Microsoft Word - Dropper.Agent D.doc

Size: px

Start display at page:

Download "Microsoft Word - Dropper.Agent D.doc"

희아 망절
6 years ago
Views:

1 Dropper/Agent D Analysis 1. 개요잊을만하면한번씩사회공학기법 (Social Engineering) 을이용한악성코드가출현했다. 이번에는첨부파일인 Police.exe 를확인하고경찰서로출두하라는내용과함께불특정다수에게유포되었는데아마메일을받고도둑이제발저린다고순간뜨끔했던사용자들도있었을것이다. 이문서에서 Dropper/Agent D( 이하 Agent D) 에대해서최대한 <?> 상세하게분석해보자. 2. VirusTotal Scan Result AhnLab-V Dropper/Agent D AntiVir TR/Agent Authentium W32/SYStroj.N.gen!Eldorado Avast Win32:Trojan-gen {Other} AVG Worm/Agent.N BitDefender Trojan.Generic CAT-QuickHeal Rootkit.Agent.btu ClamAV Trojan.Agent DrWeb Trojan.DownLoad.1178 esafe Rootkit.Win32.Agent. etrust-vet Ewido Rootkit.Agent.btu F-Prot W32/Backdoor2.CGEO F-Secure Rootkit.Win32.Agent.btu Fortinet W32/Agent.BTU!tr.rkit GData Trojan.Generic Ikarus T Rootkit.Win32.Agent.btu K7AntiVirus Rootkit.Win32.Agent.btu Kaspersky Rootkit.Win32.Agent.btu McAfee Generic BackDoor.t Microsoft NOD32v probably a variant of Win32/Genetik Norman W32/Rootkit.OVH Panda Suspicious file PCTools Prevx1 V Rising Backdoor.Win32.Undef.bio Sophos Sus/Behav-1009 Sunbelt Rootkit.Win32.Agent.btu Symantec TheHacker TrendMicro BKDR_PCLIENT.AR VBA Backdoor.Win32.Agent.oog ViRobot Trojan.Win32.RT-Agent VirusBuster Webwasher-Gateway Trojan.Agent

2 :02(GMT +09:00) 에 police.exe 를 VirusTotal 에돌려보면위의진단결과처럼대다수의백신이진단하고있음을알수가있었다. 3. BinText String & Hash Analysis (3-1) BinText String Analysis [String Information] - Dropper Function: Agent D 내부에포함된또다른 MZ-PE 구조를가진파일을생성할때 (String:Dropper) 00001F (String:Dropper) 00002AFD FD (API:FileDrop==) E E8 (API:FileDrop==) A A (API:FileDrop==) (API:FileDrop==) E E6 (API:FileDrop==) C C (API:FileDrop==) 0000EF (API:FileDrop==) 0000EF !This program cannot be run in DOS mode. 0!This program cannot be run in DOS mode. 0 SizeofResource 0 LoadResource 0 FindResourceA 0 FreeResource 0 CreateFileA 0 CopyFileA 0 WriteFile - Web Connection: Web 에접속하여추가로어떤행위를하려고할때 (String:GetURL=) 0000F9C FC6 0 Referer: (String:GetURL=) 0000FAB B0 0 (String:NoIfDir) 0000F F52 0 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; MyIE 3.01)Cache-Control: no-store, must-revalidate (API:ConnectURL) 0000F B80 0 InternetOpenUrlA (API:ConnectURL) 0000F B94 0 InternetOpenA (API:ConnectURL) 0000F B58 0 InternetReadFile (API:ConnectURL) 0000F56C 00410B6C 0 InternetCloseHandle - Stealth Function: 자신을은폐시킬때 (API:Stealth===) C C (API:Stealth===) A AA8 (API:Stealth===) (API:Stealth===) (API:Stealth===) (API:Stealth===) CA CA 0 KeServiceDescriptorTable 0 Can't find KeServiceDescriptorTable 0 IofCompleteRequest 0 IoDeleteDevice 0 IoDeleteSymbolicLink 0 ntoskrnl.exe - File Control: 특정프로세스를종료또는삭제그리고레지스트리설정할때 (API:FileRun===) 0000F ShellExecuteA (API:FileDel===) 00001A1C C 0 DeleteFileA (API:ProcKill==) 0000EE7A A 0 TerminateProcess (API:Registry==) 00001B0A A 0 RegSetValueExA (API:Registry==) 00001B1A A 0 RegCloseKey (API:Registry==) 00001AFA FA 0 RegOpenKeyExA (API:FileHandle) 0000EF2A A 0 GetFileSize (API:FileHandle) 0000F25E E 0 SHGetFileInfoA (API:FileHandle) 0000ED FindNextFileA (API:FileHandle) 0000EDD D6 0 FindFirstFileA (API:FileHandle) 0000ED FindClose - Service Control: 특정서비스를제어할때 (API:Service===) 00001B6E E 0 CloseServiceHandle - 2 -

