[Hwp Malware] kimsuky's love is all around

기존 "KINU 전문가 자문 요청사항" (https://sfkino.tistory.com/75)과 동일한 스타일의 악성코드이다. 하나하나 비교하면서 분석해보자.

this malware is the same style with "KINU Expert Advisory Request.hwp" that was released October 2019. Let's analyze it compared to the existing one.

hwp file info

Stage 1. Exploit code & shellcode

EPS 파일의 /ar 변수에 들어있는 익스플로잇 코드와 쉘코드는 기존과 거의 동일하지만, 기존에는 0x00으로 XOR되어있었고, 이번 케이스에서는 0x91로 인코딩 되어있다. 0x91로 디코딩한뒤 익스플로잇 코드와 쉘코드를 비교하면 signature code를 제외하고 모두 동일하다.

exploit code and shellcode in variable /ar is almost same with Previous case, but xor key was changed 0x00 to ox91. comparing exploit code and shellcode after decoding. After decoding and comparing the exploit code and the shell code, they are all the same except for the signature code.

shellcode structure
Previous case 
signature : 0xBE 0x0C 0x79 0x0C
1byte xor key : 0xF5
Decrypt Size : 0x00018E3F

Current case
signature : 0x30 0xE7 0x8D 0x1B
1byte xor key : 0x17
Decrypt Size : 0x00018E3F

복호화된 쉘코드는 기존과 동일하게 HimTrayIcon.exe에 인젝션되고, 인젝션된 쉘코드는 암호화된 악성코드를 복호화하고 userinit.exe 프로세스에 인젝션한다.

decoded shellcode is injection into the himtrayicon.exe just like the previous case. injected shellcode is decrypt malware and inject into userinit.exe process.

Previous case xor key : 0x04C40B86
Current case xor key : 0x18737E1D

Stage2. userinit.exe

userinit.exe 프로세스에 인젝션되는 PE파일의 행위도 기존과 동일하고 c2 주소와 다운받는 파일명, 뮤텍스 이름 만 달라졌다. 공격자는 탈취한 정보를 C2로 전송하고, 추가 악성코드를 다운로드 한다. 다운로드 받은 파일은 기존과 동일하게 0xFF로 xor인코딩 되어있다. 이번 악성코드에서 흥미로운 점은, 이번 악성코드에서 뮤텍스 이름이 잘못 설정되어있다는점이다. 아마 뮤텍스 이름 기입과정에서 실수가 있었던 것으로 추정된다.

malware injected into userinit.exe process was same with previous case, and only the c2 address, the file name downloaded, and the Mutex name have changed. The attacker sends the stolen data to C2 and downloads additional malware. The downloaded file is xor encoded in 0xFF just like before. interesting thing is, it has the wrong Mutex name.i think, the attacker seems to have made a mistake during setup.

invalid mutex name

Previous downloader(up), current downloader(down)

Previous case
Mutex Name : clouds_xys
C2 : hxxp://clouds.scienceontheweb[.]net/img/png/load.png, hxxp://clouds.scienceontheweb[.]net/img/png/download.png?filename=button03
download file name : button03

Current case
Mutex Name : \x00UTEX_NAME
C2 : hxxp://lovelovelove.atwebpages[.]com/home/jpg/post.php, hxxp://lovelovelove.atwebpages[.]com/home/jpg/download.php?filename=lover01
download file name : lover01

Stage 3. downloaded dll

다운로드된 악성코드는 vmprotect로 패킹되어 있다. 하지만 주요 악성행위 자체는 기존과 거의 동일하다. 그러나 기존에는 폴더이름을 defender로 위장하고 있었던 반면 이번 케이스에서는 firefox로 위장하고 있다. 특히, 공격자는 폴더명을 firefox가 아닌 firefax로 사용했는데, 이것이 또다른 실수인지, 의도한 것인진 알수없다. 악성코드가 시스템 정보를 훔치고 난 뒤, 리소스영역에 암호화된 PE파일을 복호화하고 svchost.exe에 인젝션한다.

downloaded malware was protect by vmprotect. and main malicious behavior is same. the change is folder name. previous malware's folder name is "defender", but in this attack, it use "firefax". especially, The attacker used the folder name "firefax" instead of "firefox". maybe it was attacker's mistake. After malicious code steals system information, it decrypts encrypted PE files in the resource area and injects them into the svchost.exe.

