Skip to main content

Extracting encrypted contents from Kronos Banking Trojan

Introduction 

This post explains how to identify and extract encrypted contents stashed away in the Resource section of malware. It's a common technique used by malware authors  to make analysis more difficult and the current analysis uses pestudio for initial analysis, using signsrch to identify encryption algorithms and using x64dbg to disassemble the binary

Tools
  1. pestudio - https://www.winitor.com/ signsrch
  2. signsrch - http://aluigi.altervista.org/mytoolz.htm 
  3. x64dbg- https://x64dbg.com/#start
  4. hxd - https://mh-nexus.de/en/hxd/
Disclaimer
  • You are dealing with real malware samples
  • Don’t expose them to internal networks or internet
  • Analyze them in a controlled environments (sandboxes)
  • We are not responsible for any consequences of damage if you fail to obey the rules
Analysis
A windows 7 virtual machine was setup with above mentioned tools. Ensured that a clean state of windows 7 with all tools was taken as a snapshot 
The below mentioned Kronos variant is going to be used in following analysis

Hash
MD5: 2a550956263a22991c34f076f3160b49

A quick static analysis of Kronos in PEStudio shows a suspicious resource section

An unknown signature with abnormal size is found in resource section of Kronos 

Dump the unknown signature is dumped as raw file 
The RAW file is opened in hex-editor to see the ASCII and hex view of the file content and the content looks encrypted 

The file header part is noted down to check whether the same can be observed in Kronos process memory or not. Meanwhile signsrch is a tool for searching signatures inside files, extremely useful in reversing engineering for figuring or having an initial idea of what encryption/compression algorithm is used for a proprietary protocol or file.
The below output shows the signsrch found two interesting keys with the type of algorithm (TEA - Tiny Encryption Algorithm). It's also observed that Kronos has anti-debug check for debugger presence using kernel32.dll API IsDebuggerPresent 
Now the Kronos is loaded into x64 debugger  
Check for the second constant in memory as shown in below figure ( right click)once the Kronos is loaded 

Follow the constant in memory by double clicking on search results. 
Keep a break point (hit F2) at the address once it's shown in memory and run Kronos (hit F9). As shown below figure, the debugger halts at breakpoint and check the content of EDX data register 
Check the EDX content by following in dump (right click on EDX register and hit follow in dump) 
The unknown resource section is loaded into memory.  As the break point is already set, keep on continue debugging (by hitting F9), the decryption happens in Dump1 
As it's difficult to continue to decrypt each and every byte, scroll down to find ret 8 instruction and remove the break point from 0041FB10, keep the breakpoint at ret 8 instruction.  Now, hitting F9 stops at ret 8 instruction so that the entire dump1 is decrypted. 
Now, remove the breakpoint at ret 8  and hit F8 (step over) and keep breakpoint on next instruction mov esp,ebp and then continue run the kronos (hit F9) 


Once it's landed at breakpoint, follow in memory map  to dump the loaded decrypted unknown resource 
dump memory to file 

Open the dumped file in hex-editor to find the Hex 0x4d5a or ASCII MZ  header and trim the content above MZ save it as an executable.
Now open the dumped binary in x64 debugger and look for the string references, It's observed that kronos maintains persistence by making an entry into one of ASEPs Run key. Below is the hash of dumped binary
SHA1: d4f69dea39fd414147fe9241eedfd06a5570683f
Open the dumped file in PESudio to get a quick idea like what type of APIs it imports and look for any suspicious strings in strings section
Further the extracted file is submitted to https://www.hybrid-analysis.com for behavioural analysis. The below link shows indicators of compromise  
https://www.hybrid-analysis.com/sample/2d2e7731e19b0a3bd428346ede6f50c8d8af3837b6d7a3b76536e1d66d444ecb?environmentId=100

Conclusion 
This is just an explanatory post to how to identify and extract encrypted contents from Resource section of malware. Below is the original work done by @cybercdh 
Special Thanks to




Comments

  1. kavithasathish15 May 2019 at 21:59

    This comment has been removed by a blog administrator.

    ReplyDelete

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlle
60 comments
Read more

Malicious office doc with process hollowing shellcode

Introduction  This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer  Part-1  and  Part-2  to get an understanding of  tools and approach to analyse phishing documents.  Tools  Didier Stevens Suite    sudo pip install oletools  Analysis   SHA256:  5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d   This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and t he encoded shellcode is a property in stream 17.  T he shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or process replacement.The explorer.exe process is created in a suspended state, the code for explore
1 comment
Read more

Decoding Metasploit and CobaltStrike shells

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg  emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command  powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAH
1 comment
Read more