Malware configurations reveal attacker campaigns and behaviors by exposing in-memory configuration data, as demonstrated with IcedID’s encrypted stage-one and stage-two configurations decoded through dynamic analysis. The article also outlines how to scale configuration extraction across samples and derives IoCs (like C2 URLs and campaign IDs) to strengthen detection with Advanced WildFire. #IcedID #Bokbot #bayernbadabum #newscommercde #spkdeutshnewsupp #germanysupportspk #nrwmarkettoys
Keypoints
- Malware configurations are valuable intelligence, containing items such as C2 addresses, administrator passwords, and file drop paths, designed to be easily editable between campaigns.
- Malware protections often include encryption, obfuscation and compression, making static analysis difficult and necessitating dynamic, memory-based analysis.
- The IcedID (Bokbot) analysis demonstrates how configurations are encrypted and stored, linking C2 URLs to campaign IDs and threat actors.
- Unpacking IcedID Stage One uses memory allocation (VirtualAlloc), clearing (Memset) and data movement (Memmove) to reveal the unpacked binary for analysis.
- Stage One and Stage Two configurations are decrypted with keys (Stage One uses an XOR loop; Stage Two uses the last 0x10 bytes of the blob as the key) to reveal IoCs such as C2 URLs and campaign IDs (e.g., 1139942657).
- Scaling up involves intelligent runtime memory analysis, noise filtering, and modular extractors to process malware configurations at scale and populate a malware configuration database with IoCs.
- Palo Alto Networks emphasizes using these parsers to improve detections via Advanced WildFire and to understand campaigns across threat actors targeting various organizations.
MITRE Techniques
- [T1027.001] Obfuscated/Compressed Files and Information (XOR) – An XOR loop was used to decrypt the configuration. “An XOR loop was used to decrypt the configuration.”
- [T1071.001] Web Protocols – C2 communications observed via WinHttpConnect; “The address pointed to by register RDI contains the string of the C2 URL.”
- [T1053.005] Scheduled Task – The infection chain ends with a scheduled task created to persist IcedID stage two. “ends with a scheduled task created to persist IcedID stage two.”
- [T1105] Ingress Tool Transfer – Stage two would only be downloaded if the victim’s machine matched the requirements of the threat actor. “…would only be downloaded if the victim’s machine matched the requirements of the threat actor.”
- [T1027] Obfuscated/Compressed Files and Information – General protection includes a blend of encryption, obfuscation and compression. “These protections often include a blend of encryption, obfuscation and compression.”
Indicators of Compromise
- [Hash] Stage One sample hash – 05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51
- [Domain] Stage One C2 domain – bayernbadabum[.]com
- [Domain] Stage Two C2 domains – newscommercde[.]com, spkdeutshnewsupp[.]com, germanysupportspk[.]com, nrwmarkettoys[.]com
- [URI] C2 URI – news
Read more: https://unit42.paloaltonetworks.com/teasing-secrets-malware-configuration-parsing/