and malware are becoming more and more complex to steal more money. We recently saw an increase of ransomware cases. Ransomware is a malware that hijacks your data in exchange of a ransom. At the beginning ransomware were not sophisticated and did not use encryption. The access to the computer was only blocked but data could be recovered, we talked about “Locker Ransomware”. Then attackers improve their techniques with the use of encryption, “Crypto Ransomware”. These kind of ransomware targets specific valuable data stored on the computer and encrypt data with strong encryption algorithm. Making thereof unusable without the decryption key. Ransomware attack is a very successful attack, and allows attackers to steal lot of money with a minimal risk. Coupled with the development of anti-analysis technique, the complexity of this malware is still growing. This paper talk about a short analysis of TeslaCrypt v4, the last release of infamous ransomware. Teslacrypt Presentation TeslaCrypt is a ransomware released for the first time in February 2015. It finds and encrypt your data then print a message to inform you that your data has been encrypted and is unusable unless you pay to get the decryption key. The first releases of TeslaCrypt were not properly built. As the encryption algorithm was not correctly implemented security researchers were able to create decryption tools. In November 2015, the TeslaCrypt version 2 had also some issues, attackers released the version 3 in January 2016 to correct these issues. With this version, the data was not recoverable. Then in March 2016, the last version released: the version 4. With this version the encryption files keep their original extension and a new name is implemented to the recover files. This latest version don’t allow to decrypt files. TeslaCrypt is now stronger than ever.
Lot of malwares use protection tricks to trap the analyst and make difficult the reverse engineering and the detection. We will see in this section how to recover the original sample file. The packing technique is commonly used to protect itself the sample. Common packer could be easily to detect and to use to get the original file. However in many case attackers uses custom packer to avoid recovery. In this case, a custom packer is used with multiple decryption and the use of process hollowing technique. Process hollowing is a common technique that inject a malicious code in a suspended process. So to use process hollowing, attackers uses the following Api: x CreateProcess: in a suspended mode with the CreationFlag at 0x0000 0004. x GetThreadContext: retrieves the context of the specified thread. x ZwUnmapViewOfSection: Unmaps a view of a section from the virtual address space of a subject process. x VirtualAllocEx: allocates memory within the suspended process’s address space. x WriteProcessMemory: writes data of the PE file into the memory just allocated within the suspended process. x SetThreadContext: sets the EAX register to the entry point of the executable written. x ResumeThread: resumes the thread of the suspended process.
is: BOOL WINAPI GetThreadContext( _In_ HANDLE hThread, _Inout_ LPCONTEXT lpContext ); Then we can see the call of ZwUnmapViewOfSection: Figure 3. GetThreadContext in packed TeslaCrypt The prototype is: NTSTATUS ZwUnmapViewOfSection( _In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress );
VirtualAlloc function: Figure 4. VirtualAlloc in packed TeslaCrypt LPVOID WINAPI VirtualAlloc( _In_opt_ LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD flAllocationType, _In_ DWORD flProtect ); We can here dump the unpacked file loaded in the memory after the 4th hit of VirtualAlloc. We can see the VirtualAlloc API by hit CTRL+G and enter “VirtualAlloc”: Figure 5. Breakpoint at VirtualAlloc
F9 we hit the breakpoint, then we return to usercode, and follow the register EAX in memory. Figure 6. Follow in dump the allocation of the PE We have now in memory pan an empty space which will be fill by the function. We can setup a hardware breakpoint to see what’s happened. Figure 7. Breakpoint on memory space
press F9 to check the file dropped in the memory space. Here we see the memory during each hit of VirtualAlloc. The sample unpacked is the last one. Figure 8. PE on memory space We can dump this one for analysis with “save data to file”. Figure 9. Save memory data to file Invalid PE Valid PE but still packed Valid PE unpacked
point we have a valid unprotected PE. The other way to dump quickly the PE without hit each VirtualAlloc is to setup a breakpoint at WriteProcessMemory API and follow in memory the buffer. Figure 10. PE in Buffer in WriteProcessMemory BOOL WINAPI WriteProcessMemory( _In_ HANDLE hProcess, _In_ LPVOID lpBaseAddress, _In_ LPCVOID lpBuffer, _In_ SIZE_T nSize, _Out_ SIZE_T *lpNumberOfBytesWritten ); With the valid unprotected PE we can now analysis it to better understand his behavior.
overview of TeslaCrypt capabilities After unpacked the file we can find more interesting information. The original date of compilation can be found the March 18 2016 at 09:37:49 UTC. Figure 11. PE unpacked File header The date before the unpacking was the February 22 2007 at 5:38:20 UTC. Figure 12. PE packed File header Metadata: File Name unpackTesla.mem File Size 249856 bytes File Type PE32 executable (GUI) Intel 80386, for MS Windows Md5 ea3ccdd7c69b5e1a18c473d937c68c37 Ssdeep 6144:NSMPQFF58b1H2towR74r7kLeY4U3HUck:NSJFF41H2to07475A0
some trick to elevate their privilege one of this trick is to use the SeDebugPrivilege, which attribute the System privilege to the malware. The following screenshot shows how it’s working. Figure 13. SeDebugPrivilege When the sample is running, it enables the SeDebugPrivilege by setting an access token right. An access token is an object containing the security descriptor of a process. The sample uses the functions OpenProcessToken and LookupPrivilegeValue to get the LUID (Local Unique Identifier) and check the privilege SeDebugPrivilege. Then the sample used the function AdjustTokenPrivilege for setting the token. The SeDebugPrivilege is normally used for system level debugging but it is also a trick used by malware coder to gain access to system level process.
also uses some anti-debugging technique; we can find the API IsDebuggerPresent that check if the process is being debugged or not. Figure 14. IsDebuggerPresent If the debugger is detected the sample terminate the process, and never call the rest of the code. Debugger detection Rest of the code Terminate process if debugger is detected
with the remote IP and register the infected machine, the function HttpSendRequest is used. Figure 17. HttpSendRequest The sample try to connect to the following IP. Domain Ip resumosdenovela.net 126.96.36.199 classemgmt.testbada.com 188.8.131.52 shampooherbal.com 184.108.40.206 exaltation.info 220.127.116.11 commonsenseprotection.com 18.104.22.168 ebookstoreforyou.com 22.214.171.124
analysis we found some part of code referring to a Bitcoin foundation github project (secp256k1). (https://github.com/bitcoin/secp256k1) The Secp256k1 is used in Bitcoin and defined in Standards for Efficient Cryptography. (https://en.bitcoin.it/wiki/Secp256k1) We can find the code above at this address: https://github.com/bitcoin/secp256k1/blob/master/src/secp256k1.c Conclusion This short paper briefly presents some functionalities of TeslaCrypt and brings an overview of its capacities. With the increasing development of cybercrime, ransomware gain in strength and become more complex and powerful. As we know TeslaCrypt is still active and developers continue to improve their code in order to gain more money. The best way to avoid infection is still to educate users but also to do regular backups. To be continued…