Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware

A new wave of active DarkGate malware exploits a vulnerability in Windows Defender SmartScreen has now been upgraded, with the ability to bypass security checks and automatically install fake software installers plating on the target system.

SmartScreen is a Windows security feature that displays a warning when users try to run unrecognized or suspicious files downloaded from the internet. The vulnerability tracked, identified as CVE-2024-21412, is an issue in Windows Defender SmartScreen that allows specially crafted downloads to bypass security warnings from the company. this tool.

Attackers could exploit the vulnerability by creating a Windows Internet shortcut (.url file) that points to another .url file stored on a remote SMB share. This will cause the file in the last location to be executed automatically.

CVE-2024-21412 was patched by Microsoft in mid-February, but it seems that this update has not really been fully applied. Previously, Trend Micro revealed that a group of financial hackers nicknamed Water Hydra successfully exploited this vulnerability as a zero-day to spread their DarkMe malware into the systems of traders. pandemic.

Today, Trend Micro analysts continue to issue an urgent announcement that those behind the DarkGate malware are deploying a new wave of attacks, exploiting similar vulnerabilities to improve the chances of successful infection. attacks on targeted systems.

Details of the DarkGate attack

The attack begins with a malicious email that includes a PDF attachment containing a link that uses open redirects from Google's DoubleClick Digital Marketing (DDM) service to bypass email security checks.

When victims click on the link, they are redirected to a web server that hosts an internet shortcut file. This shortcut file (.url) in turn links to a second shortcut file hosted on a WebDAV server controlled by the attacker.

Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware Picture 1

Using a Windows Shortcut to open a second Shortcut on a remote server effectively exploits the CVE-2024-21412 vulnerability, causing a malicious MSI file to automatically execute on the device.

Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware Picture 2

These MSI files are masqueraded as legitimate NVIDIA software, Apple iTunes or Notion applications.

When executing the MSI installer, another DLL loading vulnerability involves the file "libcef.dll" and a loader named "sqlite3.dll" that decodes, and executes the DarkGate malware payload on the system .

Once initialized, malware can steal data, fetch additional payloads and inject them into running processes, perform key logging, and grant attackers access from away in real time.

The complex and multi-step infection chain used by DarkGate exploiters since mid-January 2024 is summarized in the diagram below:

Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware Picture 3

Trend Micro said this campaign used DarkGate version 6.1.7. Compared to the older version 5, version 6 features XOR-encoded configuration, new configuration options, and updates to command and control (C2) values.

The configuration parameters available in DarkGate 6 allow operators to define various operational tactics and evasion techniques, such as allowing persistent booting or specifying disk storage capacity and size. Minimum RAM to avoid analysis environment.

Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware Picture 4

Currently, the only option to mitigate the risk from these attacks is to apply Microsoft's February 2024 Patch Tuesday update to fix the bug CVE-2024-21412.

Lesley Montoya

Update 16 March 2024

You should read it

May be interested

Detecting a Google Drive vulnerability could allow hackers to trick users into installing malware
an unresolved security weakness in google drive can be exploited by software attackers to distribute malicious files.
Wi-Fi Vulnerability Leads to FragAttacks Attacks
attackers have exploited the wifi vulnerability to perform data theft and spread malicious code that affects the device.
Detects a vulnerability that threatens all Windows computers shipped from 2012 up to now
security researchers have found a vulnerability in the microsoft windows platform binary table (wpbt). this vulnerability can be exploited by hackers to install rootkits on all windows computers shipped from 2012 to the present.
Hacker exploited three vulnerabilities in Microsoft Office to spread Zyklon malware
security researchers have discovered a botnet spread of malware through at least three new vulnerabilities published in microsoft office.
Some simple tricks to deal with Malware
malware seems to become more and more intelligent and causes more incalculable consequences than before. installing malware detection tools (malwarebytes, hijackthis, combofix ...) on the computer is not a redundant task. but in some cases, for many reasons (blocked by malware itself) these tools are
Use Nepenthes Honeypots to detect common malware
over the past few years, a large number of serious bugs in the windows operating system have been discovered. like ms03-026, exploited and dispersed by the blaster worm in 2003; or lately is mocbot / wargbot worm, exploiting the ms06-040 vulnerability from
Detects Zero-Day vulnerabilities on Windows PC operating systems that allow administrative rights
security firm kaspersky (russia) has discovered a zero-day vulnerability on pc operating systems that has been exploited and exploited by hackers for a long time to control all systems running on the platform.
Cisco launched a technology to identify malicious code on encrypted traffic
cisco has released encrypted traffic analytics (eta), a breakthrough technology that detects malware on encrypted network traffic without interfering with or decrypting data.
Patches of dangerous vulnerabilities being exploited by hackers contain dangerous holes and then continue to be exploited by hackers
not long after the log4j vulnerability was discovered, the patch was released. however, the irony is that this patch has holes.
The unpatched Microsoft Word DDE vulnerability is exploited in a massive malware attack
a new attack method that exploits the microsoft office integration feature has been discovered being used for malware distribution campaigns.

Detection of Windows SmartScreen vulnerability being exploited to spread DarkGate malware

Details of the DarkGate attack

You should read it

May be interested

Attack the network