WithSecure STINGR released a technical analysis of a previously undocumented Windows packer named TangleCrypt that hides payloads inside PE resources using base64, LZ78 compression, and XOR, and that delivered STONESTOP payloads which leverage the ABYSSWORKER malicious driver. The packer supports executing payloads in-process or in a child process, employs string encryption and dynamic import resolving, and contains implementation flaws (TLS handling and incomplete API re-implementations) that can cause crashes or unexpected behavior. #TangleCrypt #STONESTOP
Keypoints
- TangleCrypt is a newly identified custom PE packer that stores the original executable in PE resources and conceals it using multiple layers: base64 encoding, LZ78 compression and XOR encryption.
- The packer was found on two STONESTOP-bearing executables from a Qilin ransomware incident; the STONESTOP payload uses the ABYSSWORKER malicious driver to terminate security products.
- The loader supports two execution modes selectable by a configuration string appended to the embedded payload: in-process execution or injection into a child process (CreateProcessW + WriteProcessMemory + ResumeThread).
- Anti-analysis measures are limited: many strings are encrypted, imports are resolved dynamically, and an exception-based trick is used, but these are straightforward to bypass for analysts.
- TangleCrypt’s loader was compiled unoptimized and contains flawed re-implementations (e.g., _getmainargs) and discarded TLS information that can break C runtime initialization and cause crashes in some configurations.
- Manual unpacking is practical: analysts can break on VirtualAlloc for in-process mode or on WriteProcessMemory for child-process injection to dump a working unpacked PE from memory.
MITRE Techniques
- [T1027 ] Obfuscated Files or Information – The packer hides the payload using multiple layers of encoding/compression/encryption (‘…The payload is stored inside the PE Resources via multiple layers of base64 encoding, LZ78 compression and XOR encryption…’).
- [T1027.002 ] Software Packing – TangleCrypt implements a custom packing scheme that places the original executable in PE resources and reduces entropy with encrypted NULL regions (‘…the original executable is encrypted inside an entry of the PE resources in the ‘.rsrc’ section…’).
- [T1055 ] Process Injection – The loader supports executing the payload either in the same process or by creating a child process and writing the decrypted payload into it using CreateProcessW, WriteProcessMemory and ResumeThread (‘…starts a child process where the decrypted payload is written to… CreateProcessW, WriteProcessMemory and ResumeThread’).
- [T1548.002 ] Bypass User Account Control – STONESTOP checks for elevated privileges and restarts itself to run with admin rights, triggering a UAC prompt if needed (‘…If not, it will restart itself to run with admin rights, which triggers a UAC prompt by default.’).
- [T1562.001 ] Disable or Modify Tools (Impair Defenses) – The STONESTOP payload registers and uses the ABYSSWORKER driver to terminate listed security processes and optionally delete files in hard-coded directories (‘…uses the driver to terminate all running processes matching an item in this list… All files in these directories will be recursively deleted by the driver.’).
- [T1215 ] Kernel Modules and Extensions – The attack deploys and registers a malicious kernel driver (ABYSSWORKER / POORTRY / BURNTCIGAR) to perform privileged operations against security products (‘…it registers the ABYSSWORKER driver in Windows. The executable assumes that the SYS file is present in the same directory. Then it tries to load and initialize the driver.’).
Indicators of Compromise
- [File name ] IR artifacts and payloads – 4cBh.exe, b1.exe, fehmr.sys (kernel driver masquerading as CrowdStrike Falcon Sensor driver).
- [Driver / component name ] Identified malicious components – ABYSSWORKER (also referenced as POORTRY, BURNTCIGAR), STONESTOP payload.
- [File hash ] Similar sample hash – 73b6e7cdd10c373a633367fd3bde791278e7900b342a21e2bad2b8e5cfc33746 (sample containing an XWorm payload).
- [Detection name ] Vendor detection – WithSecure product detection: Trojan:W32/TangleCrypt.A.
Read more: https://labs.withsecure.com/publications/tanglecrypt