Ransomware Teslacrypt Uncovered - Malware Analysis

White Paper

Foundstone Services

TeslaCrypt Uncovered

By Thomas Roccia

White Paper

2 TeslaCrypt Uncovered – Thomas Roccia

Table of Contents Introduction ............................................................................................................................................................................................................................ 3

Teslacrypt Presentation .................................................................................................................................................................................................... 3

Teslacrypt Protection ......................................................................................................................................................................................................... 4

A brief overview of TeslaCrypt capabilities ........................................................................................................................................................... 11

Conclusion ............................................................................................................................................................................................................................. 16

Table of Figures Figure 1. CreateProcess in packed TeslaCrypt .................................................................................................................... 5

Figure 2. GetThreadContext in packed TeslaCrypt .............................................................................................................. 5

Figure 3. GetThreadContext in packed TeslaCrypt .............................................................................................................. 6

Figure 4. VirtualAlloc in packed TeslaCrypt ........................................................................................................................ 7

Figure 5. Breakpoint at VirtualAlloc .................................................................................................................................... 7

Figure 6. Follow in dump the allocation of the PE ............................................................................................................... 8

Figure 7. Breakpoint on memory space .............................................................................................................................. 8

Figure 8. PE on memory space ............................................................................................................................................ 9

Figure 9. Save memory data to file ..................................................................................................................................... 9

Figure 10. PE in Buffer in WriteProcessMemory ............................................................................................................... 10

Figure 11. PE unpacked File header .................................................................................................................................. 11

Figure 12. PE packed File header ....................................................................................................................................... 11

Figure 13. SeDebugPrivilege ............................................................................................................................................. 12

Figure 14. IsDebuggerPresent ........................................................................................................................................... 13

Figure 15. FindFirstFile ...................................................................................................................................................... 14

Figure 16. FindNextFile ..................................................................................................................................................... 14

Figure 17. HttpSendRequest ............................................................................................................................................. 15

White Paper


Introduction

Cybercrime and malware are becoming more and more complex to steal more money. We recently saw an increase of ransomware cases. Ransomware is a malware that hijacks your data in exchange of a ransom. At the beginning ransomware were not sophisticated and did not use encryption. The access to the computer was only blocked but data could be recovered, we talked about “Locker Ransomware”. Then attackers improve their techniques with the use of encryption, “Crypto Ransomware”. These kind of ransomware targets specific valuable data stored on the computer and encrypt data with strong encryption algorithm. Making thereof unusable without the decryption key. Ransomware attack is a very successful attack, and allows attackers to steal lot of money with a minimal risk. Coupled with the development of anti-analysis technique, the complexity of this malware is still growing. This paper talk about a short analysis of TeslaCrypt v4, the last release of infamous ransomware.

Teslacrypt Presentation

TeslaCrypt is a ransomware released for the first time in February 2015. It finds and encrypt your data then print a message to inform you that your data has been encrypted and is unusable unless you pay to get the decryption key. The first releases of TeslaCrypt were not properly built. As the encryption algorithm was not correctly implemented security researchers were able to create decryption tools. In November 2015, the TeslaCrypt version 2 had also some issues, attackers released the version 3 in January 2016 to correct these issues. With this version, the data was not recoverable. Then in March 2016, the last version released: the version 4. With this version the encryption files keep their original extension and a new name is implemented to the recover files. This latest version don’t allow to decrypt files. TeslaCrypt is now stronger than ever.

White Paper


Teslacrypt Protection

Lot of malwares use protection tricks to trap the analyst and make difficult the reverse engineering and the detection. We will see in this section how to recover the original sample file. The packing technique is commonly used to protect itself the sample. Common packer could be easily to detect and to use to get the original file. However in many case attackers uses custom packer to avoid recovery. In this case, a custom packer is used with multiple decryption and the use of process hollowing technique. Process hollowing is a common technique that inject a malicious code in a suspended process. So to use process hollowing, attackers uses the following Api:

x CreateProcess: in a suspended mode with the CreationFlag at 0x0000 0004.

x GetThreadContext: retrieves the context of the specified thread.

x ZwUnmapViewOfSection: Unmaps a view of a section from the virtual address space of a subject process.

x VirtualAllocEx: allocates memory within the suspended process’s address space.

x WriteProcessMemory: writes data of the PE file into the memory just allocated within the

suspended process.

x SetThreadContext: sets the EAX register to the entry point of the executable written.

x ResumeThread: resumes the thread of the suspended process.

