### "Hidden malware" write-up ###### m4drat - August 25, 2019__table of contents__:- [info](#info)- [investigating pcap](#investigatin-pcap)- [investigating memdump](#investigatin-memdump)- [reversing](#reversing)- [tldr](#tldr)
#### infotask files:  1. .pcap file with virtual machine traffic2. virtual machine memory dump
task hints:  1. Take a closer look at the intercepted traffic. Which process initiated the connection and on which port?2. What do you know about process-injection malware
#### investigating pcapThis .pcap file has many data in it, but as we know the most interesting part is always in tcp streams, so lets take a closer look on them:  ![pcap](https://i.imgur.com/6mYSHGJ.png)  There are only 2 of them, so we can check them by hands:  The first one looks like something default for windows:  ![pcap-1](https://i.imgur.com/i9tDYpu.png?1)  But the second one don't:  ![pcap-2](https://i.imgur.com/13GWwnQ.png)  This is definitely a malware communication session with CNC. And as we can see it read's file `flag.txt`, transfers encrypted content to CnC, and later deletes it. So we somehow need to restore content of this file. Lets start investigating memory dump.
#### investigating memdumpTo begin with, using volatility, we need to find out what system we are working with:  - `py -2 vol.py --file ./memdump.mem imageinfo`  ![imageinfo](https://i.imgur.com/3br8NTg.png)  - Okay, now we know, that it was `Windows 7 Sp1, x64`, lets check `pslist` using this command: `py -2 vol.py --file ./memdump.mem --profile=Win7SP1x64 pslist`![pslist](https://i.imgur.com/xR8LuaS.png)  But there is nothing really interesting... We need to dig deeper.- Lets check network connections (because we know, that malware definetely communicated with CnC on known port: 63792) using this command: `py -2 vol.py --file ./memdump.mem --profile=Win7SP1x64 netscan`![netscan](https://i.imgur.com/fM4leZw.png)  That looks much interesting right now, because we managed to find which process opened port, that we are searching for. It's `explorer.exe`. Stop, what?! Explorer.exe? Default windows app, that shouldn't open any network gates?.. Yep, that's it. The answer for this weird behaviour can be found in second hint: `What do you know about process-injection malware`. After this information all that we need to do, is to find appropriate dll, that is loaded by `explorer.exe`. Lets do it!  - To view all loaded dll's that belongs to specific process we can run this command: `py -2 vol.py --file ./memdump.mem --profile=Win7SP1x64 dlllist -p 1776`, where -p is pid of target process:  ![dlllist](https://i.imgur.com/7PU0DUR.png)  Everythinhg looks fine excluding just one module 'update_agent.dll', that looks suspicious... Lets dump this dll, and take a closer look on it.  - To dump specific dll we can use this command: `py -2 vol.py --file ./memdump.mem --profile=Win7SP1x64 dlldump --pid=1776 -D ./out --base=0x000007fef0f40000`  ![dlldump](https://i.imgur.com/VvKbyaf.png)  Now, when we have dll we can start reversing it.
#### reversing- let's open it in IDA and look at the strings  ![strings](https://i.imgur.com/eyS735N.png)  - Looks like we've found what we are looking for. Using xrefs for this string we can find function, where main logic is.  ![cmd](https://i.imgur.com/dwNjB1y.png)  - Highlighted blocks represent enum switch-case construction. And that can be confirmed through decompiler view:  ![decompiled](https://i.imgur.com/UrEOAca.png)  - So now we need to find command, which reads, and encrypts target file. And here it is. After a bit of reversing we managed to find it:  ![read_file](https://i.imgur.com/CDWYaz8.png)- Now we need to understand which cryptographic algorithm is used. Lets take a look at `Encrypt` function (i've already reversed it):  ![Encrypt_fnc](https://i.imgur.com/Pc7Lau1.png)  Seems like it's initialising something. And then calls two interesting functions: `KSA` and `PRGA`. Where `KSA` looks like this:  ![KSA](https://i.imgur.com/nYSnIKB.png)- After some time its really easy to understand, that used algorithm is `RC4`, so now we just need to get key, and ciphertext (which we already have from .pcap). Key can be found using xref's to `key` variable. It will allow us to find unrecognized function, which initializes this vector with values, that looks like key...  ![key](https://i.imgur.com/jBGqVXl.png)All we have to do now is copy them and decrypt the flag.  ![flag](https://i.imgur.com/SVeFM9g.png)
#### links1. [reversing c++ in IDA](https://blog.0xbadc0de.be/archives/67)2. [c++ malware](https://www.youtube.com/watch?v=o-FFGIloxvE)3. [RC4 in c++](https://www.youtube.com/watch?v=CiJocXXMXK4)