This is a 16-bit Windows malware sample being analyzed using common procedure:
- Setup VM analysis environment and tooling
- Unpack the binary
- Monitor binary dynamic behavior with various running conditions
- Patch binary to satisfy running conditions
- Reverse the binary and analyze specific area of interest
- Collect artifacts during the analysis
Interesting findings include but are not limited to:
- Use of known packer
- Password protected executin path, after patched:
- Anti-debugger technique#1: IsDebugPresent() check presence of user-mode debugger(stored in PEB::IsDebugged field), this condition leads to TerminateProcess():
-
Anti-debugger technique#2: GetProcAddress()+EncodePointer()+DecodePointer() obfuscates imported function calls using per-process secret, such as GetTickCount():
-
Anti-debugger technique#3: IsProcessorFeaturePresent(17h) checks __fastfail support before proceeding with immediate termination:
- Anti-debugger technique#4: IsProcessorFeaturePresent(0Ah) checks SSE instruction set available and collect CPU ID info:
- Anti-debugger technique#5: SetUnhandledExceptionFilter() + UnhandledExceptionFilter() check presence of debugger by replacing top-level exception handler for all threads. If executable is being debugged, then the custom handler will not be called, result in malware terminates the process:
- Anti-debugger technique#6: SetLastError(code)+OutputDebugString() + GetLastError() check error code remaining condition to confirm debugger free:
-
Anti-debugger technique#7: Read PEB::BeingDebugged flag:
-
Anti-debugging exit flow:
- Malicious processes and dependencies:
-
Malicious COM scriptlet key and content:
-
Trojan get downloaded by Scriptlet using Msxml2.Server XMLHTTP, writes into C:\Users\admin\AppData\Local\Temp\
-
Malicious IPs observed:
- amp-tg-ret.s3.amazonaws.com 52.216.16.168
- www.allyourbasearebelongtous.com 75.119.198.176
- 52.216.130.187:80 (certutil.exe) US
- 92.122.18.115:443 (ie.exe) EU
- 93.184.220.29:80 (ie.exe) EU
- 2.22.146.113:80 (ie.exe) EU
- 104.18.25.243:80 (ie.exe) US
- 152.199.19.160:80 (ie.exe) US