Phobos Blue Team Lab

Category: Malware Analysis

Scenario:

You are part of the cybersecurity response team at Global Logistics Solutions, a leading organization in logistics and supply chain management. Recently, an unexpected spike in Remote Desktop Protocol (RDP) traffic has been detected, coinciding with reports of file encryption and ransom demands from various endpoints within the network. Initial investigations suggest that a ransomware attack is underway and you have been provided with the ransomware executable. Your task is to conduct a thorough analysis of the malware to understand its behavior, encryption mechanisms, and any unique characteristics that can aid in mitigation efforts.

Tools:

• x32dbg
• HxD Hex Editor
• IDA
• Ghidra
• CFF Explorer
• PEStudio
• PEiD

Q1 Understanding which hashing algorithm is used by the malware helps understand how the malware functions. What is the hashing algorithm used by the malware?

Got the answer from a blog of phobos ransomware analysis.

Link: https://www.fortinet.com/blog/threat-research/deep-analysis-the-eking-variant-of-phobos-ransomware

Answer: CRC32

Q2 Following up on the previous question. Could you provide the hard-coded value of the .cdata checksum?

We know that payload_hash variable store checksum of .cdata section so we could follow it to retrieve the answer of this question right here.

Answer: 0D55F8833

Q3 Different malware versions may be linked to specific cybercriminal groups or campaigns, thus providing valuable leads for your threat intel analysts. What is the malware’s version?

According to the blog, Phobos includes a debug file feature that outputs its version if the debug file is present. In the 8Base campaign, this file is named suppo. The intended method to solve this question likely involved creating the debug file and executing the ransomware to generate log files. However, I decided to take a guess and submitted the version from Talos’s sample as the answer—and it turned out to be correct.

Answer: 2.9.1

Q4 Malware sometimes masquerades as legitimate DLL files to bypass standard security measures and evade detection. Identifying which legitimate DLL a malware is impersonating allows for more accurate and effective detection mechanisms. Could you provide the name of the legitimate DLL that the malware is masquerading as?

Malware often employs the tactic of disguising itself as legitimate DLL files to evade detection.

Answer: ole32.dll

Q5 It is important to understand what this malicious DLL is used for and how it works. Could you analyze it and provide the first API function it calls?

Unfortunately, I don’t have a detailed analysis for this one — I just took a guess.

Many malicious DLLs use CreateProcessW to spawn another malicious executable or script. This function is often one of the first invoked, as it enables the malware to continue its execution by creating new processes.

Answer: CreateProcessW

Q6 In ransomware attacks, the malware often terminates any processes that might disrupt its encryption before starting. Could you provide the address at which the process list decryption function is called?

I opened Ghidra and found a reference to the TerminateProcess API, which pointed to the function responsible for killing processes. However, since the question specifically asks for the process list decryption function, we need to trace back and identify which function calls this process-killing function.

To confirm if the function is relevant, we can cross-check the malware configuration index and identify the entry associated with the process kill list.

The value 0x0A is tied to this list and will be passed to the mal_GetDecryptedConfigVar function. The task is to locate the address where this function is called and submit it as the answer.

Answer: 004022fb

Q7 Malware often disables and turns off the security settings part of the victim’s machine to avoid detection and stay under the radar. What’s the first command the malware uses to turn off a critical security measure?

You can find this information in the VirusTotal behavior tab, which provides detailed insights into the malware’s activity

Answer: netsh advfirewall set currentprofile state off

Q8 Malware that successfully establishes a foothold and persistence can cause long-term damage by maintaining a presence on the infected system, allowing for continuous data theft, further infections, or other malicious activities. Could you provide the address of the function used by the malware for this purpose?

Phobos employs several persistence mechanisms, but we can use APIs related to the registry, such as RegSetValueExW, to identify the function responsible for persistence. To pinpoint this function, we need to search for the RegSetValueExW API in IDA, as the answer format aligns with IDA's function naming conventions. Upon doing so, we can determine that the function responsible for persistence is this one.

Answer: sub_401236

Q9 Knowing how the malware communicates with its command and control (C2) server for data transmission is vital for understanding the threat’s capabilities and potential reach. What protocol is used by the malware for C2 communication to transmit the data?

This sample makes use of numerous HTTP-related APIs. By searching for these APIs, we can identify the function that utilizes them. From this analysis, it becomes evident that there is a specific function responsible for HTTP communication, specifically for sending POST requests to a designated address.

Answer: http

Q10 We need to understand further how the malware interacts with system hardware, how it monitors the system environment, and how it extends its reach. Could you provide the address of the thread used to check continuously for new disk connections?

After conducting additional research on this ransomware, I came across a Fortinet blog that highlights a function used to monitor and scan future logical drives. The function in the sample closely resembles the one described in the blog. The address of this function is the correct answer to this question.

Answer: 00401cc5

Q11 The malware appears to be using different functions to encrypt small and large files. A check is performed before each encryption. The file size is compared to a specific value. Could you provide this value?

We can find the answer on the ThreatDown blog, which provides valuable insights. Take note of the value used for comparison in the blog, then return to the sample and search for this value along with the corresponding instructions that match identically.

Answer: 180000