File Analysis - 2023:07:07

Analysis of Flagged Executable

By Baylen Orr

Binaries

1. alphastand.7z (a878ae7309e152ef181f5307a33beaac46d888950475dc71042fa119d139cd10)

STAGE 1 ANALYSIS (stage1.exe)

The sample stage1.exe maintains a mostly normal set of API calls and drops the files cxeirm.dll and 6lqolmzxam into the \AppData\Local\Temp folder. It then spawns a child procress under the original executable name before terminating itself. The child process loads cxeirm.dll where execution is then passed to the newly loaded module.

STAGE2 ANALYSIS (cxeirm.dll)

cxeirm.dll is the second stage and unpacks and executes the final payload which contains our malware (analysis below). cxeirm.dll exports fifteen functions that are randomly named. Most of these are simple return statements to a place in memory. cxeirm.dll is obfuscated and does not appear to have any risky API calls when analyzed statically as they are all generated at runtime. It is possible to download the final payload from memory using the following technique (note: ensure ASLR is disabled).

Unpacking

Set a breakpoint on the API calls LoadLibraryExA and VirtualAlloc. The debugger should break at LoadLibraryExA as it loads cxeirm.dll and begins importing functions. The following routine calls cxeirm.xiqoecpi to handle the rest of the unpacking process.

00401F88 | push 8                                 |
    00401F8A | push ebx                               |
    00401F8B | push esi                               | esi:"C:\\Users\\REM\\AppData\\Local\\Temp\\nsp9588.tmp\\cxeirm.dll"
    00401F8C | call dword ptr ds:[<&LoadLibraryExA>]  |
    00401F92 | mov edi,eax                            |
    00401F94 | cmp edi,ebx                            |
    00401F96 | je loki-flagged.402004                 |
    00401F98 | push dword ptr ss:[ebp+8]              | [ebp+8]:"xiqoecpi"
    00401F9B | push edi                               |
    00401F9C | call dword ptr ds:[<&GetProcAddress>]  |
    00401FA2 | mov esi,eax                            | esi:"C:\\Users\\REM\\AppData\\Local\\Temp\\nsp9588.tmp\\cxeirm.dll"
    00401FA4 | cmp esi,ebx                            | esi:"C:\\Users\\REM\\AppData\\Local\\Temp\\nsp9588.tmp\\cxeirm.dll"

Break Point

All APIs are dynamically resolved at runtime. Before execution passes into cxeirm.dll module, ensure a breakpoint for VirtualAlloc is set. At the first triggered event, review the call stack and locate the instruction that called VirtualAlloc. It will looks something akin to the following.

1005698E | 6A 04                    | push 4                                  |
    10056990 | 68 00300000              | push 3000                               |
    10056995 | FF75 F8                  | push dword ptr ss:[ebp-8]               |
    10056998 | 6A 00                    | push 0                                  |
    1005699A | FF55 A8                  | call dword ptr ss:[ebp-58]              |
    1005699D | 8945 F4                  | mov dword ptr ss:[ebp-C],eax            |

Set a breakpoint on the instruction after the call instruction. The address in EAX will be initialized with zeros. Continue execution letting the debugger break on the second call to VirtualAlloc. The populated memory space is now ready to be dumped. Locate the region in the memory mapper and dump to disk. At this stage of execution the file will be a 'PRV' type and 0x36000 bytes (216KB) in size.

STAGE 3 ANALYSIS (stage3.exe)

After dumping stage3.exe from cxeirm.dll (Stage 2) as described above, you can execute stage3.exe from the command line without building the IAT or rebasing the image. I have not identified any arguments that are necessary for the dumped binary to execute.

stage3.exe uses RtlInitUnicodeStringEx and RtlInitAnsiStringEx to resolve strings for its operations during runtime. By hooking the Rtl APIs in API monitor or a debugger and letting the sample execute, you can retrieve a good comprehensive string analysis. This particular sample also deobfuscates more URLs that I did not observe to be captured elsewhere. At 0x004a0024 we observe the following:

                     LAB_004a0024                                    XREF[1]:     004a002e(j)  
    004a0024 30 1e           XOR        byte ptr [ESI]=>DAT_004a0074, BL                 ; = 97h
    004a0026 46              INC        ESI
    004a0027 90              NOP
    004a0028 90              NOP
    004a0029 90              NOP
    004a002a 90              NOP
    004a002b 80 3e 00        CMP        byte ptr [ESI]=>DAT_004a0075, 0x0                ; = 8Bh
    004a002e 75 f4           JNZ        LAB_004a0024
    004a0030 90              NOP
    004a0031 90              NOP
    004a0032 be 74 00        MOV        ESI, DAT_004a0074                                ; = 97h

This for loop will deobfuscate the C2 urls. Watch the address space at 0x004a0074 and set a breakpoint at 0x004a0032 to observe the malicious URL. This routine is called three times, and in this sample's case the below URLs in the IOC section were resolved.

Upon execution, stage2.exe assigns itself the 'System' and 'Hidden' attributes and moves itself into \%user%\AppData\Roaming\<random>\<random> where "random" is a four hexadecimal characters. The file can be seen and the attributes removed by using the 'attrib' command (attrib -s -h ####.exe).

Further analysis of stage3.exe should involve more dynamic analyses and attempts to further deobfuscate the large memory allocations that are not disassembled. The level of dynamic analysis thus far confirms the deobfuscated URLs are called. Further, stage3.exe immediately attempts to resolve the host name "ckav[.]ru" (see stage3-network-capture.pcap file). To get a proper capture, ensure an http server is running on the capture machine.

TOOLS USED

x32dbg
PEStudio
Ghidra
CFExplorer
WireShark
API Monitor

IOCs

urls

1. ckav[.]ru
2. secure01-redirect[.]net/gc4/fre.php
2. alphastand[.]trade/alien/fre.php

strings

1. "U2XpekVvtYq0fwsx7EDuZjrCo9GcF1B6Hl358mbznyLWdMANa4TSKJhIiOPgQR"
2. "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW"

hexstrings

1. "97 8b 8b 8f c5 d0 d0 8c 9a 9c 8a 8d 9a cf ce d2 8d 9a 9b 96 8d 9a 9c 8b d1 91 9a 8b d0 98 9c cb d0 99 8d 9a d1 8f 97 8f 00" // This is an argument for getaddrinfo()