rendari
August 5th, 2009, 16:17
Someone sent me an exe at work, and I opened it on my work computer. Shortly thereafter my firewall blocked explorer.exe. I had the sinking suspicion that I had just been infected, so I fired up Olly and took a look. Looks like the enclosed exe is an exe bundler with the real exe I want and a trojan. They are both extracted to the user's temp folder, the trojan being called bot.exe. The trojan at first glance is legitimate, with a legit import table and just a bunch of user32 calls. However, upon looking closer you will see that the User32 calls are just obfuscation, and in reality it seems like it's setting up to inject some shell code for a privilige escalation exploit? I don't know; the interesting stuff starts here:
It's cycling through kernel32.dll looking for GetProcAddress and LoadLibraryA, from whence it grabs the addresses using a custom getprocaddress. After that I lose track of it, as I am inexperienced in malware debugging and have never written malware before. That's why I decided on posting it here, hope someone might tell me what it does and how badly I've been compromised. I know at least a half dozen other people ran this on their work machines so I need to get in touch with them, as well as the IT department that someone so thoughtfully outsourced to India
But I plan on sitting down with this thing later; which brings up my 2nd question: will VMWare be good enough and sterilized enough of an environment to analyze this SOB out of?
Thanks guys,
-rendari
ATTATCHMENT IS MALWARE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
PASSWORD IS: malware
Code:
004036C5 |. 52 |PUSH EDX ; /s2 => "LoadLibraryA"
004036C6 |. 8B45 BC |MOV EAX,[LOCAL.17] ; |
004036C9 |. 8B8D 30FCFFFF |MOV ECX,[LOCAL.244] ; |
004036CF |. 8B1481 |MOV EDX,DWORD PTR DS:[ECX+EAX*4] ; |
004036D2 |. 0355 DC |ADD EDX,[LOCAL.9] ; |
004036D5 |. 52 |PUSH EDX ; |s1
004036D6 |. E8 FD2F0000 |CALL <JMP.&MSVCRT.strcmp> ; \strcmp
004036DB |. 83C4 08 |ADD ESP,8
004036DE |. 85C0 |TEST EAX,EAX
004036E0 |. 0F85 9E000000 |JNZ bot.00403784
004036E6 |. 6A 00 |PUSH 0 ; /lParam = 0
004036E8 |. 6A 05 |PUSH 5 ; |wParam = 5
004036EA |. 68 82010000 |PUSH 182 ; |Message = LB_DELETESTRING
004036EF |. 68 EE030000 |PUSH 3EE ; |ControlID = 3EE (1006.)
004036F4 |. 6A 00 |PUSH 0 ; |hWnd = NULL
004036F6 |. FF15 C4704000 |CALL DWORD PTR DS:[<&USER32.SendDlgItemMessageA>] ; \SendDlgItemMessageA
004036FC |. 6A 00 |PUSH 0 ; /ObjType = WHITE_BRUSH
004036FE |. FF15 00704000 |CALL DWORD PTR DS:[<&GDI32.GetStockObject>] ; \GetStockObject
00403704 |. 50 |PUSH EAX ; /hBrush
00403705 |. 68 408F4000 |PUSH bot.00408F40 ; |pRect = 00408F40 {0.,0.,0.,0.}
0040370A |. A1 7C8E4000 |MOV EAX,DWORD PTR DS:[408E7C] ; |
0040370F |. 50 |PUSH EAX ; |hDC => NULL
00403710 |. FF15 C8704000 |CALL DWORD PTR DS:[<&USER32.FillRect>] ; \FillRect
00403716 |. 6A 00 |PUSH 0 ; /hDC = NULL
00403718 |. FF15 0C704000 |CALL DWORD PTR DS:[<&GDI32.CreateCompatibleDC>] ; \CreateCompatibleDC
0040371E |. A3 5C8E4000 |MOV DWORD PTR DS:[408E5C],EAX
00403723 |. 8B0D 04BF4000 |MOV ECX,DWORD PTR DS:[40BF04]
00403729 |. 890D 4C8F4000 |MOV DWORD PTR DS:[408F4C],ECX
0040372F |. 8B55 BC |MOV EDX,[LOCAL.17]
00403732 |. 8B85 40FCFFFF |MOV EAX,[LOCAL.240]
00403738 |. 33C9 |XOR ECX,ECX
0040373A |. 66:8B0C50 |MOV CX,WORD PTR DS:[EAX+EDX*2]
0040373E |. 8B55 B8 |MOV EDX,[LOCAL.18]
00403741 |. 8B048A |MOV EAX,DWORD PTR DS:[EDX+ECX*4]
00403744 |. 0345 DC |ADD EAX,[LOCAL.9]
00403747 |. A3 8CBE4000 |MOV DWORD PTR DS:[40BE8C],EAX
0040374C |. 8B0D 00BF4000 |MOV ECX,DWORD PTR DS:[40BF00]
00403752 |. 890D 488F4000 |MOV DWORD PTR DS:[408F48],ECX
00403758 |. 6A 00 |PUSH 0 ; /lParam = 0
0040375A |. 6A 05 |PUSH 5 ; |wParam = 5
0040375C |. 68 82010000 |PUSH 182 ; |Message = LB_DELETESTRING
00403761 |. 68 EE030000 |PUSH 3EE ; |ControlID = 3EE (1006.)
