Tracur Malware Analysis

From UIC

Tracur.b Analysis

Tracur Malware Analysis
Author:	Quequero
Email:
Website:	http://quequero.org
Date:	21/12/2010 (dd/mm/yyyy)
Level:
Language:	English
Comments:	Let's start with malware reversing!

Tracur.b analysis

In a previous tutorial we have shown how to deal with malware, this time we'll go through the analysis process of a real malware found in the wild. In this case we are going to deal with Tracur.b a variant of Tracur malware, we will get infected and we'll try to understand what's going on the infected machine, and what this malware is capable of. So fire up your debugger and get ready for the fun!

Tools

First of all we'll need a few tools:

• VMware, VirtualBox, Parallels or any other virtual machine with Windows installed (I used Windows XP SP3)
• LordPE or any other memory dumper (OllyDump will do as well if you use OllyDbg v1)
• OllyDbg, any version
• RegShot
• SysAnalyzer
• ProcessExplorer

Of course you will need Tracur.b executable, grab it from the UIC Malware Kickstart Package, password is: infected.

Malware Identification

This malware is identified from the various AV vendors with the following names:

• AhnLab-V3 (Dropper/Win32.Agent)
• AntiVir (TR/Katusha.2.8)
• Avast (Win32:Dracur-E)
• Avast5 (Win32:Dracur-E)
• AVG (Downloader.Generic10.AFIX)
• BitDefender (Gen:Variant.Katusha.2)
• Comodo (MalCrypt.Indus!)
• DrWeb (Trojan.DownLoader1.31906)
• Emsisoft (Virus.Win32.Dracur!IK)
• eSafe (Win32.GenVariant.Kat)
• F-Secure (Gen:Variant.Katusha.2)
• Fortinet (W32/TRACUR.SMDI!tr)
• GData (Gen:Variant.Katusha.2)
• Ikarus (Virus.Win32.Dracur)
• Kaspersky (Trojan-Dropper.Win32.Agent.dikg)
• McAfee (Artemis!F7F27B3DDEE9)
• McAfee-GW-Edition (Artemis!F7F27B3DDEE9)
• Microsoft (TrojanDownloader:Win32/Tracur.A)
• NOD32 (Win32/TrojanDownloader.Tracur.B)
• nProtect (Gen:Variant.Katusha.2)
• Panda (Trj/CI.A)
• Prevx (Medium Risk Malware)
• Rising (Trojan.Win32.Generic.5240387C)
• Sunbelt (Trojan.Win32.Generic!BT)
• TheHacker (Trojan/Downloader.Tracur.b)
• TrendMicro (TROJ_TRACUR.SMDI)
• TrendMicro-HouseCall (TROJ_TRACUR.SMDI)
• VirusBuster (Trojan.Katusha.LAQ)

Analysis

Turn on your preferred Virtual Machine, but one point must be very clear: a virtual machine is _not_ an added security layer, malware can (and in some cases will) escape the cage, so be careful!, the simple fact that you're using a virtual machine doesn't imply that the most advanced malware will stay there. You've been warned :).

Disable drag and drop support from the VM to the host computer and disable any shared folder from and to the VM. While it is true that escaping the VM can be a bit hard, it is also true that most of the malware will spread through usb-sticks and shared folders. At this point make a snapshot of the current environment, since you'll need a clean system every time you'll start a new analysis.

Run RegShot and take a registry snapshot, optionally you can save the hive for later comparisons. Run SysAnalyzer and check the option Use Directory Watcher, select your file and... Are you ready?

