search
TwitterGithub

Malware

Challenge
Topic

A Mule Stealer

Rust, Stripped, C2

Best Teams Forever 🥇

Electron, Ransomware

Music Speed Changer 🥈

Staged, PyArmor, Exfiltration

hashtag
A Mule Stealer

hashtag
Description

[IMPORTANT] This challenge involves working with malicious files. While we have done our best to ensure that these files cause no malicious impact if launched accidentally, please be careful when working with them.

Is this a rabbit? Or a cat? Or a crabbit..., maybe? I'm instructed not to click on weird attachments, but this one should be my background image for real!

hashtag
Solution

Given EML file, we can use EML viewer online to view it.

By clicking video hyperlink we will redirected to a fake captcha URL. Through analyzing the HTML source we will see that it will execute HTA file that execute a powershell command below

To get the executed command we can run base64 decode on it and print it as utf-16

By removing last line, we will get file svchost.exe in directory C:\Users\<username>\AppData\Local\temp\ . Next we need to analyze svchost.exe file.

First, when we check available strings on the executable we will know that the executable built with Rust.

The functions are stripped, but we can try to recover library function by using Cerberusarrow-up-right. Although not all library function has been successfully recovered but the recovery results are quite helpful.

Through running the executable on sandbox, we can see that there are access to http://backupstorage.task.sasc.tf/outarrow-up-right and http://backupstorage.task.sasc.tf/inarrow-up-right. By utilizing API monitor we can see that after accessing /in , malware will execute system command which is type flag.txt. Since we've recovered some function name, we can take a look on function related to command execution

Looking at xref, we found one user defined function which call that function which is sub_14004BF20. Set up breakpoint on address 0x14001F5CB that call function sub_14004BF20 . While debugging we will see that the output from command type flag.txt will be carried out and passed to function sub_14004BCB0 . Through static analysis we can see that function sub_14004BCB0 do RC4 encryption.

In the end of function sub_14004BCB0 we can see that there is a call to function sub_14004A180.

Through static analysis we can see also that function sub_14004A180 do encryption/decryption part of RC4. So by looking at function arguments or variable in function we can clearly get the key used to do the encryption in this case. During the competition, the process of sending ciphertext to the server was denied (no write permission to the server), so we can conclude that the file exist on the server is the ciphertext of flag.txt. So download the file then decrypt using RC4 to get the flag.

Flag: SAS{c475_w17h_r4bb17_34r5_c4n_d3liv4r_m4lw4r3}

hashtag
Best Teams Forever

hashtag
Description

[IMPORTANT] This challenge involves working with malicious files. While we have done our best to ensure that these files cause no malicious impact if launched accidentally, please be careful when working with them.

Hi! This is Bob from incident response.

Reaching to you regarding that ransomware attack we've had on our side-hosted server running "Windows Server 2019 Standard (17763.3650)". I was really surprised to find out MS Teams on the application list. Like, this a server, why would you need a corporate chat there?

That looks kinda SUS, aren't you thinking so? That being said, attaching some related artifacts. Check asap.

Best regards, Bob Guzini, Neck of IR Department.

hashtag
Solution

Given file archive that contains executable and other related files. By decompiling Teams.exe we will see that the pdb file of Teams.exe is electron.exe.pdb.

From that information we know that the application is an electron based, so let's take a look on resources directory. In resources directory there is app.asar which lies the code executed by the electron application. To unarchive asar file, we can use following command

Looking at index.js, we can see that the code is obfuscated so let's use online deobfuscatorarrow-up-right for it. Scrolling down we will see the main code as follows

At initial, there is execution of function _0x4cfb1f . By static analysis we can see that function _0x4cfb1f mainly do the following behavior

  • Open registry key

  • Check if _0x3544df or _0x439019 has been filled or not after random check based on Math.random

    • if null, _0x3544df will be filled with sha256 of _0x4478ea

    • if null, _0x439019 will be filled with md5 of _0x4478ea

    • _0x3544df and _0x439019 is not filled with the same _0x4478ea

  • Enumerate key inside HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft and recursively call _0x4cfb1f

So we can conclude that function _0x4cfb1f will choose randomly key inside HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft and put the hash of it in _0x3544df or _0x439019.

