Goal: Analyze Ramnit’s hidden Virtual Network Computing (hVNC) remote control module focusing on its hidden desktop creation.
- Ramnit main loader (5ae2ad8f0be144ce732badf7dec0a16e)
- hVNC module (5AE2AD8F0BE144CE732BADF7DEC0A16E)
- Rig Exploit Kit landing (AS9123 TIMEWEB-AS 176[.]57[.]217[.]89)
While following the Rig Exploit Kit’s distribution of the Ramnit (demetra) banking malware via the Seamless gate, I decided to dive deeper into its “VNC ISFB” module that is most notable running as a thread inside “TRACERT.EXE,” a child process of Ramnit’s svchost.exe
2-13-2018: #Seamless gate -> #RigEK landing
176.57.217[.]89 -> AS9123 TIMEWEB-AS ->#Ramnit banker #malware -> just copy/pasted code from #ISFB gang’s hidden VNC module w/ hooks & “IsfbInitClient” 😂
Hash: 5ae2ad8f0be144ce732badf7dec0a16e pic.twitter.com/NjfPBSsIXz
— Vitali Kremez (@VK_Intel) February 13, 2018
By and large, Ramnit, which is also known as “demetra” in the underground, leverages the following modules:
- Antivirus Trusted Module v2.0 (AVG, Avast, Nod32, Norton, Bitdefender)
- Cookie Grabber v0.2 (no mask)
- FF&Chrome reinstall x64-x86 [silent]
- IE & Chrome & FF injector
- VNC IFSB
- VNC IFSB x64-x86
HVNC allows criminals to bypass many anti-fraud measures by allowing compromised accounts to be accessed directly from the victim’s machine. By using a VNC program, which allows for remote access to and control of a machine, Ramnit actors do not have to spoof or try to replicate a victim machine’s data to avoid the account being flagged. HVNC allows actors to carry out these activities concurrent with regular user activity without being detected by operating in a hidden desktop.
The DLL module contains the following three export ordinals:
Here is one of the most interesting sequences of hidden desktop calls with injection:
Ramnit’s VNC module leverages a set of programs using the Remote Frame Buffer (RFB) protocol hooking multiple API calls and leveraging ISFB AcDLL injection module. Not only the whole Ramnit module was pulled directly from the ISFB gang, the module itself has strong source code similarities to the leaked Carberp one.
The following pseudocoded C++ function demonstrates the location of the “explorer.exe” with the subsequent create process injection.
signed int __stdcall explorer_exe(int a1)