SonicWall RTDMI ™ engine has recently detected a malware file which is using REMCOS (Remote Control & Surveillance Software) as payload. The malware is delivered to the victim’s computer as an email attachment. Archive file contains the executable file has shown below:

Unavailability of the archive file and Portable Executable (PE) file inside the archive in any of the popular threat intelligence sharing portals like the VirusTotal and the ReversingLabs indicates its uniqueness and limited distribution:

 

 

PE Static Information:

 

Malware Execution:

The malware creates a copy of itself in %AppData%\Roaming\hpsupportk\ hpsupportw.exe and uses install.vbs to delete itself and execute hpsupportw.exe from %APPDATA% directory.

The malware decrypts and executes highly obfuscated code in multiple layers which makes the analysis of the malware difficult for reverse engineers.

First Layer Execution:

The malware code has thousands of instruction in which only few instructions are real. The malware does not contain any decryption key to decrypt encrypted data; instead it generates the key using a fascinating logic.

The malware picks the initial DWORD of encrypted data as MarkerValue and takes a stack address as KeyValue. Malware keeps performing XOR operation on MarkerValue and KeyValue, decrementing KeyValue by 1 in each iteration until the result value matches to 0x41414141. Now the KeyValue is the actual key to decrypt the second layer code:



The malware decrypts the second layer code using the previously generated decryption key as shown below:

Second Layer Execution:

The malware reads the PEB_LDR_DATA structure from Process Environment Block (PEB) to iterate loaded modules and looks for the MSVBVM60.DLL:



The malware iterates the exports directory of MSVBVM60.DLL and looks for DllFunctionCall Application programming interface (API) by matching initial bytes of the API module. The malware now retrieves address of all required Windows APIs using the DllFunctionCall API.

Anti-Debugging:

GetTickCount:

 

ThreadHideFromDebugger:

The malware calls ZwSetInformationThread API by setting ThreadInformationClass argument as ThreadHideFromDebugger which detaches the debugger and terminates the process immediately, if running inside a debugger:

 

Hardware Breakpoints:

The Malware calls ZwGetContextThread API by setting ContextFlags argument as CONTEXT_DEBUG_REGISTERS.  The API gives us the values of debug registers which are used for hardware breakpoints. The malware examines retrieved values and if it finds any hardware breakpoint, it terminates the execution:

 

Software Breakpoints:

The malware checks for software breakpoints and undefined instruction at the beginning of Windows APIs before calling it:

 

Sandbox Evasion:

The malware uses GetCursorPos API to monitor the mouse movement:

 

Malware iterates in loop checking for hardware breakpoints, software breakpoints and cursor position until cursor position is changed. The malware encrypts the second layer code when it is not in use and decrypts it back when the code needs to be executed.

Finding start of decrypted code:

 

Encrypting second layer code:

 

Decrypting second layer code:

Persistence:

The malware creates Run key in the registry to maintain persistence on the system as shown below:

 

Bringing REMCOS in action:

The malware contains REMCOS executable’s encrypted bytes in chunks of 97 bytes and uses 0s padding after each chunk. The malware keeps count of padding bytes in a data structure. It brings all encrypted bytes which are contiguous in memory as shown below:

The malware decrypts the REMCOS executable’s bytes using 34 bytes key. It does not bring MZ at e_magic field in memory to prevent understanding of a PE file decryption by reverse engineers:

 

After completing decryption and correcting e_magic field to MZ, the malware loads and start executing the REMCOS executables.

 

About REMCOS

REMCOS designed as Remote Control and Surveillance tool for legitimate purpose but it is being used by malware authors from a few years. Free edition with limited capabilities can be downloaded from the official website as shown below:

 

REMCOS in Action

REMCOS keeps the configuration information in the resource named as settings. The very first byte tells us the RC4 key size, followed by RC4 key which is further followed by the encrypted configuration information:

 

REMCOS reads the key from the resource and decrypts configuration data using RC4 algorithm which contains Command and Control (C&C) server’s IP address, port number, password, REMCOS executable’s name and key logging filename etc.:

 

REMCOS gathers victim’s system information which contains REMCOS executable’s name, computer name, Windows version, RAM information, REMCOS version (2.5.0 Pro), keylogging file path and CPU information etc. REMCOS uses “|cmd|” as delimiter which is as shown below:

 

Network:

REMCOS encrypts collected system information using RC4 algorithm with the key “pass” retrieved from configuration data and sends it to the C&C server:

 

Key Logging:

REMCOS records keystroke and saves them into %AppData%\Roaming\hpsupportl\logs.dat:

 

Additional capabilities of REMCOS

• Screen Capture
• Remote CommandLine
• Remote Registry Editor
• Download, Upload and Execute files
• Logins cleaner

Evidence of detection by RTDMI ™ engine can be seen below in the Capture ATP report for this file:

SonicWall RTDMI engine has been detecting obfuscated JavaScript malware files since last two weeks. After analysis, we found that these files belong to WSHRAT malware family. Archive file carries the WSHRAT JavaScript file shown below:

Background:

WSHRAT was first spotted in the wild in year 2013, since then it has been periodically upgrading its Remote Access Trojan (RAT) capabilities. The current version is 2.0, this version information is present in the RAT itself. The programming language used by this malware separates it from other RATs because it has been completely written in JavaScript. The malware has been also written in VBScript.