After calling _0x4cfb1f , if _0x3544df or _0x439019 is null, it will be filled with _0x28a4d9 which is the last value of the enumerated key in function _0x4cfb1f . Next, the malware will read files in directory C:\sasctf_77a44d458a057afe4beed9de71923f65e1fcf230baa916d48359dd8926826521 that doesn't have .enc or restore_files in filename. The encryption function lies on function _0x26a82b.

By analyzing it statically we can conclude what code above did

  • Encrypt _0x3544df and _0x439019 using RSA

    • By getting the RSA parameter we found that it is hard/impossible to recover the private key because it use standard RSA implementation

    • Put the RSA ciphertext to the .enc file

  • Create AES cipher with key _0x3544df and iv _0x439019

    • Encrypt the file passed with AES

Until this step we know that there is a vulnerability in the encryption since it use "bruteforceable" information to derive a key. Because we know that the client use following OS Windows Server 2019 Standard (17763.3650) we can try to setup the operating system and dump the registry key. After trying several option we found the right one, which is en version with desktop installation.

During the installation process, we also make sure the formatting of the registry key by modifying the asar file. To do this, we modified the index.js and pack the code again.

  • We put following code 2 times, near the hashing process of _0x3544df which is inside recursive function and main function.

Pack the code with following command

Then we just need to create a file aaa.txt and any .txt file inside C:\sasctf_77a44d458a057afe4beed9de71923f65e1fcf230baa916d48359dd8926826521 . After that run the executable and got the key written in aaa.txt . Following is the example of key before it hashed.

Back to the installed windows server, we can dump the registry using following command

Because the encryption using AES-CBC, if we use invalid IV it will only failed to decrypt the first block but the rest block is valid. Looking at important.txt.enc file we saw that the file is not small, so we can reduce the bruteforce time by only bruteforcing the key (with assumption the IV is different key).

Flag: SAS{N0_M0r3_R4n50m_f0r_53rv3r5}

hashtag
Music Speed Changer

hashtag
Description

[IMPORTANT] This challenge involves working with malicious files. While we have done our best to ensure that these files cause no malicious impact if launched accidentally, please be careful when working with them.

I miss those times when discord bots had an ability to play music... With a single button press you can change speed, pitch, bass... I like some tracks to bee speedy, some to be slow, some to bang from the back.

I was seeking for a solution for so long, and luckily found one! Or so I thought... Yesterday my friend from a local secret service called me and said I should change my passwords. How could he know? He refused to answer :(

hashtag
Solution

Given .dmp file which is a network dump, we can open it using mitmweb. Looking at the traffic we will see some suspicious traffic to domain musicspeedchanger.online.

fetcher.php is an endpoint to download executable file named setup.exe

Let's download the file and open it in IDA. By looking at the code, we can see that setup.exe is an installer, we can extract the file inside by using 7z.

There are some executable files, looking on it one by one we found suspicious executable which is upd.exe. From the pdb name we know that upd likely an executable to do the update for the MusicSpeedChanger. We can see access to https://musicspeedchanger.online/fetcher.php?uid=arrow-up-right in main function and it match with the data in network dump.

Let's understand the program by statically and dynamically analysis it.

  • sub_140001AE0 get value for MachineGuid

  • Buffer will store temporary directory, e.g

    • C:\Users\ryuk\AppData\Local\Temp\

  • Create a random filename with prefix upd with extension .enc

  • sub_140005BD0 will copy arg2 to arg1

  • sub_140001FB0 will access URL https://musicspeedchanger.online/fetcher.php?uid=arrow-up-right<machine_guid> and store the response which is a file in <temp>/upd<random>.enc

Looking at the next code, we will see call to a function sub_140002650.

