Malicious Inauthentic Falcon Crash Reporter Installer Delivers LLVM-Based Mythic C2 Agent Named Ciro

On July 24, 2024, an unattributed threat actor distributed a password-protected installer masquerading as an inauthentic Falcon Crash Reporter Installer to a German entity in an unattributed spear-phishing attempt.

Subsequent analysis revealed that executing the installer with the threat actor-provided password leads to a novel execution chain in which an agent written to the Mythic command-and-control (C2)1 framework is executed as LLVM Intermediate Representation (IR) bitcode. The installer executes the agent using an LLVM interpreter, which is included in the installer archive.

This activity is highly likely targeted, and the malware used is highly likely above average in sophistication. These assessments are based on observed social-engineering, infection-chain and malware implementation.

Initial Access

The threat actor gained initial access to the victim by placing a phone call in which the actor impersonated a member of the company’s internal IT team and asked the victim to download an inauthentic Falcon Crash Reporter. The threat actor spoke fluent German and communicated professionally, suggesting that they are experienced in social engineering. The installer prompts the victim to input a “Backend-Server” (Figure 1).

Figure 1. URL check

CrowdStrike Intelligence verified that the installer did not perform any connectivity checks. The backend-server input is used as a social-engineering pretext for entering a password. The threat actor-provided password uses the pattern crowdstrike.{German Entity}.de:35294, which mimics a legitimate domain, almost certainly to make the social-engineering attempt appear legitimate. Once the victim has entered the password correctly, a screen appears stating the setup is ready to install (Figure 2).

Figure 2. Message presented to victim following correct password input

When the victim clicks “Installieren,” the installer writes the files csmon8.dat and Java8Runtime.exe in the directory %LOCALAPPDATA%\Java\, executing the InnoSetup installer install_script.iss. Finally, the installer presents a screen showing the victim the installation was successful (Figure 3).

Figure 3. Install page indicating installation was successful

Decoy Page

The InnoSetup script creates a shortcut in the Startup folder named Microsoft Edge, which opens the Microsoft Edge browser. The HTML page presented to the user, which is passed using the command-line argument --app, resembles an inauthentic loading screen. This screen closes the browser window once the page has finished loading. The inauthentic loading page depends on JavaScript (JS) from the URL https[:]//www[.]warnmelderzentrale[.]com/jquery.min.8ac34787.js?v=8. However, as of this writing, the site is no longer serving the JS file. Figure 4 provides the code for the inauthentic loading page.

Figure 4. Inauthentic loading screen using Microsoft Edge browser

The JS served by www[.]warnmelderzentrale[.]com was likely the code used to display an inauthentic loading animation.

LLVM Bitcode Execution

The InnoSetup script creates another shortcut in the Startup folder called System Health Monitor, which executes Java8Runtime.exe as a minimized window. This executable is a slightly modified version of the LLVM interpreter (lli)2 with the filename changed within the command-line help text. However, the command-line option flags remain identical.

The LLVM IR bitcode, which is contained within the csmon8.dat file, is executed using the LLVM interpreter with the entry function set to run. Figure 5 shows the parameters for the bitcode.

Figure 5. LLVM IR bitcode parameters

The threat actor created the LLVM IR bitcode by compiling a custom C++ agent with LLVM for the Mythic C2 framework.3

Agent Functionality

The agent, tracked as Ciro, is likely a custom agent written for the Mythic C2 framework in C++. Upon execution, the agent performs dynamic resolution of required API functions. These functions are set into a function table passed by reference to each function as required, and each function is accessed at offsets relative to the beginning of the table.

Ciro collects and formats the username, computer name, process identifier (PID) of the running Ciro process, payload universal unique identifier (UUID)4 (ae26cb07-ea65-434f-a9ac-d6c4814432ba) and internal adapter IP addresses into a check-in payload. The payload is then serialized and Base64-encoded and is also encrypted using an embedded AES-256 key (19E02B2049E10104573AB05B3D8882F4C3373992D4B823998152B93EB4971873) and a 128-bit initialization vector (IV) of null bytes in CBC mode.

