The bad, worse and the horrible
by Gunnar Guðmundsson and Axel Marinho Guðmundsson
In this article, we look at a malware payload from an exploited Microsoft Word document. With a little Python scripting and deciphering we research a single sample and gather a few more versions to view a history of active development.
Recently we received a malicious DOCX document format containing an embedded Visual Basic script designed to download a compressed .hta payload.
Figure 1 Visual Basic script
The .hta file had an obfuscated function that downloads a PowerShell script disguised as a .php file that hides the following function:
The downloaded script includes 11 files, obfuscated and compressed to hinder static analysis. After rewriting the de-obfuscation methods and acquiring the files hidden within, we discovered that the script hides a remote access trojan.
Figure 2 Simple attempt to evade sandbox analysis
The downloaded script checks the execution environment and closes the script if it detects that it is being run in a folder with a particular set of names, such as avast, avg, sample, malware, sandbox or virus. This logic is to avoid analysis. The program continues execution if these conditions are not met. The malware authors use the backtick symbol to make it difficult to read their code. After removing this character, the names of the files and paths become clear. However, the authors also used string concatenation for another layer of code obfuscation.
The malware relies on a PowerShell script to do its dirty work by creating a pair of values with two distinct functions. Those functions use elaborate ways to obfuscate the routine of the malware, such as using bitwise operations, gzip compression, and base64 encoding.
The methods mentioned above are used throughout the malware.
Figure 3 Example of a path decryption function
Figure 4 Obfuscated string to binary function
Figure 5 Rewritten string to binary function
The method works by parsing segmented strings and pairing them with a corresponding value, such as an index. The string is then assembled and base64 decoded, revealing a compressed .gzip file. The string is then converted to binary before the file is decompressed, another layer of base64 encoding once decrypted a correctly formatted binary file appears.
Figure 6 Obfuscated string concatenation
The malware relies on commercial software called NetSupport Manager. NetSupport Manager is employed worldwide as a remote administration tool used in education and business environments. In our case, NetSupport Manager sets up remote access on the affected system. In the case of this malware, the remote access is without the users’ consent and knowledge, turning legitimate software into a remote access trojan (RAT).
After the files have been decoded and saved, the script adds a presentation host executable to the host system environment variable. The executable runs on startup. The Presentationhost.exe is then executed and remote access is established. The script then deletes the PowerShell and text files after execution, removing most of their traces.
Figure 7 Setting presentationhost.exe to run on startup
The result of a successful infection means the attacker now has a beachhead inside the victim’s network and can do whatever he pleases: steal information, install malware or ransomware remotely, or just passively gather network intelligence for further exploitation. Net Support Manager is a feature-rich remote management tool – its functionality is only limited by the attacker’s imagination and resources. In cases the is sold to a different threat actor, an infection can spell disaster for corporate targets.
Samples From the Wild
Interestingly, there are several samples of the same malware gathered from VirusTotal at various stages of development using the exact variable names and methods and implementing them one by one. We cannot confirm that this is the order of development from the submission dates alone, but the presence of the same variables and methods implies that the files are related.
The rudimentary detection of debug environments was present in all samples gathered.
The least developed sample is submitted at 2022-08-18 16:25:12 UTC
In the least developed sample, only the first three encoded files are present. The structure of the file is the same, but variables differ. The string to binary conversion function is present along with its ability to decompress the strings embedded into the file. There is no persistence on system reset or self-delete after infection written into the script. The functions look structurally the same, the string arrays and index numbers are numerically different but structurally the same; while the resulting dropped files are the same as later samples, the order in which the files are decoded in the document is the same. This seems to be a non-functional version as one of the binary strings does not drop a file properly despite our best efforts.
Second sample is submitted at 2022-08-13 16:43:08 UTC
It is the same as the first sample, but it adds a 4th file msver100.dll to the list of dropped files. In addition, the scuffed file has been repaired.
Third sample is submitted at 2022-10-13 16:29:04 UTC
This version looks like the first version of the current payload version and shares the decryption functions with the exact variable names. The strings used to encode the file strings and the indexes used to assemble and decode the strings, are the same as in the sample we reversed and deciphered.
Fourth sample is submitted at 2022-10-18 17:29:17 UTC
This is where the malware starts resembling the final form. The total files dropped are now 10 with Nskbflter.inf, nsm.ini, nsm.lic, pcicapi.dll, pcicapi.dll, pcicehk.dll, pcicl32.dll added from the earlier iteration. There are no remarkable additions to the functionality besides the added files.
Fifth sample is submitted at 2022-10-13 15:11:32 UTC
In this version, the author establishes persistence by adding itself to the startup routine of the host system. It also cleans up the files created and removes the PowerShell script once it was executed. The author adds tclltl32.dll file to the list of dropped files.
Indicators of Compromise