extracting archives (SFX) and links to malicious modules. In addition, previous attacks used Golang droppers to deliver malware – we didn’t find evidence of this in the current activity. However, the main difference in the implant we analyzed lies in a new method of gaining and maintaining control over the infected machine. For several years, we observed the use of the UltraVNC module to gain remote access to systems, but in this campaign, the attackers used MeshAgent, an agent for the MeshCentral system. As stated on the official MeshCentral website, this is an open-source remote device management solution with extensive functionality.

We discovered the new type of implant in September 2024, and our telemetry indicates that the attackers began using this software in August 2024. So now, let’s analyze this implant in detail.

Unpacking the archive

As in previous campaigns, the implant is packed using UPX and distributed in a self-extracting archive (SFX), created using 7-Zip, as indicated by its metadata. To continue the analysis, we must unpack it.

Implant metadata

The archive contains five files, four of which are disguised as legitimate system services and command files.

Implant archive contents

The remaining CMD file (the last one in the screenshot above) has a non-descriptive, randomly generated name. In previous implants we analyzed, most files were named in this way. What’s more, some files contained no payload and were added to the archive solely to mislead users. We will analyze all the files from the archive, but first, let’s open it in “#” mode. This is a special parser mode in 7-Zip, used for analyzing files to gather additional information about the archive, including the installation script.

Opening an archive in “#” mode from the archiver context menu

Contents of the archive opened in “#” mode

To determine how the implant persists in the system, we extract the installation script named “2” from the archive.

SFX archive installation script

As seen in the script code, the SFX module extracts all components of the archive into a temporary directory and runs
MicrosoftStores.exe without parameters.

AutoIt script

The next step in the attack is to execute
MicrosoftStores.exe. This sample is also packed using UPX.

Having unpacked the file, we see that it contains a compiled AutoIt script with an interpreter – this is indicated by a snippet in the file’s code starting with
AU3!. The presence of this script explains why the file was executed without parameters after extraction.

We managed to extract the decompiled AutoIt script, which was obfuscated.

Extracted AutoIt script

After manually deobfuscating it, we can determine the purpose of the script: it launches
NetworkDrivers.exe and
nKka9a82kjn8KJHA9.cmd with the specified parameters to ensure persistence in the system.

Contents of AutoIt script after deobfuscation

Payload

NetworkDrivers.exe

Next, we examine the first executable launched by the script,
NetworkDrivers.exe.

Our products detect this sample with the verdict not-a-virus:HEUR:RemoteAdmin.Win32.MeshAgent.gen. Indeed, this is MeshAgent, the agent for the legitimate MeshCentral platform, which the attackers started using instead of UltraVNC.

nKka9a82kjn8KJHA9.cmd

The AutoIt script then launches the command file
nKka9a82kjn8KJHA9.cmd with specified parameters.

It’s important to note that this script has an unusually large size – over 1 MB. The reason is simple: it’s heavily obfuscated.

Part of the obfuscated contents of nKka9a82kjn8KJHA9.cmd

Despite the large amount of code, the obfuscation technique is quite simple: the attackers use large filler text blocks. During script execution, the interpreter skips the meaningless text using labels with the
GOTO command.

We were able to easily deobfuscate this file.

nKka9a82kjn8KJHA9.cmd after manual deobfuscation

The purpose of this command file is to create a scheduled task named
MicrosoftEdgeUpdateTaskMachineMS. This task runs
EdgeBrowser.cmd from the unpacked archive and deletes certain files related to malicious activity, such as the first-stage executable
MicrosoftStores.exe. This makes it harder to detect the attackers.

EdgeBrowser.cmd

The command file from the previous stage creates a task to run the
EdgeBrowser.cmd script.

EdgeBrowser.cmd

This script launches
NetworkDrivers.exe (the MeshAgent agent) using PowerShell to interact with the C2 server.

These actions allow the APT to persist in the system: the attackers create a scheduled task that runs a command file, which, in turn, launches MeshAgent to establish a connection with the MeshCentral server.

NetworkDrivers.msh

There is another file in the archive named
NetworkDrivers.msh. This is the configuration file for MeshAgent. We also found its contents in the code of the
NetworkDrivers.exe.

MeshAgent configuration file contents

This file specifies the agent’s parameters for establishing a connection with the MeshCentral server: MeshName, MeshID, ServerID, and the C2 address, connecting via the WebSocket protocol. When opening this address via HTTPS, the following window appears – the login form for the MeshCentral platform.

MeshCentral platform login interface

This confirms that the attackers used the legitimate MeshCentral system to interact with the C2 server.

Victims

The primary victims of this attack were Russian government agencies, their contractors, and industrial enterprises.

Attribution

Based on the TTPs used and the information about the victims, we assume with high confidence that the threat actor is the APT group Awaken Likho.

Takeaways

Awaken Likho is one of the threat actors that ramped up its activity after the start of the Russo-Ukrainian conflict. Recently, the group’s methods have changed significantly; for example, they have begun using MeshCentral instead of UltraVNC. The APT is still active – we’ve seen fresh implants dated August 2024. It’s worth noting that the implant analyzed in this article does not contain the payload-free files we observed in previous samples. Clearly, this is a new version of the malware, which is still in development. We believe we will see new attacks from the Awaken Likho operators. We are convinced that the group continues to successfully infiltrate their selected targets’ infrastructure.

Such attacks once again stress the importance of a comprehensive solution to ensure continuous protection of corporate resources, especially in the face of evolving threats.

Indicators of compromise

603eead3a4dd56a796ea26b1e507a1a3
deae4a955e1c38aae41bec5e5098f96f
892c55202ce3beb1c82183c1ad81c7a0
63302bc6c9aebe8f0cdafdd2ecc2198a
912ebcf7da25c56e0a2bd0dfb0c9adff
c495321edebe32ce6731f7382e474a0e

Domain
kwazindernuren[.]com

IP address
38.180.101[.]12

Malicious task name
MicrosoftEdgeUpdateTaskMachineMS