[PMAT] Malware Analysis: SikoMode

This is a write up which describes one of the ways to approach the challenge: SikoMode from PMAT course, which covers the concepts related to advanced static and dynamic analysis.

Sample: unknown.exe

[embed]PMAT-labs/labs/2-3.Challenge-SikoMode at main · HuskyHacks/PMAT-labs Labs for Practical Malware Analysis & Triage. Contribute to HuskyHacks/PMAT-labs development by creating an account on…github.com

For the sake of keeping this short, we’ll skip the file hash enumeration and Virustotal discovery; feel free to do it if you think you really need to.

Static Analysis:

File Information:

Architecture: 64-bit
Type: Executable
GUI program
Compile time: Sat Jan 08 21:29:18 2022

String Enumeration And Imports:

We come across some interesting imports and strings, which reveal that we are initiating connections to the internet, along with that a possible URL we are connecting to and a couple of files which seem interesting.

 InternetOpenW
 InternetOpenUrlA
 InternetCloseHandle
 @Transfer-Encoding
 @Content-Type
 @Content-Length
 @httpclient.nim(1082, 13) `not url.contains({'\r', '\n'})` url shouldn't contain any newline characters
 @hxxp://cdn[.]altimiter[.]local/feed?post=
 @Nim httpclient/1.6.2
 @Desktop\cosmo.jpeg
 @SikoMode
 @iterators.nim(240, 11) `len(a) == L` the length of the seq changed while iterating over it
 @ccc
 @Mozilla/5.0
 @C:\Users\Public\passwrd.txt
Unknown error

Reviewing disassembly in IDA:

Let’s first look at the __tmainCRTStartup call, one of the two functions we see called as we try to find the main() function:

Graph view in IDA of where we end up after loading the binary initially

Inside the _tmainCRTStartup, initially we could not identify anything which would indicate it to be helpful in finding the core functionality. We review the function calls made prior to exiting:

_tmainCRTStartup

Within_text75 call, we see the execution jump to WinMain() after a bunch of MOV instructions which looks like a setup for WinMain() with it’s arguments:

_text75

Inside the WinMain, we see a call to NimMain() which is used when integrating Nim code with C\C++ and is used to initialize top level code along with other things.

WinMain

We see a call to PreMain and instructions loading address of NimMainInner into RAX which is later called; both used to set up the environment and prepare the runtime

NimMain

For context, the execution flow generally looks like:

main() -> NimMain() -> NimMainInner() -> NimMainModule()

Inside the NimMainInner we see the execution jump to NimMainModule, which generally consists of program’s logic:

NimMainInner

NimMainModule gives us the basic structure of the program and what some of its functionality may look like.

NimMainModule

Dynamic Analysis:

Executing the malware without internet simulation leads to the binary self-deleting itself from the disk.

With internet simulation running, and wireshark capture in place we execute the binary again, this time we notice a call to a callback domain.

DNS query: update[.]ec12–4–109–278–3-ubuntu20–04[.]local

Callback domain

checkKillSwitchURL_sikomode_25 — This checks for connectivity to our call back domain.

houdini_sikomode_51 — This seems to causing the Self deletion of the binary if the call back domain is not reachable.

Also, in the process monitor trace we notice two file related operations which stand out:

CreateFile\WriteFile: C:\Users\Public\passwrd.txt

File creation\Write event

ReadFile: C:\Users\vboxuser\Desktop\cosmo.jpeg

File Read event

Now, to understand more as to how these files are relevant we go back to IDA to review the function: stealStuff_sikomode_130 which is being called if we are able to get to the call back domain.

Within the function: stealStuff_sikomode_130 we find that we are performing a file read and an encoding operation.

stealStuff_sikomode_130

So we set up a break point in x64dbg at the call which we are using to reading a file:

Break point at readFile_systemZio_557

Function call takes RCX as an argument, using the value in RCX we can follow it in the dumps to see which file are we reading

File read: C:\Users\vboxuser\Desktop\cosmo.jpeg

Following the instructions further we see we have another call to read a file just before we call a function to encrypt some data using RC4 algorithm:

stealStuff_sikomode_130

We now set up another break point at the call to “to_RC4 function”, reviewing the function details we know that it takes a “Key” and a “string” as arguments and returns encrypted data:

toRC4(“Key”, “Plaintext”)

Break point at to_RC4 function

We can look at the arguments by looking at the values pointed to by RCX and RDX, we are interested in key being used since we know now that the file read earlier which is “cosmog.jpeg” is most likely the one being encrypted.

SikoMode — Contents of file: C:\Users\Public\passwrd.txt

Now, if we let the program execute till it returns we will see another network event on the wireshark trace which looks like an attempt to exfiltrate data.

Data exfiltration as parameter to feed element

Summary:

The malware attempts to connect to a call back domain, if it fails it deletes itself.

Attempts to read a file cosmo.jpeg and if not found, malware self deletes.

If the above file is found we create a file: passwrd.txt.

Malware now reads the cosmo.jpeg file, encodes it and then further encrypts the file with RC4 algorithm using a KEY from passwrd.txt file’s contents.

This encrypted data is then exfiltrated to another domain.

If during all of this process malware is interrupted, it self deletes.

If you found this article valuable, consider clapping to help others discover it. Follow Sagar and The Malware Files to stay connected and be part of a growing community exploring malware, security, and digital threats together.