Introduction
This post explains how to identify and extract encrypted contents stashed away in the Resource section of malware. It's a common technique used by malware authors to make analysis more difficult and the current analysis uses pestudio for initial analysis, using signsrch to identify encryption algorithms and using x64dbg to disassemble the binary
Tools
Open the dumped file in hex-editor to find the Hex 0x4d5a or ASCII MZ header and trim the content above MZ save it as an executable.
Now open the dumped binary in x64 debugger and look for the string references, It's observed that kronos maintains persistence by making an entry into one of ASEPs Run key. Below is the hash of dumped binary
SHA1: d4f69dea39fd414147fe9241eedfd06a5570683f
Open the dumped file in PESudio to get a quick idea like what type of APIs it imports and look for any suspicious strings in strings section
This post explains how to identify and extract encrypted contents stashed away in the Resource section of malware. It's a common technique used by malware authors to make analysis more difficult and the current analysis uses pestudio for initial analysis, using signsrch to identify encryption algorithms and using x64dbg to disassemble the binary
Tools
- pestudio - https://www.winitor.com/ signsrch
- signsrch - http://aluigi.altervista.org/mytoolz.htm
- x64dbg- https://x64dbg.com/#start
- hxd - https://mh-nexus.de/en/hxd/
- You are dealing with real malware samples
- Don’t expose them to internal networks or internet
- Analyze them in a controlled environments (sandboxes)
- We are not responsible for any consequences of damage if you fail to obey the rules
Analysis
A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot
The below mentioned Kronos variant is going to be used in following analysis
Hash
MD5: 2a550956263a22991c34f076f3160b49
A quick static analysis of Kronos in PEStudio shows a suspicious resource section
An unknown signature with abnormal size is found in resource section of Kronos
Dump the unknown signature is dumped as raw file
The RAW file is opened in hex-editor to see the ASCII and hex view of the file content and the content looks encrypted
The file header part is noted down to check whether the same can be observed in Kronos process memory or not. Meanwhile signsrch is a tool for searching signatures inside files, extremely useful in reversing engineering for figuring or having an initial idea of what encryption/compression algorithm is used for a proprietary protocol or file.
The below output shows the signsrch found two interesting keys with the type of algorithm (TEA - Tiny Encryption Algorithm). It's also observed that Kronos has anti-debug check for debugger presence using kernel32.dll API IsDebuggerPresent
Now the Kronos is loaded into x64 debugger
Check for the second constant in memory as shown in below figure ( right click)once the Kronos is loaded
Follow the constant in memory by double clicking on search results.
Keep a break point (hit F2) at the address once it's shown in memory and run Kronos (hit F9). As shown below figure, the debugger halts at breakpoint and check the content of EDX data register
Check the EDX content by following in dump (right click on EDX register and hit follow in dump)
The unknown resource section is loaded into memory. As the break point is already set, keep on continue debugging (by hitting F9), the decryption happens in Dump1
As it's difficult to continue to decrypt each and every byte, scroll down to find ret 8 instruction and remove the break point from 0041FB10, keep the breakpoint at ret 8 instruction. Now, hitting F9 stops at ret 8 instruction so that the entire dump1 is decrypted.
Now, remove the breakpoint at ret 8 and hit F8 (step over) and keep breakpoint on next instruction mov esp,ebp and then continue run the kronos (hit F9)
Once it's landed at breakpoint, follow in memory map to dump the loaded decrypted unknown resource
dump memory to file
SHA1: d4f69dea39fd414147fe9241eedfd06a5570683f
Further the extracted file is submitted to https://www.hybrid-analysis.com for behavioural analysis. The below link shows indicators of compromise
Conclusion
This is just an explanatory post to how to identify and extract encrypted contents from Resource section of malware. Below is the original work done by @cybercdh
Special Thanks to
This comment has been removed by a blog administrator.
ReplyDelete