3 (API:Service===) 00001AEC EC (API:Service===) 00001B (API:Service===) 00001B5E E (API:Service===) 00001B (API:Service===) 00001B (API:Service===) 00001B (API:Service===) 00001B [/String Information] 0 OpenServiceA 0 OpenSCManagerA 0 StartServiceA 0 QueryServiceStatus 0 ControlService 0 QueryServiceStatus 0 ChangeServiceConfigA 지금까지분석한악성코드가사용하는문자열이나 API 를 DB 화한후매칭시키는방법으로얼마나일치하는지비교해본결과 String 은좀부족하지만위에나열된 API 들을통해서 Agent D 가대략적으로어떤행위를한다는것을유추할수있었다. (3-2) Hash Analysis File: C:\TempDir\Police.exe Size: bytes MD5: CE2F09ED6BB0EF6EBE7808A817BD7F79 SHA1: D2A5338AEEA7A B862A4AAF1DC2D8A60 CRC32: 858B8CF8 4. Technical Analysis (4-1) %SYSTEM%\Drivers\beep.sys 대체하기 Beep.sys 는원래윈도우 OS 에존재하는정상파일이다. 그러나요즘악성코드들이정상 beep.sys 를삭제하고자신의존재를은폐시키기위한루트킷드라이버로서 beep.sys 파일을생성하고있다. 일단아래루틴을통해서정상 beep.sys 의존재여부를검사한다. //--- %SYSTEM%\drivers\beep.sys 찾기 ---// 00401C5A push 100 ; /BufSize = 100 (256.) 00401C5F. 50 push eax ; Buffer 00401C60. FF15 A call dword ptr [<&KERNEL32.GetSystemD>; \GetSystemDirectoryA 00401C66. BF AC3B4000 mov edi, 00403BAC ; ASCII "\drivers\beep.sys" 00401C70. 8D lea edx, dword ptr [esp+10] Stack address=0012fe24, (ASCII "C:\WINDOWS\system32") edx=7ffb C74. F2:AE repne scas byte ptr es:[edi] ;[edi]="c:\windows\system32\drivers\beep.sys" 00401C94. E8 37FFFFFF call 00401BD0 정상 beep.sys 를삭제하기위해서는 sfc_os.dll 에서제공하는 Export 함수를우회한다. 좀더쉽게말하면윈도우에서는시스템파일이삭제되면시스템변경및복구관련메시지를출력하지만악성코드에서관련 Export 함수를우회하므로메시지가출력되지않는다. //--- 파일보호우회하기 ---// 00401C05. 83C4 08 add esp, C B4000 push 00403B68 ; /FileName = "sfc_os.dll" 00401C0D. FF call dword ptr [<&KERNEL32.LoadLibrar>; \LoadLibraryA Executable modules, item 7 Base=76C10000 Size= ( ) - 3 -