White Paper


We can find these functions in the packed TeslaCrypt:

Figure 1. CreateProcess in packed TeslaCrypt

Figure 2. GetThreadContext in packed TeslaCrypt

White Paper


The prototype is:

BOOL WINAPI GetThreadContext( _In_ HANDLE hThread, _Inout_ LPCONTEXT lpContext );

Then we can see the call of ZwUnmapViewOfSection:

Figure 3. GetThreadContext in packed TeslaCrypt

The prototype is:

NTSTATUS ZwUnmapViewOfSection( _In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress );

White Paper


Then the VirtualAlloc function:

Figure 4. VirtualAlloc in packed TeslaCrypt

LPVOID WINAPI VirtualAlloc( _In_opt_ LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD flAllocationType, _In_ DWORD flProtect );

We can here dump the unpacked file loaded in the memory after the 4th hit of VirtualAlloc. We can see the VirtualAlloc API by hit CTRL+G and enter “VirtualAlloc”:

Figure 5. Breakpoint at VirtualAlloc

White Paper


By pressing F9 we hit the breakpoint, then we return to usercode, and follow the register EAX in memory.

Figure 6. Follow in dump the allocation of the PE

We have now in memory pan an empty space which will be fill by the function. We can setup a hardware breakpoint to see what’s happened.

Figure 7. Breakpoint on memory space

White Paper


Then we press F9 to check the file dropped in the memory space. Here we see the memory during each hit of VirtualAlloc. The sample unpacked is the last one.

Figure 8. PE on memory space

We can dump this one for analysis with “save data to file”.

Figure 9. Save memory data to file

Invalid PE Valid PE but still packed

Valid PE unpacked

White Paper


At this point we have a valid unprotected PE.

The other way to dump quickly the PE without hit each VirtualAlloc is to setup a breakpoint at WriteProcessMemory API and follow in memory the buffer.

Figure 10. PE in Buffer in WriteProcessMemory

BOOL WINAPI WriteProcessMemory( _In_ HANDLE hProcess, _In_ LPVOID lpBaseAddress, _In_ LPCVOID lpBuffer, _In_ SIZE_T nSize, _Out_ SIZE_T *lpNumberOfBytesWritten );

With the valid unprotected PE we can now analysis it to better understand his behavior.

White Paper


A brief overview of TeslaCrypt capabilities After unpacked the file we can find more interesting information.

The original date of compilation can be found the March 18 2016 at 09:37:49 UTC.

Figure 11. PE unpacked File header

The date before the unpacking was the February 22 2007 at 5:38:20 UTC.

Figure 12. PE packed File header

Metadata: File Name unpackTesla.mem File Size 249856 bytes File Type PE32 executable (GUI) Intel 80386, for MS Windows

Md5 ea3ccdd7c69b5e1a18c473d937c68c37 Ssdeep 6144:NSMPQFF58b1H2towR74r7kLeY4U3HUck:NSJFF41H2to07475A0

White Paper


Malware uses some trick to elevate their privilege one of this trick is to use the SeDebugPrivilege, which attribute the System privilege to the malware. The following screenshot shows how it’s working.

Figure 13. SeDebugPrivilege

When the sample is running, it enables the SeDebugPrivilege by setting an access token right. An access token is an object containing the security descriptor of a process. The sample uses the functions OpenProcessToken and LookupPrivilegeValue to get the LUID (Local Unique Identifier) and check the privilege SeDebugPrivilege. Then the sample used the function AdjustTokenPrivilege for setting the token. The SeDebugPrivilege is normally used for system level debugging but it is also a trick used by malware coder to gain access to system level process.

White Paper


The malware also uses some anti-debugging technique; we can find the API IsDebuggerPresent that check if the process is being debugged or not.

Figure 14. IsDebuggerPresent

If the debugger is detected the sample terminate the process, and never call the rest of the code.

Debugger detection

Rest of the code

Terminate process if debugger is detected

White Paper


To browse the disk and find all the file to encrypt, the sample use both API, FindFirstFile and FindNextFile.

Figure 15. FindFirstFile

Figure 16. FindNextFile

White Paper


To connect with the remote IP and register the infected machine, the function HttpSendRequest is used.

Figure 17. HttpSendRequest

The sample try to connect to the following IP.

Domain Ip resumosdenovela.net 108.167.185.237 classemgmt.testbada.com 115.94.157.252 shampooherbal.com 104.128.239.91 exaltation.info 46.235.47.104 commonsenseprotection.com 50.116.109.230 ebookstoreforyou.com 87.229.77.69

White Paper


During the analysis we found some part of code referring to a Bitcoin foundation github project (secp256k1). (https://github.com/bitcoin/secp256k1)

The Secp256k1 is used in Bitcoin and defined in Standards for Efficient Cryptography. (https://en.bitcoin.it/wiki/Secp256k1)

We can find the code above at this address: https://github.com/bitcoin/secp256k1/blob/master/src/secp256k1.c

Conclusion

This short paper briefly presents some functionalities of TeslaCrypt and brings an overview of its capacities. With the increasing development of cybercrime, ransomware gain in strength and become more complex and powerful. As we know TeslaCrypt is still active and developers continue to improve their code in order to gain more money. The best way to avoid infection is still to educate users but also to do regular backups. To be continued…

https://github.com/bitcoin/secp256k1)

https://en.bitcoin.it/wiki/Secp256k1)

https://github.com/bitcoin/secp256k1/blob/master/src/secp256k1.c

Technology

Ransomware Teslacrypt Uncovered - Malware Analysis