Function sub_140002650 do the decryption of .enc file, we know it by looking at the code

To get the decrypted version we don't need to reconstruct the decrypt function. Because in this case we've network dump, so basically we can repeat the process same like the infected machine. Following is the idea

  • Create fake server with HTTPs

    • Generate self-signed cert and install cert on our sandbox machine

    • Fake server will sent the same data like in network dump

  • Directly put our fake HTTPs server ip address in /etc/hosts. E.g

    • musicspeedchanger.online 192.168.137.2

Generate self-signed certificate first, put musicspeedchanger.online as FQDN

Convert cert.pem to .der, then install .der fileto sandbox machine

Based on network dump, we can see that there is more than one request to the fetcher.php with GUID, so i've downloaded all the encrypted executable and put it on directory UPDATE.

After execution of function sub_140002650, we will get decrypted version of executable.

Let's extract the archive again.

Nothing suspicious from first update, let's continue to next update. Do the same flow to get the next update.

Looking at each file, we found suspicious file named sendDiagnostics.exe. Through decompiling we know that the executable produced from PyInstaller.

Let's extract it using pyinstxtractorarrow-up-right.

By decompiling using pycdc, we can see that hello.pyc is protected using pyarmor.

There are several way to defeat pyarmor, during the competition i failed to deobfuscate it statically so i tried to do it dynamically.

First, when we run the sendDiagnostics.exe it will try to access URL. Because my sandbox doesn't connect to the internet it will shows an error regarding the failure of accessing the URL.

Previously i've been researching about pyamor and created a challenge regarding pyarmor also in past competition.

Following is my idea to get deobfuscated code

  • Use PyInjectorarrow-up-right to do following task

    • spawn python interactive to find entrypoint for decryption

    • execute deobfuscator script

  • If we use PyInjector, we need to inject the DLL to the running python process. If python process died, the interactive session will died also or the script running also died.

    • Error will terminate the python process (like connection error in image above)

  • To mitigate the issue regarding the termination of python process the idea is setting up fake HTTPs server and make the server sleep if there is a request. So it will make the client waiting for the response or terminate it if it reach the default timeout.

    • The step to create fake HTTPs server is same, the different only on code and FQDN

Following is the code for fake HTTPs server (gkfmdgkdgb.pythonanywhere.com)

Following are steps to spawn interactive python

  • Run sendDiagnostics.exe

  • Open process hacker then choose the sendDiagnostics.exe that has the largest private bytes

    • Miscellanious > Inject DLL > choose PyInjector_x64_shell.dll

If we use the scriptarrow-up-right directly it will failed to find the frame because there is no frozen in current frames

But we can do it manually by inspecting each frame until found frozen hello

After that we can modify the existing script to get the frozen frame from the one that we got.

Put the file in same folder with PyInjector_x64.dll , then you will get .pyc file in dump directory in the same directory with sendDiagnostics.exe. Next we can use pycdcarrow-up-right or pylingualarrow-up-right to decompile the pyc file.

Code is not fully decompiled, but we still can see what the code want to achieve by combining output from both decompiler.

Manually deobfuscate the code and looking at disasm output (using pycdas) we got the idea what the code did.

  • Get files from directory below

    • C:\SecretMusic_01bc59b0059dd953cc8e59bdc86937f1839d9338aabbef279e92cc94680310c8

    • C:\SecretDocuments_78dbfebd2b180fccff80a1c7dc7d2696744ac111a4ff26f94bd715b52aabc112

  • Create zip (archive.zip) for the files and encrypt the zip using class lIIIIIIlIIlIIIIlIl then save it with name archive.enc .

  • Last, send archive.enc to the DEST_URL which is https://gkfmdgkdgb.pythonanywhere.com/sendDiagnostic.phparrow-up-right

Most of the constants in the code used by lIIIIIIlIIlIIIIlIl , looking at the constant we will found that most likely it is kind of DES cipher based on constant values.

Single DES use 8 bytes key to do the encryption and decryption but in this case there are 24 bytes value and 8 bytes value. Most likely 24 bytes is the key and 8 bytes is the IV. Looking at another variant of DES we found 3DES that match with this criteria. So let's create a script to decrypt the zip file.

Flag: SAS{n3v3r_g0nn4_g1v3_up_u51ng_unp0pul4r_50ftw4r3}

PreviousSAS CTF QualsNextGooseCTF - misc0nfig

Last updated