Ciro then prepends the check-in payload with the hard-coded UUID in plaintext and sends an HTTP GET request to the C2 server csmon.westeurope.cloudapp.azure[.]com using a randomized HTTP endpoint (see Table 4 in the Appendix). The payload is set as the value of the X-REQUEST-INFO header. Figure 6 provides an example of the C2 check-in.

Figure 6. Ciro C2 agent check-in request

Once the check-in is complete, Ciro enters a task loop that requests and receives tasks from the operator and sleeps for a defined interval on each iteration. Once a task is received, it is Base64-decoded and decrypted using the same embedded AES-256 key and IV that were used to encrypt the payload. Table 1 describes Ciro’s capabilities.

Table 1. Ciro capabilities

Assessment

CrowdStrike Intelligence assesses with high confidence that the attack described in this alert is likely targeted based on the following factors:

• The threat actor installed the malware by conducting voice phishing (vishing) against an employee at the victim company
• The threat actor tailored the German-language spear-phishing website and the installer password to the specific German entity

The threat actor appears to be highly aware of operations security (OPSEC) practices, given that they encrypted the installer contents and prevented further activity from occurring without a password. The actor is also highly aware of social-engineering practices, which were implemented in all steps of the installer’s delivery and execution.

The recovered payload is above average in sophistication. This assessment is made with high confidence based on the use of what is likely a custom Mythic C2 agent, the LLVM bitcode representation of the C2 agent, and the decision to ship an LLVM interpreter to execute the provided bitcode.

Recommendations

These recommendations can be implemented to help protect against the activity described in this report.

• Only accept updates delivered through official CrowdStrike channels, and adhere to CrowdStrike support teams’ technical guidance
• Check website certificates on the download page to ensure downloaded software originates from a legitimate source
• Train users to avoid executing files from untrusted sources
• Enable download protection that can issue warnings about potentially harmful websites or downloads
• Hunt for suspicious LLVM interpreter execution, which includes but is not limited to:
  • LLVM interpreter execution on endpoints not intended for software development
  • LLVM interpreter execution as a means to establish persistence

Empty heading

Appendix

YARA Rule

This YARA rule detects the Mythic agent Ciro.

Falcon LogScale Query

This Falcon LogScale query hunts for suspicious execution of the LLVM interpreter.

This Falcon LogScale query hunts for malicious installer files used to deliver Ciro.

Indicators of Compromise (IOCs)

This table details the IOCs related to the information provided in this report.

Table 2. Ciro IOCs

MITRE ATT&CK

This table details the tactics and techniques described in this report.

Table 3. Ciro MITRE ATT&CK mapping

Table 4. Mythic C2 agent HTTP endpoints

Additional Resources

Read more blog posts from CrowdStrike Intelligence regarding the Falcon content issue: 

• Falcon Sensor Content Issue from July 19, 2024, Likely Used to Target CrowdStrike Customers
• Likely eCrime Actor Uses Filenames Capitalizing on July 19, 2024, Falcon Sensor Content Issues in Operation Targeting LATAM-Based CrowdStrike Customers
• Threat Actor Uses Fake CrowdStrike Recovery Manual to Deliver Unidentified Stealer
• Threat Actor Distributes Python-Based Information Stealer Using a Fake Falcon Sensor Update Lure
• Lumma Stealer Packed with CypherIt Distributed Using Falcon Sensor Update Phishing Lure
• Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity via Spearphishing Website

1 https[:]//docs.mythic-c2[.]net

2 https[:]//llvm[.]org/docs/CommandGuide/lli.html || https[:]//github[.]com/llvm/llvm-project/blob/main/llvm/tools/lli/lli.cpp

3 https[:]//docs.mythic-c2[.]net

4 https[:]//docs.mythic-c2[.]net/customizing/payload-type-development/create_tasking/agent-side-coding/initial-checkin#a-note-about-uuids