4 Entry=76C1F03A sfc_os.<moduleentrypoint> Name=sfc_os (system) File version= (xpsp Path=C:\WINDOWS\system32\sfc_os.dll 00401C13. 8BF0 mov esi, eax ; eax=76c10000 (sfc_os.76c10000), esi=00403bbe (Police.00403BBE) 00401C19. 6A 05 push 5 ; /ProcNameOrOrdinal = # C1B. 56 push esi ; hmodule, esi=76c10000 (sfc_os.76c10000) 00401C1C. FF15 BC call dword ptr [<&KERNEL32.GetProcAdd>; \GetProcAddress 00401C22. 8D lea edx, dword ptr [esp+8] 00401C26. 6A FF push C push edx 00401C29. 6A 00 push C2B. FFD0 call eax ; eax=76c19436 (sfc_os.#5) 상기루틴을통해서 sfc_os.dll 를우회하는데성공하였다면아래루틴을통해서정상 beep.sys 를삭제한후동일한경로에동일한파일명을사용하여루트킷드라이버를생성한다. 참고로윈도우에서사용하는정상 beep.sys 는약 5kb 로 Agent D 가생성하는 beep.sys 는약 3kb 이다. 따라서 beep.sys 가존재한다고해서무조건악성은아니며또한 Agent D 에감염된것은아님을밝혀둔다. //--- beep.sys 삭제 ---// 00401CA3. 50 push eax ; /FileName = C:\WINDOWS\system32\drivers\beep.sys 00401CA4. FFD7 call edi ; \DeleteFileA //--- beep.sys 생성 ---// 00401CA6. 6A 00 push 0 ; /htemplatefile = NULL 00401CA8. 6A 02 push 2 ; Attributes = HIDDEN 00401CAA. 6A 02 push 2 ; Mode = CREATE_ALWAYS 00401CAC. 6A 00 push 0 ; psecurity = NULL 00401CAE. 6A 02 push 2 ; ShareMode = FILE_SHARE_WRITE 00401CB0. 8D4C24 24 lea ecx, dword ptr [esp+24] ; 00401CB push ; Access = GENERIC_WRITE 00401CB9. 51 push ecx ; FileName = C:\WINDOWS\system32\drivers\beep.sys 00401CBA. FF call dword ptr [<&KERNEL32.CreateFile>; \CreateFileA 00401CCA. 6A 00 push 0 ; /poverlapped = NULL 00401CCC. 52 push edx ; pbyteswritten 00401CCD. 68 C push 8C6 ; nbytestowrite = 8C6 (2246.), beep.sys 의크기 00401CD push ; Buffer = Police , beep.sys 의 MZ헤더위치 00401CD7. 56 push esi ; hfile 00401CD8. FF15 8C call dword ptr [<&KERNEL32.WriteFile>>; \WriteFile //---- Agent D 가생성한 Drivers/beep.sys 파일의일부 ----// D 5A FF FF MZ? B ?...@ C ? E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD ?.???L?Th F D E 6E 6F is program canno E E F t be run in DOS - 4 -

5 (4-2) %TEMP%\%d_res.tmp 파일생성하기 //--- %Temp% Path 얻기 ---// C0. 50 push eax ; /Buffer C push 104 ; BufSize = 104 (260.) C6. FF call dword ptr [<&KERNEL32.GetTempPathA>] ; \GetTempPathA D2. 8D8C lea ecx, dword ptr [esp+134] ; [esp+134] = 리턴된 %TEMP% 의경로 //--- %TEMP%\%d_res.tmp 파일생성 ---// D9. 50 push eax ; /<%d> eax = 0x h DA. 51 push ecx ; <%s> = C:\DOCUME~1\AHNMAR~1\LOCALS~1\Temp\ DB. 8D lea edx, dword ptr [esp+38] ; DF. 68 E push E0 ; Format = "%s\%d_res.tmp" E4. 52 push edx ; s E5. FF call dword ptr [<&USER32.wsprintfA>] ; \wsprintfa F2. 8B mov eax, dword ptr [esp+254] ; Police = File Type:DLL //--- 리소스찾기 ---// push eax ; /ResourceType = File Type(DLL) A. 51 push ecx ; ResourceName = B. 56 push esi ; hmodule C. FF call dword ptr [<&KERNEL32.FindResourceA>] ; \FindResourceA BD8 mov ebx, eax ; Police B C 01 00?...L.. 0x h: 0x000040B0h, %TEMP%\%d_res.tmp 파일의 MZ 헤더위치 0x h: 0x00014C00h, %TEMP%\%d_res.tmp 파일의크기 //--- 리소스로딩 ---// > \53 push ebx ; /hresource = push esi ; hmodule FF15 3C call dword ptr [<&KERNEL32.LoadResource>] ; \LoadResource //--- 파일생성 ---// A > \6A 00 push 0 ; /htemplatefile = NULL C push 80 ; Attributes = NORMAL A 02 push 2 ; Mode = CREATE_ALWAYS A 00 push 0 ; psecurity = NULL A 02 push 2 ; ShareMode = FILE_SHARE_WRITE D lea edx, dword ptr [esp+44] ; B push ; Access = GENERIC_WRITE push edx ; FileName = % 랜덤한문자 %_res.tmp edx=0012f9b8, (ASCII "C:\DOCUME~1\AHNMAR~1\LOCALS~1\Temp\\ _res.tmp") FF call dword ptr [<&KERNEL32.CreateFileA>] ; \CreateFileA //--- 랜덤한문자 %_res.tmp%_res.tmp 에코드쓰기 ---// D1. 6A 00 push 0 ; /poverlapped = NULL D3. 51 push ecx ; pbyteswritten D4. 53 push ebx ; /hresource =

