Lab 12-2

Analyze the malware found in the file Lab12-02.exe.

Analysis:

Let’s begin with Basic Static Analysis on Lab12-02.exe. Looking at the Imports, we can start to suspect some of the functionalities of this Malware:

• The Malware may dynamically resolve and import external resources (GetProcAddress and LoadLibraryA)

• The Malware has the ability to create and terminate processes (CreateProcessA, and TerminateProcess)

• The Malware may allocate memory and use it in some fashion. (VirtualAlloc, HeapAlloc, VirtualFree, HeapFree, etc.)

• The Malware will likely search and use a resource module (FindResourceA, SizeofResource, LoadResource, and LockResource)

• The Malware can write and read files. (WriteFile, and ReadFile)

• The Malware may read and write data to an area of memory in a specified process. (WriteProcessMemory, and ReadProcessMemory)

• The Malware may retrieve and set the context of the specified thread. (GetThreadContext, and SetThreadContext)

• The Malware has the ability to resume the execution of a Thread (ResumeThread)

From the last imports mentioned we can start to guess that the Malware will use the Process Replacement technique.

In terms of strings, this Malware has some interesting strings as well:

• The string svchost.exe is highly suspicious. As it is a common process name, and with some of the Imports mentioned before, probably the Malware will attempt to inject on this process.

Looking at the resources, we can confirm that the Malware has indeed a resource named LOCALIZATION.

Let’s move on to Basic Dynamic Analysis. After running the Malware, and observing Process Explorer, we can see that it executes and creates an instance of svchost.exe and exists, leaving the svchost.exe process running as an orphaned process:

Even though an orphaned svchost.exe process is highly suspicious since this doesn’t stand out in Windows Task Manager, it’s normal that the process will blend in perfectly:

After executing Lab12-02.exe, in the same directory, a file named practicalmalwareanalysis.log is created. By inspecting the file, we can see that the Malware has keylogging functionality.

One interesting thing found in the information stored in practicalmalwareanalysis.log is that special keys such as “[ENTER]” or “[TAB]” are well represented, even though these haven’t been observed Statically. This means that they probably come from the embedded resource (which has several strings but seem to be encoded). In the following image, we can see some of the mentioned strings in memory:

Let’s advance to Advanced Static Analysis and Advanced Dynamic Analysis in order to understand better the Malware’s inner workings.

After opening the file in IDA, we can see that the Malware starts by getting a module handle to itself (GetModuleHandleA) and then calls sub_40149D where the string C:\Windows\system32\svchost.exe is created (GetSystemDirectoryA, and the parameter “svchost.exe”):

After that, sub_40132C is called. This function is where we can see a resource being loaded:

The space for the resource is being allocated with VirtualAlloc and then the content of the resource is being copied to that space with memcpy:

Then we have sub_401000:

In this function, we can see a decode stub that is decoding the memory with a byte by byte XOR operation with the value “0x41 - A” (3rd parameter of the function).

In Olly we can actually see the buffer being decoded and identify a PE header:

After the loop finishes the decode, we can obtain the decoded payload by dumping that memory region to a file. Doing so, we obtain the following file:

• SHA256: 9b683d2fda7ca7adcc043e4412271009a0e115ca55f9a718c385a3f46b57ae6b

We can also dump the Resource using Resource Hacker and then decode it with the following python script:

import sys

# Args:
# 1) Encoded file
# 2) Decoded file
# 3) XOR Key

# Execution: python decode.py encoded_payload.exe_ decoded_payload.exe A

outbuf = b""
with open(sys.argv[1], 'rb') as c:
    byte = c.read(1)
    while byte:
        outbuf += chr(ord(byte) ^ ord(sys.argv[3]))
        byte = c.read(1)
with open(sys.argv[2], 'wb') as out:
    out.write(outbuf)

The result will be the same.

After decoding the file, it will free the Resource, copy the address to EAX and return:

After the payload has been decoded, function sub_4010EA is called:

In this function an instance of svchost.exe is created in suspended mode (dwCreationFlags = 4 (CREATE_SUSPENDED)):

If this function is successful, the Malware then dynamically loads NtUnmapViewOfSection in order to replace the target process’s memory with the malicious executable.

The Malware then allocates new memory and uses WriteProcessMemory in order to write each of the Malware’s sections to the target process memory space:

The Malware then restores the target process environment by calling SetThreadContext and resume execution of the Thread (that was suspended), thus initiating the Malware. With this, the newly created svchost.exe process has been replaced by the malicious payload that was decoded in memory.

After finishing function sub_4010EA (which we can rename to process_replacement) the Malware frees up allocated memory and sleeps for 1 second before exiting.

Thus, the Malware manages to load its malicious payload in the context of another process.

Questions:

1) What is the purpose of this program?

The purpose of this Malware is to load a keylogger and disguise it as a svchost.exe process using Process Replacement.

2) How does the launcher program hide execution?

It hides execution by performing Process Replacement on svchost.exe.

3) Where is the malicious payload stored?

The malicious payload is stored in a resource named LOCALIZATION. This resource is an encoded executable file.

4) How is the malicious payload protected?

The malicious payload is XOR encoded with the key value of 0x41 (A).

5) How are strings protected?

The strings are XOR encoded. As we can see in sub_401000 there is an XOR decode routine.