Previous case rc4 key : B7F0E346-F6D5-8C67-7D77-F270B6F54003
Current case rc4 key: 1A681C40-119E-5C42-DA59-EE3738930C23

Previous case path info
%AppData%\InstallShield\defender : iertutil.dll (self Copy)
%AppData%\InstallShield\plugin_defender : tader.wav (keylogging data & process info) %AppData%\InstallShield\upgrade_defender : Encrypted stolen info

Current case path info
%AppData%\Mozilla\Firefax : iertutil.dll (self Copy)
%AppData%\Mozilla\Ext : tader.wav (keylogging data & process info)
%AppData%\Mozilla\plug_in : Encrypted stolen info

comparing downloaded malware 

Stage 4,5. svchost.exe & iexplorer.exe

stage 4,5도 기존과 동일하다. svchost.exe에 인젝션된 악성코드는 탈취한 정보를 압축하고 암호화한 뒤 iexplorer.exe에 악성코드를 인젝션하고 파일 업로드를 요청한다. iexplorer.exe는 mutexname_0으로 명명된 Mapping File을 읽어와 upload, download에 따라 daum email service에 접속해 시스템 업로드한다.

stage 4 and 5 is same too. malware injected into the svchost.exe compresses and encrypts system information, injects malware into the iexplorer.exe, and requests file uploads. malware injected into iexplorer.exe is reading from Memory mapped file, named "mutexname_0", malware login the following mail and upload or download files according to the command.

comparing malware injected into svchost.exe 

Stage 4,5의 플로우 차트는 다음과 같다.

The flow chart of Stage 4 and 5 is as shown in the picture.

stage 4,5 flowchart

priv mutex : CD407FA1-5EAF-4846-BB2C-B48138D5429B
priv mapping file : CD407FA1-5EAF-4846-BB2C-B48138D5429B_0

current mutex : 5B7A0E69-824F-BD24-D790-7FCA2FA1418C
current mapping file : 5B7A0E69-824F-BD24-D790-7FCA2FA1418C_0

Conclusion

내생각에............................... 이악성코드는......................................... 모르겠다.
언젠가 킹갓분석가 @navsi가 분석해 줄거야.
그러니 즐거운 주말보내세요!

hmm............... i think........it......... was .......... i don't know!.
maybe One day, King God analyst @navsi will analyze it.

have a nice week end!

 

IOC's & Artifacts

북한의 회색지대 전략과 대응방안.hwp
md5 : C73225F976100AB972934F31B61EABCC
sha1 : 2FD6AD80E0FACBB2E9C46734035E190333F0EFE3
sha256 : C6661195693D0F09D70C643F87194282593EF0D6A0E349720310D760D002E062

decrypted malware
md5 : 22BEA8086D87FAC45B85BEA9E81CA142
sha1 : 0EF06518DFCE6641B2002C3C924A770D5E579891
sha256 : A869624BCD3FBA754DEC27FD7B04046455F6929DB7BF117CCA215B78B0889C79

downloaded malware (0xFF encoded)
md5 : 77F67E93C8BDEA2CE9A66012B5EA2929
sha1 : 55AE82C3D83E95B93AAC9047B5AC35B72CC29BC2
sha256 : 1DB71AF7956F90AF9544C370A9DD3570CFBE04010C7608E5A160B997CF134F89

downloaded malware (0xFF decoded)
md5 : 8F8AA835E65998DD472D2C641AA82DA5
sha1 : F9B8645BCB399E48B046BDD96F33B4B0FED1598E
sha256 : 04F9579865C6611AFD27FED6ACAF8581C662B52B817FBC9007455E046C73A05E

svchost.exe injected malware
md5 : 70EC91D17B55980036351C70B2CBE3A0
sha1 : 3F64D8526190607541DB64981E38255ADBAD981C
sha256 : 0C457E1800DC1E516D97BEF2C8F05C7D9CBB461B45F9257E958C5D88EA7C5EC8

iexplorer.exe injected malware
md5 : 327865FA4009FC6A4D2EAD8AA523EEFF
sha1 : B889A52BE4E070FDEBED48392574029766FE603D
sha256 : 55689D91DF8435A5040ABD591537BD6893166E402E6E5610E49BE76384EF9F1D

C2
hxxp://lovelovelove.atwebpages[.]com/home/jpg/post.php hxxp://lovelovelove.atwebpages[.]com/home/jpg/download.php?filename=lover01

Mutex Name : \x00UTEX_NAME
rc4 key: 1A681C40-119E-5C42-DA59-EE3738930C23
path info
%AppData%\Mozilla\Firefax : iertutil.dll (self Copy)
%AppData%\Mozilla\Ext : tader.wav (keylogging data & process info)
%AppData%\Mozilla\plug_in : Encrypted stolen info

email info
id : 30000.song@daum.net
pwd : ****(Not Open)
send to : flower9801@hanmail.net

Related posts.(in this blog)

[JustForFun] VMProtect Windows API Address Decoder 개발기

[Hwp Malware] kimsuky group's attack using hwp malware

Related posts

 

'북한의 회색지대 전략과 대응방안' 한글문서(HWP) 유포 중