00403766 |. 6A 00 |PUSH 0 ; |hWnd = NULL
00403768 |. FF15 C4704000 |CALL DWORD PTR DS:[<&USER32.SendDlgItemMessageA>] ; \SendDlgItemMessageA
0040376E |. C705 448F4000 00000000 |MOV DWORD PTR DS:[408F44],0
00403778 |. 8B15 04BF4000 |MOV EDX,DWORD PTR DS:[40BF04]
0040377E |. 8915 4C8F4000 |MOV DWORD PTR DS:[408F4C],EDX
00403784 |> 6A 00 |PUSH 0 ; /hDC = NULL
00403786 |. FF15 0C704000 |CALL DWORD PTR DS:[<&GDI32.CreateCompatibleDC>] ; \CreateCompatibleDC
0040378C |. A3 5C8E4000 |MOV DWORD PTR DS:[408E5C],EAX
00403791 |. 6A 00 |PUSH 0 ; /lParam = 0
00403793 |. 6A 05 |PUSH 5 ; |wParam = 5
00403795 |. 68 82010000 |PUSH 182 ; |Message = LB_DELETESTRING
0040379A |. 68 EE030000 |PUSH 3EE ; |ControlID = 3EE (1006.)
0040379F |. 6A 00 |PUSH 0 ; |hWnd = NULL
004037A1 |. FF15 C4704000 |CALL DWORD PTR DS:[<&USER32.SendDlgItemMessageA>] ; \SendDlgItemMessageA
004037A7 |. A1 488E4000 |MOV EAX,DWORD PTR DS:[408E48]
004037AC |. 50 |PUSH EAX ; /s2 => "GetProcAddress"
004037AD |. 8B4D BC |MOV ECX,[LOCAL.17] ; |
004037B0 |. 8B95 30FCFFFF |MOV EDX,[LOCAL.244] ; |
004037B6 |. 8B048A |MOV EAX,DWORD PTR DS:[EDX+ECX*4] ; |
004037B9 |. 0345 DC |ADD EAX,[LOCAL.9] ; |
004037BC |. 50 |PUSH EAX ; |s1
004037BD |. E8 162F0000 |CALL <JMP.&MSVCRT.strcmp> ; \strcmp
It's cycling through kernel32.dll looking for GetProcAddress and LoadLibraryA, from whence it grabs the addresses using a custom getprocaddress. After that I lose track of it, as I am inexperienced in malware debugging and have never written malware before. That's why I decided on posting it here, hope someone might tell me what it does and how badly I've been compromised. I know at least a half dozen other people ran this on their work machines so I need to get in touch with them, as well as the IT department that someone so thoughtfully outsourced to India
But I plan on sitting down with this thing later; which brings up my 2nd question: will VMWare be good enough and sterilized enough of an environment to analyze this SOB out of?Thanks guys,
-rendari
ATTATCHMENT IS MALWARE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
PASSWORD IS: malware