 

RAT Capabilities:

• Installing, uninstalling and upgrading itself
• Key logging and stealing passwords
• Downloading, uploading and executing files
• Remote desktop access
• Executing various commands and sending data to the Command and Control (C&C) server.
• Reversing proxy
• Browser’s log stealing
• Process enumeration and termination
• USB drive infection

 

Persistence:

WSHRAT copies itself in the Startup folder and makes Run entry in the registry. It uses “%temp%\wshsdk\” directory to install its components.

 

Network:

WSHRAT collects and sends system information to its Command and Control (C&C) server. It uses “|” as separator while sending information to the C&C server.

 

C&C Communication:

WHSRAT supports large number of commands which are listed below.

 

Command	Action
disconnect	Terminates itself
reboot	Reboots the system
shutdown	Turns the system off
execute	Executes the command using “eval” function
install-sdk	If %temp%\wshrat\python.exe file is present, malware sends status “SDK+Already+Installed” else downloads wshsk.zip from “hxxp://2813.noip.me:2813/moz-sdk”. Malware extracts downloaded file into %temp%\wshrat and sends SDK+Installed” message to the C&C server.
get-pass	Retrieves and sends specified browser’s passwords to the C&C server.
get-pass-offline	Retrieves and send all installed browser’s passwords to the C&C server.
Update	Downloads and executes latest JavaScript file from the C&C server.
Uninstall	Deletes all the registry entries, Startup entries and all file system traces related to WSHRAT and terminates the execution of malware.
up-n-exec	Downloads and executes the specified executable file from the C&C server.
bring-log	Sends specified log file to the C&C server.
down-n-exec	Downloads and executes the specified executable file from the specified URL.
filemanager	Downloads executable file from specified URL and saves it as “fm-plugin.exe”. The malware executes downloaded file with parameters “m-plugin.exe 2813.noip.me 2813 \{Gathered Information}”
rdp	Drops rd-plugin.exe, which is present in base64 encoded form inside the WSHRAT JavaScript file. The malware executes dropped file with parameters “rd-plugin.exe 2813.noip.me 2813 \{Gathered Information}\ true (is_offline_flag)”
rev-proxy	Drops rprox.exe, which is present in base64 encoded form inside the WSHRAT JavaScript file. The malware executes dropped file with parameters “rprox.exe 2813.noip.me 2813 {filearg}”
exit-proxy	Terminates rprox.exe process.
keylogger	Drops kl-plugin.exe, which is present in base64 encoded form inside the WSHRAT JavaScript file. The malware executes dropped file with parameters “kl-plugin.exe 2813.noip.me 2813 \{Gathered Information}\ false (is_offline_flag)”
offline-keylogger	Drops kl-plugin.exe, which is present in base64 encoded form inside the WSHRAT JavaScript file. The malware executes dropped file with parameters “kl-plugin.exe 2813.noip.me 2813 \{Gathered Information}\ true (is_offline_flag)”
browse-logs	Enumerates “wshlogs” directory and sends collected information to the C&C server.
cmd-shell	Executes specified command on “Command Shell” and sends the output to the C&C server.
get-processes	Enumerates running processes using WMI query (select * from win32_process) and sends process names, process ids and executable paths to the C&C server.
disable-uac	Modifies values of EnableLUA, ConsentPromptBehaviorAdmin and DisableAntiSpyware registry keys. The malware acknowledges changes to the C&C server by sending “UAC+Disabled+(Reboot+Required)” message.
check-eligible	If specified file present in the system, malware sends “Is+Eligible” message to the C&C server, otherwise it sends “Not+Eligible”.
force-eligible	If specified file present in the system, malware executes the file with specified parameters and sends “SUCCESS” message to the C&C server, otherwise it sends “Component+Missing” message.
elevate	If the malware is not elevated already, it restarts itself with elevated privileges and sends “Client+Elevated” message to the C&C server.
if-elevate	If the malware is elevated, it sends “Client+Elevated” message to the C&C sever otherwise sends “Client+Not+Elevated” message.
kill-process	Terminates process attached with specified process id.
sleep	Performs sleep operation for the specified time.

 

Evidence of the detection by RTDMI engine can be seen below in the Capture ATP report for this file:

 

Additional Remark:

Please note that the RTDMI engine analyzed and gave us a verdict for these samples as ‘Malicious’ on September 13, 2019 as visible in the report:

Whereas these samples (both the zipped and unzipped versions) were first seen on Virustotal 3 days later – on September 16, 2019 – as evident by the ‘First Submission’ date:

The SonicWall Capture Labs Threat Research Team observed reports of a new variant family of LOCKID ransomware [LOCKID.RSM] actively spreading in the wild.

The LOCKID ransomware encrypts the victim’s files with a strong encryption algorithm until the victim pays a fee to get them back.

Infection Cycle:

The ransomware adds the following files to the system:

• Malware.exe
  • % App.path%\ @_READ_TO_RECOVER_FILES_@
    • Instruction for recovery

Once the computer is compromised, the ransomware runs the following commands:

 

The ransomware encrypts all the files but it won’t change the extensions.

Here is an example (Eula.txt Original Content):

Here is an example Encrypted file:

After encrypting all personal documents, the ransomware shows the following text file containing a message reporting that the computer has been encrypted and to contact its developer for unlock instructions.

We have been monitoring varying hits over the past few days for the signature that blocks this threat:

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: LOCKID.RSM (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.