6 004014D5. 6A 00 push 0 ; hmodule = NULL D7. FF15 5C call dword ptr [<&KERNEL32.SizeofResource>>; \SizeofResource DD. 50 push eax ; nbytestowrite = 14C00 (84992.) DE. 57 push edi ; Buffer DF. 56 push esi ; hfile E0. FF15 8C call dword ptr [<&KERNEL32.WriteFile>] ; \WriteFile //--- 파일이동 ---// FF. 56 push esi ; /NewName = C:\WINDOWS\system32\BITSEx.dll push edx ; ExistingName = C:\DOCUME~1\AHNMAR~1\LOCALS~1\Temp\\ _res.tmp FF call dword ptr [<&KERNEL32.MoveFileA>] ; \MoveFile A //--- 파일속성설정 ---// A 06 push 6 ; /FileAttributes = HIDDEN SYSTEM push esi ; FileName = ASCII "C:\WINDOWS\system32\BITSEx.dll A. FF15 A call dword ptr [<&KERNEL32.SetFileAttribut>; \SetFileAttributesA //--- 파일삭제 ---// D lea eax, dword ptr [esp+30] push eax ; /FileName = C:\DOCUME~1\AHNMAR~1\LOCALS~1\Temp\\ _res.tmp FF15 A call dword ptr [<&KERNEL32.DeleteFileA>] ; \DeleteFileA (4-3) %SYSTEM%\BITSEx.dll 파일이동 DLL 파일을생성하기에앞서 SYSTEM32 경로를얻어오기위해서 GetSystemDirectoryA 함수를사용한다. //--- %SYSTEM% Path 얻기 ---// DC push 104 ; /BufSize = 104 (260.) E1. 50 push eax ; Buffer E2. 897D EC mov dword ptr [ebp-14], edi ; E5. 897D E4 mov dword ptr [ebp-1c], edi ; E8. FF15 A call dword ptr [<&KERNEL32.GetSystemD>; \GetSystemDirectoryA 상기루틴을통해서 system32 경로를얻어왔으면 DLL 파일명을명명하기위해서윈도우의정상서비스명인 BITS 를가져와서 조합한다. //--- DLL File Naming ---// EE. 8B75 08 mov esi, dword ptr [ebp+8] F1. 8B1D mov ebx, dword ptr [<&USER32.wsprint>; USER32.wsprintfA F7. 8D8D C8FCFFFF lea ecx, dword ptr [ebp-338] FD. 56 push esi ; /<%s> = BITS( 윈도우정상서비스명을얻어옴 ) FE. 51 push ecx ; <%s> = %SYSTEMPATH% FF. 8D95 CCFDFFFF lea edx, dword ptr [ebp-234] ; D push D4 ; Format = "%s\%sex.dll" A. 52 push edx ; s B. FFD3 call ebx ; \wsprintfa 0012FBC4 0012FCE4 ASCII "C:\WINDOWS\system32\BITSEx.dll" %SYSTEM%\BITSExt.dll 란파일명으로생성을성공했다면아래루틴을통해서 BITS 서비스의 Parameter 로실행된다

