Extracting encrypted contents from Kronos Banking Trojan

Introduction 

This post explains how to identify and extract encrypted contents stashed away in the Resource section of malware. It's a common technique used by malware authors  to make analysis more difficult and the current analysis uses pestudio for initial analysis, using signsrch to identify encryption algorithms and using x64dbg to disassemble the binary

Tools
  1. pestudio - https://www.winitor.com/ signsrch
  2. signsrch - http://aluigi.altervista.org/mytoolz.htm 
  3. x64dbg- https://x64dbg.com/#start
  4. hxd - https://mh-nexus.de/en/hxd/
Disclaimer
  • You are dealing with real malware samples
  • Don’t expose them to internal networks or internet
  • Analyze them in a controlled environments (sandboxes)
  • We are not responsible for any consequences of damage if you fail to obey the rules
Analysis
A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot 
The below mentioned Kronos variant is going to be used in following analysis

Hash
MD5: 2a550956263a22991c34f076f3160b49

A quick static analysis of Kronos in PEStudio shows a suspicious resource section

An unknown signature with abnormal size is found in resource section of Kronos 

Dump the unknown signature is dumped as raw file 
The RAW file is opened in hex-editor to see the ASCII and hex view of the file content and the content looks encrypted 

The file header part is noted down to check whether the same can be observed in Kronos process memory or not. Meanwhile signsrch is a tool for searching signatures inside files, extremely useful in reversing engineering for figuring or having an initial idea of what encryption/compression algorithm is used for a proprietary protocol or file.
The below output shows the signsrch found two interesting keys with the type of algorithm (TEA - Tiny Encryption Algorithm). It's also observed that Kronos has anti-debug check for debugger presence using kernel32.dll API IsDebuggerPresent 
Now the Kronos is loaded into x64 debugger  
Check for the second constant in memory as shown in below figure ( right click)once the Kronos is loaded 

Follow the constant in memory by double clicking on search results. 
Keep a break point (hit F2) at the address once it's shown in memory and run Kronos (hit F9). As shown below figure, the debugger halts at breakpoint and check the content of EDX data register 
Check the EDX content by following in dump (right click on EDX register and hit follow in dump) 
The unknown resource section is loaded into memory.  As the break point is already set, keep on continue debugging (by hitting F9), the decryption happens in Dump1 
As it's difficult to continue to decrypt each and every byte, scroll down to find ret 8 instruction and remove the break point from 0041FB10, keep the breakpoint at ret 8 instruction.  Now, hitting F9 stops at ret 8 instruction so that the entire dump1 is decrypted. 
Now, remove the breakpoint at ret 8  and hit F8 (step over) and keep breakpoint on next instruction mov esp,ebp and then continue run the kronos (hit F9) 


Once it's landed at breakpoint, follow in memory map  to dump the loaded decrypted unknown resource 
dump memory to file 

Open the dumped file in hex-editor to find the Hex 0x4d5a or ASCII MZ  header and trim the content above MZ save it as an executable.
Now open the dumped binary in x64 debugger and look for the string references, It's observed that kronos maintains persistence by making an entry into one of ASEPs Run key. Below is the hash of dumped binary
SHA1: d4f69dea39fd414147fe9241eedfd06a5570683f
Open the dumped file in PESudio to get a quick idea like what type of APIs it imports and look for any suspicious strings in strings section
Further the extracted file is submitted to https://www.hybrid-analysis.com for behavioural analysis. The below link shows indicators of compromise  

Conclusion 
This is just an explanatory post to how to identify and extract encrypted contents from Resource section of malware. Below is the original work done by @cybercdh 
Special Thanks to




Comments

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Memory dump analysis of Donny's System

Malicious document analysis Part - 1