# A short journey into DarkVNC attack chain

**reaqta.com/2017/11/short-journey-darkvnc/**

During an analysis of different [remote desktop trojans we came across an interesting attack-chain](https://twitter.com/ReaQta/status/926055917610815488)
which leverages an RTF that exploits CVE-2017-8759 to deliver DarkVNC, a malicious version of
the well-known VNC, designed to silently remote-control a victim.

**DarkVNC Attack Chain**

[The DarkVNC chain as reconstructed by ReaQta-Hive can be seen below:](https://upstream.rqt.io/hive/)

After opening the RTF document, one of the first processes to start is csc.exe which is a CommandLine build tool used to invoke the C# compiler, even though csc.exe is a perfectly legit, tool it can be
abused for malicious purposes. The first step is to inspect the command-line of csc.exe to discover
what is going to be compiled on-the-fly:


-----

_cam0snfh.cmdline should raise some suspicion: beside the “weird” name it also run from the user’s_
directory:
```
/t:library /utf8output /R:"System.dll" /R:"System.Runtime.Remoting.dll"
/R:"System.Data.dll" /R:"System.Xml.dll" /R:"System.Web.Services.dll"
/out:"[EDITED].dll" /D:DEBUG /debug+ /optimize- 
"C:\Users\User\AppData\Local\Temp\xyzlw5gj.0.cs"

```
The compilation will produce [EDITED].dll (we redacted the name of the DLL for safety reasons
since it’s in the form: www.maliciousdomain.com). To understand what this DLL does, we have to
inspect the source-code located in the file xyzlw5gj.0.cs:

[This block of code takes advantage of the CVE-2017-8759 (WSDL Parser Code Injection) that](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8759)
allows an attacker to inject and execute arbitrary code. Specifically the csc.exe generated DLL will
[be executed by Office. The same technique has been used in the wild to distribute FinSpy.](https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html)
In our case winword.exe will finally execute mshta.exe that launches an hta script which invokes a
_powershell. The main purpose of powershell is to drop and execute result.exe whose scope is to_
deliver DarkVNC which we can consider the final payload. The convoluted process described above
can be summarized with a simple image that gives us an immediate insight on what is happening on
the victim’s endpoint:


-----

**The Injector**

As previously stated, result.exe acts as a loader, its goal is to decrypt and inject the malicious DLL
that contains DarkVNC. From a static analysis point of view we have the following characteristics:

SHA256: 1D6F4CAC33FFF1B744DCE13BDF003B15D8EABCE53B0578E3B4BDBC5CBF001D78

SHA1: 2BB1BE823ED569EF3DAC008B2FEC4A8D04E46922

MD5: 22E2B492108F9D5517EE52C37912F24D

File size: 551.50 KB (564736 bytes)


File
name:


result.exe


File type: Win32 EXE

The executable does not have a Version Information and from an initial inspection it’s encrypted
with some private PE cryptor. We will skip the detailed analysis of the packer and subsequent
unpacking steps because we are more interested in the overall behavior. result.exe uses several
layers of encryption but does not implement complex anti-reverse engineering countermeasures, so
the fastest way track the core behavior by setting a breakpoint on VirtualAlloc() and following the
various layers.


-----

Execution will jump from layer to layer until we reach the last one where it’s possible to get the most
important aspects of the injector.


-----

_The svchost.exe process is created as a suspended process so the malicious code will be executed_
when the process is finally resumed. At this point we can extract DarkVNC from memory.

**The DarkVNC Module**

The static inspection of the module’s PE shows the following:

There are two exports whose meaning is self-explanatory, they are used to manage the VNC
Server.

The first step is to convert from string to address the attacker’s address, which in this case is in the
form IP:443.


-----

Obtains the ComputerName and an additional identifier in order to assemble the string that will
identify the victim’s endpoint, the final string will be: (COMPUTER_NAME)_ADDITIONAL_ID**DARKVNC. Immediately after, the VNC Server is started. We will not go through the analysis of the**
whole module for the sake of brevity, but from the inspection of strings we can speed-up the initial
assessment.

The string #hvnc is pretty indicative, this core shares many similarities with HVNC (HiddenVNC) a
[well-known Remote-Control Module whose source-code can be found in the carberp leak. This](https://github.com/hzeroo/Carberp/tree/6d449afaa5fd0d0935255d2fac7c7f6689e8486b/source%20-%20absource/pro/all%20source/RemoteCtl/hvnc)
module shares with it a large amount of similarities like:

Hidden VNC capabilities: The module will create a new Window Desktop to keep hidden the
_malicious VNC instance. This technique is usually adopted to bypass anti-fraud engines on_
personal banking websites by impersonating the victim’s computer and logging in with stolen
credentials without raising alerts on the bank’s side. Here’s a quick representation of the
above behavior taken from ReaQta-Hive’s process-tree point of view:


-----

We have a new explorer.exe instance and one of the child processes is Chrome!
While there are also some basic differences between DarkVNC and HVNC, one of the most
interesting is represented by the following:
```
SetEnvironmentVariableW("MOZ_DISABLE_CONTENT_SANDBOX", "1")

```
According to the [documentation MOZ_DISABLE_CONTENT_SANDBOX disables content process](https://wiki.mozilla.org/Security/Sandbox)
sandboxing.

**The threat from a higher perspective**

So far we have identified the following DarkVNC samples:

Collected samples:

1. deb02b28605a2b9c80b25c5fa1fa43ac8c71b10961f7517c1a0394531d3b0b40
2. 9a57cefbfcdf1b18cc31a2784a2ed3e0e11dd4a3c4608b1243b4141a475b182f
3. a67e96b01520183babfae285b5d692b5b3dda7edff7378b281ace7fd381d3c93
4. e0a73dd11f0f2c41859bf01cf8a5b7a2a9946303d6e7898f696037323d038f56
5. Delivered via Terror EK: [http://www.malware-traffic-analysis.net/2017/10/17/index.html](http://www.malware-traffic-analysis.net/2017/10/17/index.html)


-----

Hashes of the sample analyzed in this post:

1. RTF: 7a641c8fa1b7a428bfb66d235064407ab56d119411fbaca6268c8e69696e6729
2. result.exe: 1d6f4cac33fff1b744dce13bdf003b15d8eabce53b0578e3b4bdbc5cbf001d78

**Detection & Protection**

Visibility over the endpoints is essential to quickly detect new threats as they’re deployed by the
attackers. Real-time behavioral analysis creates a window of opportunity to detect behaviors that
are unusual, running VNC or Teamviewer is not a malicious activity by itself but those same tools
can be abused to get control over an endpoint. Being capable of detecting such anomalies allows
for a timely analysis and response before the severity of the incident escalates.

[Check out ReaQta-Hive to understand how an Endpoint Threat Response platform can help your](https://upstream.rqt.io/hive/)
organization to secure the infrastructure from threats like the one just analyzed, track incidents and
respond in real-time. Anomalous behaviors can be hard to understand manually and the help
offered by the algorithms greatly increase the chances of detection and consequently the reaction
time.


-----