7 //--- BITS Service Control ---// D95 D0FEFFFF lea edx, dword ptr [ebp-130] A. 51 push ecx ; /phandle B. 68 3F000F00 push 0F003F ; Access = KEY_ALL_ACCESS A 00 push 0 ; Reserved = push edx ; Subkey = SYSTEM\CurrentControlSet\Services\BITS push ; hkey = HKEY_LOCAL_MACHINE FF call dword ptr [<&ADVAPI32.RegOpenKeyExA>] ; \RegOpenKeyExA Parameter 로추가하기위해서일단해당서비스를비활성화시킨다. //--- BITS Service Status Changed ---// D. 6A 04 push 4 ; /BufSize = F. 51 push ecx ; Buffer A 04 push 4 ; ValueType = REG_DWORD A 00 push 0 ; Reserved = A push A4 ; ValueName = "Start" push edx ; hkey A. C mov dword ptr [ebp+8], 2 ; Service Status Flag FF call dword ptr [<&ADVAPI32.RegSetValueExA>>; \RegSetValueExA //--- BITS Service Parameter Control ---// D3. 52 push edx ; /phandle D F000F00 push 0F003F ; Access = KEY_ALL_ACCESS D9. 6A 00 push 0 ; Reserved = DB. 50 push eax ; Subkey = SYSTEM\CurrentControlSet\Services\BITS\Parameters DC push ; hkey = HKEY_LOCAL_MACHINE E1. FF call dword ptr [<&ADVAPI32.RegOpenKeyExA>] ; \RegOpenKeyExA //--- %SYSTEM%\BITSEx.dll" added as a parameter of BITS service ---// > \8DBD CCFDFFFF lea edi, dword ptr [ebp-234] ; [ebp-234] = C:\WINDOWS\system32\BITSEx.dll C9 FF or ecx, FFFFFFFF C0 xor eax, eax B. 8D95 CCFDFFFF lea edx, dword ptr [ebp-234] F2:AE repne scas byte ptr es:[edi] F7D1 not ecx push ecx ; /BufSize push edx ; Buffer = Stack Address for "C:\WINDOWS\system32\BITSEx.dll" A 02 push 2 ; ValueType = REG_EXPAND_SZ push eax ; Reserved => A. 8B45 EC mov eax, dword ptr [ebp-14] ; D push ; ValueName = "ServiceDll", push eax ; hkey FF call dword ptr [<&ADVAPI32.RegSetValueExA>>; \RegSetValueExA 최종적으로구성된 DLL파일의 Parameter 형태는아래와같다. * The final result : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters\ ServiceDll="C:\WINDOWS\system32\BITSEx.dll" - 7 -

8 BITS 서비스의 Imagepath 값을보면아래와같다. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\ ImagePath=" %SystemRoot%\system32\svchost.exe -k netsvcs" 즉위와같이구성되면 BITSEx.dll 은 svchost.exe 에의해서로딩되며외부로접속하여추가악의적인행위를하는데쉽게말 하면정상 svchost.exe 가악의적인행위를하는것처럼보여진다. (5) %SYSTEM%\BITSEx.dll 분석하기 지금까지분석한내용을통해서 BTISEx.dll 이어떻게실행되는지알아봤다. 이제실행되는 BITSEx.dll 이어떤동작을하는지 알아보자. BITSEx.dll 은외부로접속하기위해서아래루틴을수행한다. //--- WinInet.dll 로딩및 Internet*****() 함수 EP얻기 ---// * wininet.dll 로딩하기 /$ 81EC F sub esp, 3F push esi F4E00010 push 1000E0F4 ; /FileName = "wininet.dll" C. FF15 ACA00010 call dword ptr [<&KERNEL32.LoadLibrar>; \LoadLibraryA --- 중간생략 F. 8B3D B0A00010 mov edi, dword ptr [<&KERNEL32.GetPr>; kernel32.getprocaddress * Internet******() 함수 EP얻기 E4E00010 push 1000E0E4 ; /ProcNameOrOrdinal = "InternetOpenA" A. 56 push esi ; hmodule B. FFD7 call edi ; \GetProcAddress D. 68 D0E00010 push 1000E0D0 ; /ProcNameOrOrdinal = "InternetOpenUrlA" push esi ; hmodule BD8 mov ebx, eax ; FFD7 call edi ; \GetProcAddress BCE00010 push 1000E0BC ; /ProcNameOrOrdinal = "InternetCloseHandle" C. 56 push esi ; hmodule D. 8BE8 mov ebp, eax ; F. FFD7 call edi ; \GetProcAddress A8E00010 push 1000E0A8 ; /ProcNameOrOrdinal = "InternetReadFile" push esi ; hmodule mov dword ptr [esp+18], eax ; B. FFD7 call edi ; \GetProcAddress //--- Internet***** 익스포트함수 Call ---// A0E00010 push 1000E0A0 ; ASCII "RiSing" A mov dword ptr [esp+28], eax E. FFD3 call ebx ; InternetOpenA() 의 EP BD8 mov ebx, eax DB test ebx, ebx je short CD B >mov eax, dword ptr [esp+408] ; BITSEx.1000E1B8 Stack ss:[0006f38c]=1000e1b8 (BITSEx.1000E1B8), ASCII " [0006F38C] 에는암호화되지않는 URL 주소가저장되어있지만 Internet***** 익스포트함수를 Call 하기전에상당히까다로 - 8 -

