Thread by @mayahustle

More on COSMICENERGY. Previously we said that LIGHTWORK had a 98% function overlap with lib60870-c, turns out it's even more than that. Their main code is based on an example from that project, simple_client.c #ICS #malware (1/13)
github.com/mz-automation/…

Going back in the Github history, and looking at various artifacts, like dangling if statements, and some sleep calls, and such, it looks like it's based on the version from March 28, 2019 (2/13):
github.com/mz-automation/…

I'm going to forego a line by line comparison of all the functions, but if you want to take a look, here are screen shots of the handler functions and their corresponding decompilations. First: rawMessageHandler and connectionHandler (3/13)

And here is the last handler asduReceivedHandler. They're all basically 1:1 copies, with slight differences explained by the compiler (like the switch statements becoming an if, or simple printfs becoming puts). (4/13)

The last function in the example project is main, and here is where you see some slight differences where the LIGHTWORK authors changed the code. I'll go through this bit in a couple chunks for readability. (5/13)

In the first part of main, they added an argument. "input_command = atoi(argv[3])" (my annotation), and removed setting the asduReceivedHandler. The extra argument is the ON or OFF command.
(6/13)

The next part where they create the connection and do some set up (to be brief), is exactly the same (7/13)

Now here's where the real change happens. LIGHTWORK takes the next bit where the github example creates and sends one Single Command, and wraps it in a loop so it can send 8 of them to an array of IOAs that it initializes just before. (8/13)

The rest of the code is the same. I made notes and by my count, Lightwork is entirely the same as lib60870's simple_client.c, except for 1 line removed, and about 11 additional lines in decompilation.
(9/13)

In their actual source, that array initialization probably happens on 1 line, which means it's probably closer to 4 or 5 additional lines:
1 for the extra argument
1 for the array initalizer
2 for the for loop header and ending brace
+ the mods to make loop body work.
(10/13)

So what does this mean? LIGHTWORK with the exception of (let's just be generous) 6 lines of code, is exactly the same as an example IEC104 client project from lib60870. Personally, I think this lends credence to the theory that this is a test or research tool. (11/13)

The more I think about it the more I think that the authors were creating a "discount CRASHOVERRIDE emulator" to test detections. Use of xp_cmdshell and IEC104 match already known TTPs from that event.
(12/13)

The combination of naming (using a Mitre ATT&CK technique number), inclusion of symbol information, all the python errors, and an almost 1:1 copy of an example from github doesn't add up to COSMICENERGY (at least this version of it) seeming like serious malware.(13/13)