Dropping

Click Run! on SysAnalyzer and after a few seconds Tracur will be up and running, sometimes the malware will crash because there seems to be some problems with threads injected into other processes ;p, anyway... Looking at SysAnalyzer, comparing RegShot snapshots and even by looking at process explorer we are able to find out what happens behind the curtain of the dropping process. Let's summarize it:

1. fundisc32.exe is launched
2. fundisc32.exe copies itself in c:\windows\system32\ with a random name that mimics and already existing file (like: dfrgsnap32.exe)
3. The newly created "fundisc32.exe" is run
4. This new process installs itself as a service (like: Autostarter or DCOM Server Process Launcher etc...)
   1. netsh.exe is launched to add a firewall rule that allows its own traffic
   2. A DLL is spawned (plustab32.dll, regsvc32.dll, perfos32.dll etc...)
      1. The DLL install itself as an IE BHO (Browser Helper Object)
      2. The DLL register itself as a WinLogon entry to be loaded at logon-time
      3. The DLL downloads and runs a GNUtella client...
   3. A file, called always lsass.exe, is spawned here: C:\Documents and Settings\Administrator\Application Data\SysWin\lsass.exe
      1. lsass.exe installs itself in the registry using the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run, name RTHDBPL value C:\Documents and Settings\Administrator\Application Data\SysWin\lsass.exe (unlike other names, these values are fixed)

Figuring out the order listed above won't always be your first task, expecially because more often than not, you'll have to find out what's the role of every component. This is true for Tracur as well, so don't get upset if you are not able to understand what's going on just using RegShot, SysAnalyzer and so...

Component Analysis

Tracur is up and running... We now need to analyze what kind of actions are actually being performed from every part of the malware. Let's begin with the first executable, that is: fundisc32.exe.

Fundisc32.exe

Try to load fundisc32.exe into IDA and you'll soon find out that it's packed/encrypted, what you are going to find after the unpacking routine will be something like this:

We need to revert to the good old debugger ;p, so open OllyDbg, configure it to stop at WinMain() and run the program. OllyDbg, if you're using the default configuration, will soon stop asking to press Shift+F9 to pass the exception to debugged program, keep doing that until you reach the entry point, that should look like this:

Prepare your best finger: this packer uses a awful lot of junk code and to bother you, 99% of the call instructions will never return, so be sure to trace the code using only step in or F7, otherwise you'll lose control and you won't be able to unpack anything. That said, the packer will allocate a memory into the heap using VirtualAlloc, packed code will consequently be written in that area and after that, re-aligned code will be written back on the .text section of the original mapped executable. Of course don't forget to use hardware breakpoints instead of software breakpoints since we are dealing with code that rewrites itself. Eventually you'll find the point were unpacked code will be written back:

Take a look ad esp+4:

The address will point to the unpacked executable, try to dump it and you'll find:

It really seems the beginning of some .exe/.dll ;p, stop here, open LordPE, choose your process, right click and select Dump Region:

The section is easily recognizable since it's the only one marked as XRW. Dump it, save the dump, open it with any hex-editor and remove everything from the beginning until you'll find the MZ signature. Cool, you have your unpacked fundisc32.exe (password, as usual, is: infected).

Let's go back to IDA, we need to find out what the program is doing... And it doesn't seem too hard, take a look at the disasm:

What's happening here? The process makes room into the heap and decrypts the DLL in memory, decrypted content is then written on disk with a pseudo-random name, the library is loaded and run either by calling one of its exported functions (DllRegisterServer()) or by using a direct call to rundll32.exe.

Just below the already examined section there's another one, very similar, that instead of loading a dll, runs a copy of fundisc32.exe from c:\windows\system32\_something_32.exe.

Let's take a look at another interesting bit of code:

Here the process is enumerating services, taking one at random to copy its name, then a new service is created (using the already existing name) pointing to the copy of fundisc32.exe that's located in system32 directory, then after adding a rule to allow its traffic (and the DLL's traffic) through the windows firewall, the service is run.

This is most of the interesting job in fundisc32.exe, other actions are performed but they are not as interesting as those we've seen right now, since most of them are maintenance routine used to restart the service, start the dll (in 32bit or 64bit environment), monitor it, manage events and so on...

In the next part we'll analyze the spawned dll where most of the fun is. We'll see how the DLL injects itself into some processes and why. Next part is gonna be more challenging that this one :).

Greetings

Greetings goes to Andreageddon, Evilcry, PnLuck, Antelox, Evolution and all the other guys that are helping UIC to move forward. :)

Disclaimer