9 운방법을사용하여인코딩되어있었다. --- 중간생략 F push push eax push ebx A. FFD5 call ebp ; InternetOpenUrlA() 의 EP //--- 시스템정보얻기 ---// %SYSTEM%\BITSEx.dll 는감염된시스템의정보 ( 컴퓨터이름, 윈도우 OS 버전, 메모리양 ) 를얻어버퍼에저장한후위에서 알아낸 URL 에조합하여전송하는것으로보였다. ( 참고로 IDA Pro 를이용해서분석했다..text:10003EBA lea eax, [esp+0c0h+nsize].text:10003ebe mov [esp+0c0h+nsize], 40h.text:10003EC6 push eax ; nsize.text:10003ec7 push ebx ; lpbuffer.text:10003ec8 call ds:getcomputernamea.text:10003edb lea ecx, [esp+0c0h+versioninformation].text:10003edf mov [esp+0c0h+versioninformation.dwosversioninfosize], 94h.text:10003EE7 push ecx ; lpversioninformation.text:10003ee8 call ds:getversionexa ; Get extended information about the.text:10003ee8 ; version of the operating system.text:10003fad lea eax, [esp+0c8h+buffer].text:10003fb1 mov [esp+0c8h+buffer.dwlength], 20h.text:10003FB9 push eax ; lpbuffer.text:10003fba call ds:globalmemorystatus.text:10003fc0 mov ecx, [esp+0c8h+buffer.dwtotalphys].text:10003fc4 add ebx, 40h.text:10003FC7 shr ecx, 14h.text:10003FCA inc ecx.text:10003fcb push ecx.text:10003fcc push offset s_dmb ; "%dmb".text:10003fd1 push ebx ; LPSTR.text:10003FD2 call ds:wsprintfa 그외백도어로도활동하는것으로보이는데 %SYSTEM%\BITSEx.dll 에서파악된기능은마우스및키보드이벤트로깅, SeShutdownPrivilege 를통해서시스템의제어권 (logoff, Restart, Shut Down) 및화면캡쳐등을할수있는것으로보인다. 또한원격지의악의적인사용자가특정사이트로부터파일을다운로드및실행할수있는기능도존재하였다. 결론은 %SYSTEM%\BITSEx.dll 은백도어로서그리고함께생성된 %SYSTEM%\Drivers\beep.sys 에의해서은폐되어동작 하는것으로보인다

CKKeyPro 적용가이드

CKKeyPro 적용가이드 3.20 사이버테러악성코드분석보고서 라온시큐어보안기술연구팀 작성일 : 2013. 03 페이지 : 1/15 Introduction 2013년 3월 20일오후, MBC, KBS, YTN, 농협, 신한은행, 제주은행전산망장애가동시에발생하였다. 피해기관들의호스트약 500여대에오류메시지가화면에나타났으며악성코드에감염된호스트는사용할수없는상태가되었다. 현재까지정확한침투경로가밝혀지지않고있다.