Full Report
Let's hunt some bootkits
Analysis Summary
# Tool/Technique: MosaicRegressor (UEFI Bootkit)
## Overview
MosaicRegressor is a sophisticated multi-stage malware framework discovered by Kaspersky and analyzed by Group-IB. It is notable for utilizing a UEFI (Unified Extensible Firmware Interface) bootkit to achieve persistent, low-level access to target systems. By infecting the motherboard's firmware, the malware can survive operating system reinstalls and hard drive replacements, ensuring the deployment of malicious payloads during the early stages of the boot process.
## Technical Details
- **Type:** Malware Family / UEFI Bootkit
- **Platform:** Windows (UEFI Firmware level)
- **Capabilities:** Persistence, Defense Evasion, Modular Payload Delivery, Inter-Process Communication.
- **First Seen:** 2020 (Discovery of UEFI samples)
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1542.001 - Pre-OS Boot: System Firmware
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0005 - Defense Evasion**
- T1542.001 - Pre-OS Boot: System Firmware
- T1197 - BITS Jobs
- T1027 - Obfuscated Files or Information
- **TA0002 - Execution**
- T1559.001 - Inter-Process Communication: Component Object Model
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer
## Functionality
### Core Capabilities
- **Firmware Persistence:** Modifies UEFI firmware modules (SmmInterfaceBase, Ntfs, SmmReset, and SmmAccessSub) to execute before the Windows operating system loads.
- **Payload Deployment:** The UEFI application `SmmAccessSub` drops a malicious executable (`IntelUpdate.exe`) into the Windows Startup folder (`%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup`) to ensure execution upon user login.
- **BITS Integration:** Uses the Background Intelligent Transfer Service (BITS) for stealthy data transfer between the infected host and C2 servers.
### Advanced Features
- **Modular Architecture:** Downloads additional DLL files and executes specific exported functions (`CallA`, `CallB`, `CallC`, `CallD`, and `CallE`) to perform specialized tasks.
- **COM Utilization:** Employs Component Object Model (COM) libraries for inter-process communication and system interaction.
- **String Encryption:** Obfuscates internal strings within the user-mode components to hinder static analysis.
## Indicators of Compromise
- **File Names:**
- `IntelUpdate.exe` (Main dropper/loader)
- `SmmInterfaceBase` (UEFI module)
- `SmmReset` (UEFI module)
- `SmmAccessSub` (UEFI module)
- **Network Indicators:**
- 43[.]252[.]230[.]180
- 122[.]10[.]82[.]30
- 43[.]252[.]228[.]179
- 144[.]48[.]240[.]101
- 185[.]216[.]117[.]91
- 212[.]64[.]6[.]161
- 45[.]116[.]78[.]238
- 52[.]174[.]139[.]136
- **Behavioral Indicators:**
- Unexpected files appearing in the `\Start Menu\Programs\Startup` directory.
- Unusual BITS job activity initiated by non-system processes.
## Associated Threat Actors
- Development and deployment have been linked to Chinese-speaking threat actors (likely APT groups), though specific attribution varies by campaign.
## Detection Methods
- **Signature-based detection:** Scanning for specific UEFI module hashes and the `IntelUpdate.exe` binary.
- **Behavioral detection:** Monitoring for unauthorized modifications to UEFI firmware (via specialized tools like Chipsec) and tracking BITS job creation.
- **Firmware Scanning:** Utilizing EDR/XDR solutions capable of scanning the SPI flash memory for non-standard UEFI modules.
## Mitigation Strategies
- **Boot Integrity:** Enable **Secure Boot** to prevent the execution of unsigned or unauthorized UEFI modules.
- **Update Software:** Regularly update BIOS/UEFI firmware to the latest versions provided by the manufacturer.
- **Privileged Account Management:** Restrict administrative privileges to prevent the execution of tools required to flash firmware from within the OS.
- **Hardening:** Implement application whitelisting to prevent `IntelUpdate.exe` or similar unauthorized binaries from executing in startup folders.
## Related Tools/Techniques
- **LoJax:** The first UEFI rootkit used in the wild by Sednit (APT28).
- **FinSpy:** Sophisticated surveillance software known to use UEFI persistence.
- **VectorEDK:** A UEFI bootkit framework.