Tracur Malware Analysis part3

From UIC

Tracur.b Analysis - Part 3

Tracur Malware Analysis part3
Author:	Quequero
Email:
Website:	http://quequero.org
Date:	04/02/2011 (dd/mm/yyyy)
Level:
Language:	English
Comments:	Time to catch the spamming thread!

Tracur.b drops an executable that's used to perform one single tasks: spam the user. The executable's analysis is not tough at all since the malware coder left debugging information into the project, speeding up a lot our reversing session. Therefore the code we are going to analyze will be very straightforward and we'll figure out what's going on very easy. Enjoy the reading and don't forget to take a look at the first and second part if you've missed them.

Lsass.exe

Lsass.exe is the executable's name we're dealing with. It's not hidden using rootkit techniques so you can simply grab it from the following path:

%APPDATA%\SysWin\lsass.exe

pretty easy to spot.

Unpacking

Now load it into OllyDbg and soon you'll notice that's packed with the same packer we've analyzed in the first and second part, simply step till you get here:

Just dump it and you'll be done, remember to remove any unwanted byte from the byte.

Analysis

Let's go straight into the code, run IDA and let her crunch your lsass.exe, you'll soon notice that the first action performed by the WinMain() is to start a new thread:

This thread performs a really easy task, follow the code to the ThreadAddToStartup routine:

this function simply retrieves Windows version and username, consequently it registers a new registry key used to autostart the executable:

Key name is: RTHDBPL, we've already met it in the previous part, pointing to the initial directory: %APPDATA%\SysWin\lsass.exe or %windir%\lsass.exe. At this point we know that:

1. This component autostarts using the registry
2. This component is not called/run by the malware dll...
3. This component creates a mutex called SERPv2 (look into the WinMain() body)

Except for a lot of calls to OutputDebugString() and a dead-branch that leads to a DebugBreak() call (hey coder, where was your brain while you were writing the code?!?!?!), there are only a few interesting functions to examine.

SetKillSelfKey

This is a dummy name I've invented for the following function:

That's obviously a leftover of a debugging version:

What's this call for? Actually it checks for the user under which the malware is running on, if it's system a variable is set up like this:

• "HKEY_LOCAL_MACHINE/Software"

if it's not system the variable is set up like this:

• "HKEY_CURRENT_USER/Identities"

The code that follows this initialization will simply:

1. Create a key with the just set up name
2. Set a REG_SZ string with the name KillSelf to value ok
3. Wait for 550ms
4. Remove the key
5. Print "Asta la vista" to the debugger

Apparently it's used as a test function to inactivate the malware, the reason I suspect it is simply because after setting the key there's a wait loop, most probably used to let another part of the malware to read and acknowledge it. My suspect were confirmed after finding the following function:

This is almost the same code used in the previous call, this is what it does:

1. Checks the username to see if it's system or not, and initializes a variable
2. Opens the registry key KillSelf and retrieves the value
3. If the value is ok, it will kill the thread and print I am killed!

Spam Thread

This module is mainly used to spam, and it's not really hard to get it, let's begin with the following thread-routine:

That's a simple loop that just call EnumWindows every 1 second, what's interesting is the callback function, translated here to pseudo-code for the sake of simplicity:

So basically this is what happens:

1. A browser window is identified looking for Explorer, Opera, Chrome or Firefox in the window title
2. A spam-type is retrieved using the window title (we'll delve into this later)
3. A new "popup" is opened using a particular URL

Let's go a bit deeper into the analysis, the GetSpamType() function is pretty boring but easy to understand, here's just a piece:

A keyword is identified into the window title, and a string that's related to the identified topic is returned. So if we are browsing a casino webpage, the related string will be casino, if we browse for medicines, the related word will be pharma and so on. This string is used to create a popup that's related to what we are looking at. That's a smart move from the malware author ;p and it's called: targeted advertisement. So after identifying the topic of the page, and getting the current local time, a request string is built that will appear like this:

• http://roxifind.com/se.php?pop=1&aid=aGlkZGVu&sid=<local time>&key=<topic>

Live Running

Let's start our VM and let's see what happens when this part of the malware is running. First of all we should take a look at the registry when the system is clean:

And this is the same entry after running Tracur:

We have the malware version as the first value, that's actually 30, the installation date, the last date the malware ran, and some info about the popup presented to the user. Before testing the spamming capabilities let's open DebugView to see what are the messages sent to the debugger:

Basically almost all the debug messages have been left intact, there are still traces of functions removed in the disassembly, but most of them are still complete. It's now time to open a browser and to look for a keyword in google, I've used cialis because it's the first one in the list, but you can search for any word listed into the disassembly. As soon as we hit the return key here's what happens:

On the left we have the window where I was looking for cialis, on the right there's the spam page. At the time of writing, the spam URL has been redirected to Wikipedia, even though when I started writing this tutorial it was still active. Anyway take a look at how the string has been built. This mechanism is pretty rough, but works someway ;p. We can now test the self-killing capabilities of the malware thread by setting up the "KillSelf" key into the registry:

Wow it worked ;p

Malware Intelligence

After analyzing the whole malware we can try to infer some conclusions: first of all the malware uses at least four different components:

1. A packer
2. A dll
3. A downloader
4. An executable

At least 3 different entities took part into the malware coding, maybe indirectly. In my opinion the job has been shared in this way

1. Someone coded the packer for some kind of group/crew
2. Someone else coded the dll and recompiled the gnutella client into a DLL
3. Someone else coded the executable

I'm pretty sure that the DLL and the executable have been coded by different people, this is due to the fact that the writing style is very different from each component. More exactly my opinion is the following: some crew/group developed the DLL(s) and the packer, the DLL code has been shared/sold to other people that added the executable module into the dropper, and then released it in the wild. For this reason I'm also pretty sure that somewhere on the internet this DLL was wandering around alone, in similar forms but without the .exe attached, before this crew made Tracur.b. Some other clues points to the fact that we are dealing with at least two persons: the DLL and the packer requires some knowledge, and even without being sophisticated, they can accomplish their jobs. The executable module instead uses a very rough trick to spam the user, and there are a lot of mistakes into the code itself. So if you ask me we are dealing with at least two different coders. Let's take a look at the .exe resources to see if we're able to extract some more information:

Is Andreas Hausladen the malware coder??? No clearly not ;p, he's only the developer of dcc32speed.exe that's a module used to speed up Delphi's IDE ;p, that's the most we'll be able to gather from the executable. We can suppose that this variant of Tracur was coded in east Europe since the main node used by the DLL is in Moldova, but the other nodes are in Holland so we can't really be sure about that.

That's all folks :), time to start with the next malware... Just let me find one that's interesting enough ;p.

Disclaimer