SHA-256 Hash
SHA-256: 963f1735e9ee06c66fdf3a831d7c262bc8bce0d7155e37f9a5aa2677e0a6090c
You can download the malware sample from malware-traffic-analysis.net.
Stage 1
The main function is filled with junk instructions, but the most interesting function within main is the decode_n_call function located near the end:
Inside the decode_n_call function, memory is allocated, data is decoded from the 0x0433220 address, and execution jumps to it via the call instruction:
It allocates two memory blocks, each 0x3000 in length, with PAGE_EXECUTE_READWRITE permission:
After that, some decoded data is written into the first allocated memory:
Additionally, there is another loop that decodes/decrypts the written data in memory:
It seems like it’s a PE file, but it is still encoded and not valid yet.
The function at 0x30A70 takes two arguments: the encoded/encrypted data and the second allocated memory. It returns a decoded/decrypted PE file via the second argument:
It removes the main executable from memory and copies the recently decoded/decrypted code:
Section Maps
Inside the 0x30730 (offset 0x730) function, it builds the Import Address Table (IAT) for the new PE file:
After that, it jumps to the entry point of the new PE file:
Instead of continuing the analysis, it is much easier to dump the new PE and analyze it separately.
Stage 2
The second PE is also filled with junk instructions. The interesting part starts at the 0x0401EED location:
Inside the sub_403B10 function, it attempts to delete the following directories: Settings, Microsoft\\Enc, AMMYY, Foundation, and Foundation1, as well as the following files: wmihost.exe, settings3.bin, wmites.exe, and wsus from various directories:
It uses sub_404450 to obtain function addresses based on some kind of hash, which is passed as the second argument:
The 0x403DE0 function takes the process name as an argument and terminates the corresponding process:
It executes the following commands using the ShellExecuteW function:
cmd /C net.exe stop ammyycmd /C sc delete ammyycmd /C net.exe stop foundationcmd /C sc delete foundation
These commands stop the malware if it is running.
It generates a random name (via CoCreateGuid) for a PE file, which it downloads from http://185.176.221.29/ban3.dat:
Inside the downloadNextStage_bin function, it downloads a file from the URL and saves it at the previously mentioned location:
It copies the new file to CSIDL_COMMON_APPDATA\Microsoft Help\\wsus.exe and deletes the original one:
Inside the sub_402960 function, if the user is an admin, it executes the above-mentioned commands again, registers the downloaded PE file as a service called foundation, and starts it:
In the end, it deletes the original second-stage PE file:
If the user is not an admin, it uses a COM object (taskscd.dll) to create and run the executable via a scheduled task:
For more detailed information, refer to the sub_402360 function.
After that, the same process occurs: it deletes the original second-stage PE file and exits via the TerminateProcess call:
