LOLSnif Malware

A boringly deep analysis of a very complex VBS Malware dropper

Image for post — A code snippet of the script

LOLSnif is a new(ish) variant of the common trojan Ursnif.

Here, we take a look at the very complex and heavily encoded/obfuscated script that drops the malicious DLL on the victim machine.

Apologies if it gets a bit boring, I’ve crammed in too much stuff here. Feel free to skip sections that are of less interest.

It all starts the usual way, phishing email brings in a link that serves the initial script. The script itself has the malware in it, which is dropped on the victim machine on successful execution.

This script has a lot of anti-analysis, anti-sandbox features that are clever and heavily encoded which makes them well-hidden.

Let’s take a step-by-step look at this malware:

There are more than 500 lines of code in the script and most of those lines have thousands of chars in them. This is a very long script, based on those numbers alone.

A lot of that is garbage, as is common with scripting malwares. What makes this one more complex than your average malware, is the lengths this author(s) has gone to in order to hide the code and make it hard to analyse.

For the purpose of this analysis (as with most of my work), we will analyse it dynamically and we’ll be clever in our approach. We will disable the anti-analysis features one by one and then make the malware execute the way we want. We will then record all the relevant actions and examine the results to form a complete analysis for Incident Response.

Anti-Sandbox features

This malware has a few tricks that allow it determine if it’s being executed in a sandbox — these are highly effective tricks and I can confirm that it evades analysis by major sandboxing solutions available in the market.

Cores

Let’s take a look at the function above.

The malware creates a WMI instance to query information in the cimv2 category for the local machine. This can be used to run queries on WMI, which is structured in classes.

Next, it uses a select statement to extract all info from the Win32_Processor class (table) and then goes ahead with querying the ‘NumberOfCores’ field.

The malware is trying to query the number of cores on the victim machine. Once it has that number, it runs it against am If statement:

If luck.NumberOfCores < (95 + (-((10 + 138.0) - (81 + (-25.0))))) Then
onomatopoeia = True
End If
Next
If onomatopoeia Then
DCZwCUL
End If

From the code snippet above, (95 + (-((10 + 138.0) — (81 + (-25.0))))) equals ‘3’.

So if the number of cores is less than 3, the condition is ‘True’. If true, the program runs the function ‘DCZwCUL’, which (we’ll see later) exits the program. It gives you a fake message about a missing ‘MSVCR102.dll’ which in reality doesn’t exists (try googling it).

Tip: Increase the number of cores to your VM to 4 or more and you'll bypass this feature.

Memory

In this function, the malware tries to query the physical memory of the victim machine. It again uses the WMI classes for this purpose.

This time it queries the ‘Win32_ComputerSystem’ field.

If the physical memory is less than 1030 Mb, it terminates execution.

Tip: increase the memory of your VM to more than 1030 and you'll successfully bypass this feature.

Common Analysis Tools

Personally, I like this list of common tools these malware authors use for anti-analysis techniques. I get to see a few new ones every now and then and I add them to my arsenal :)

As you can see, the list above is quite comprehensive. Basically, the malware checks if you’ve got any of these tools running on your analysis machine and if it finds any of the ones listed in the function’s array, it terminates execution.

This function works flawlessly. I tested it by running a couple of these tools on the machine (procmon, procexp) and it identified those and terminated the program.

Tip: You can have these tools on your analysis machine, just make sure they are not running at the time of analysis - most of these are portable executables. I've written this quick script that tells you if any of these are detectable on your system. Run this script and see if any of these are detected. You'll have to terminate the detected tools to bypass this feature. https://github.com/vithakur/scripts/blob/master/sandbox_tools.vbs

Logical Volume Size

Another trick the malware uses is the size of the logical volumes on your analysis machine. In the above code snippet, you can see that the malware terminates execution if the size is less than 60 Gb. Most VM’s are less than that (especially in commercial cloud-based sandboxes).

Tip: If you can have a vm with a logical volume size of more than 60 Gb, you'll be able to bypass this feature completely.

Number of files in certain folders

This is another neat trick by the authors. The malware checks a couple of directories to see how many files are in them to make sure it’s not an analysis machine the malware is running on.

The two directories it checks are:

\temp\\Downloads\

Here’s how it works:

The function declares two variables, to be used for comparison purposes later in the function.

PsRTozXY = (622 — ((10 + (39 + 2901.0)) — 2331.0))
(622 — ((10 + (39 + 2901.0)) — 2331.0)) = 3
PsRTozXY = 3

PsRTozXY_download = (397 — ((88 + (-25.0)) + (81 + 250.0)))
(397 — ((88 + (-25.0)) + (81 + 250.0))) = 3
PsRTozXY_download = 3

If CreateObject("Scripting.FileSystemObject").GetFolder(ibrdYdE).Files.Count < PsRTozXY Then
DCZwCUL
End If

ibrdYdE refers to another function in the program:

Function ibrdYdE()
ibrdYdE = CStr(WScript.CreateObject(“Scripting.FileSystemObject”).GetSpecialFolder(((16 + (-11.0)) + (-((81 + (-49.0)) + (-29.0))))) + “\”)
End Function

ibrdYdE returns the special folder — ‘\temp\’ based on the function above.

GetSpecialFolder(((16 + (-11.0)) + (-((81 + (-49.0)) + (-29.0))))) + “\”)

‘(((16 + (-11.0)) + (-((81 + (-49.0)) + (-29.0)))))’ = 2; 2 returns ‘\temp’

So, if there are less than 3 files in the ‘temp’ folder, terminate execution.

The second folder is the \Downloads\ folder, which is easier to see in the code itself:

sallow = fkvQdFqe.ExpandEnvironmentStrings("%USERPROFILE%") + "\Downloads\"

Again, if there are less than 3 files in the Downloads folder, terminate execution.

Tip: Just put some random files in the Downloads folder, the malware just checks the number of files not the type of files or extensions. In the 'temp' folder (c\users\yourUser\appdata\local\temp) there should be more than 3 files usually by default.

So, as you can see, quite a few anti-analysis, anti-sandbox features in this malware and all well-written.

Terminate Function

Now that we’ve had a look at all the anti-analysis functions in the malware, let’s quickly take a look at the function that is used to terminate execution of the malware.

From the code above, you can see that once the function is called, it calls three other functions and then terminates the program using ‘WScript.Quit’

The first function it calls is Crete():

This function doesn’t lead to anything, no requests are made.

The second function is kZDlOhis():

This function deletes the malware from the temp folder.

The last function is frank():

This function displays a misleading message, about a missing DLL that actually doesn’t exists, its a made-up file.

After this, the program terminates.

Execution after bypassing the anti-analysis checks

Now that we know how to bypass the anti-analysis checks, let’s take a look at how the malware actually executes.

This function does most of the work for the malware:

What’s happening in this function is this:

Create the Object ‘ADODB.Stream’ — which in this case is used to write the binary data (the actual malware DLL) to the disk.
Define the Charset of the data to be written
Read through all the arrays supplied in the script with the binary data
Write all that data to the file “planetariam.zip” using the ‘SaveToFile’ function
Position is ‘0’ which means, re-write if file already exists
Close the file

As you can see, all the values in Array are the arrays in the script, with the data to be written. Here’s an example:

This is the function that loads the DLL and executes it:

As you can see, it uses rundll32 to load the malicious dll. The malicious dll is ‘do343.scss’.

The malware also creates a URL file in the temp folder — this can be used as an IOC. It is linked to adobe.com

Malware DLL

Now that we know how to bypass all the anti-analysis techniques this malware uses and how to execute the malware in our analysis machine, let’s get to the final DLL that is the malware LOLSnif.

Among other commonly seen malware functions, this malware also reaches out to the C2 and tries to post the victim machine information.

The DLL in this case works with DGA as we can see with all these requests that are being made:

Conclusion

The dropper for this malware is very complex. The authors have gone to great lengths to make it as hard as possible to analyse the code. There are layers and layers of encoding and obfuscation. To analyse it, you need to peel back each layer one by one, right to the end where it reveals the final payload, the malicious DLL.

Appendix

IOC:

At the time of this publishing, these are some of the Hashes for the LOLSnif DLLs:

9d55833324c088cf385ce6ae914ef21a
e65c0ac2d6964f5866eb9eddf8654f3f
654121216d3c75c83ef202785d5cc0ef
894877146bb0b8ea8adf0ee26e52c1d7
4549708f2a9c381890a5558b2036bc49
dcf79f6af5b4b2b9d46b8a4e0b09b7bd
faa84b171f792d7154d9e38e94199100
948e548aed01218c784b767b91504d18
048b1b3e0781ab1a2f93b0e27644fde0
28b17df90fb856d7e4540ac799094675
057065c30188f1c4c7974946acade6da
52b26eff6f2d5e2763fad705c4204016
059514bbe7fcbe147cdd0ece92172f66
e6be61c83d5d47576963a26f2301c08a
0078f7e4b72461c7e16179c619c15ad8
3f1c0646141e053865a4214108c74068
3b98f77f08f7849e84634b36b77b27b9
44de95961cc70cf2109b01951478e3f2
8930e46553122ff4f3527ec437c8c4c5
bf4af57d8668f8a7f64538b3b5b69e28
ed196535f294b9b7e36ebeb64cf06a68
7dd011fc8fb66696593c532866ff5289
710b94a1accbb727e6fa96f75bde769c
f2468454850c605558c6e959e07483b8
cbf550e52f40c94d791aa44ab40d2e14
30f6d63ae1414f03d8cc48c0b8586515
4e4574bf57096ce027bc92366d0abb10
69c72e594f33f7d5ea82cdccc0222f26
de25f443cc3bd5ccf14d1b514e909bb3
0eee43e53dc9aa16e74f65ad09c5e82b
d9efe81f4a58efa16158a73b1449b803
9661df852aeeff9650fe8ac1a7412c39
5c7bfc85f733cec1370ac6ebbded4762
f7aeb4e1e0576d5a3d60db750282cbb5
1f542cf3e1a239f001bc0c421550ca6a
e35ac0d74c0c1e03b91a4c3083c767f1
02818a3bf4231a7a0a9ce6704a0d9ed0
6abe5757ed3098a45370453280b2864d
6eabc4a1ca7f4e62476a7a52c8be0421
8bbeae7c6067e2da6f5cdc232e271f8a
f41c55c4588a9c37a1ac0eac366ac289
b3af7dd2a66725fb34993083b1c8d005
d6c361f547a7c56c40791098cec92186
79c0cd43ee3fef2daf8c997ddb435a3f
867e462ffcbe4510e03db3b93d846765
4ce855d6e159db31376fd22b264018c8
51303064fdcc6f69898e9f20ed0dde74
b123fb543768cf6946b2be1e0af001ec
784a48688f137a570aad2f5e396f1787
ef75f86a924894fec1dac693d329a7ab
3881063f31833e97c6d3537c098b16a9
30dd0f30a35abf1e135932948d05251d
7fdacd5458f03ea0d20283c5d92a3c4d
1e81d417b57e45a9fc64ddbc64f0d319
420accd30315d90055d902b8e5bef7ad
90ff9d6855c24dacd066d5dce7542d20
70ba2bfeb8b9464bc04b1a27b4b9fd60
0e833ac74e16bb544f5bfbd7832a47f0
50f6f5e7eed54c3d981f33fce45bcfe5
7b97b9083c3a00bdd5f091909b760879

Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835–0E21–4959-BA22–42B3008E02FF}\iexplore\Count

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835–0E21–4959-BA22–42B3008E02FF}\iexplore\NavTimeArray

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835–0E21–4959-BA22–42B3008E02FF}\iexplore\LoadTimeArray

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835–0E21–4959-BA22–42B3008E02FF}\iexplore\Time

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161–30C5–4D22-B7F9–0BBC1D38A37E}\iexplore\Count

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161–30C5–4D22-B7F9–0BBC1D38A37E}\iexplore\Blocked

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161–30C5–4D22-B7F9–0BBC1D38A37E}\iexplore\Time

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

URL Substring:

The best IOC to block if possible is this URL sub-string, it should cover the bulk of the campaign:

*.at/api1/*

URLs:

These are DGA generated so I’, putting these in here only for context.

_malienist_

Search This Blog

LOLSnif Malware

Anti-Sandbox features

Terminate Function

Execution after bypassing the anti-analysis checks

Malware DLL

Conclusion

Appendix

IOC:

Labels

Comments

Post a Comment

Popular posts from this blog

Grinju Downloader: Anti-analysis (on steroids) | Part 2

Grinju Downloader: Anti-analysis (on steroids) | Part 1

TrickBot C2i and Configs March 2019