Nico Yturriaga September 27, 2014

Nico YturriagaSeptember 27, 2014

Why Necurs?� Infected 80,000+ during December 2012

� Tagged as “Rootkit for Hire”

� In the wild

What is a Rootkit?

� Stealthy type of software

� Activated at boot up

� Removal can be complicated or practically impossible

Necurs is...

� Obfuscated / Encrypted

� Protective to itself and components

� Able to Prevent AV Installation

Basic Flow

MaliciousURL/Spam

DropperDownloadsNecurs

NecursProtectsitsRegistry,FilesandProcesses

DropperDownloads

Zeus

NecursAddsZeustoitsProtection

The Components

� The Dropper (Executable .exe)vInfection Symptoms, The Executable,

Rootkit Installation

� The Rootkit (Driver .sys)vThe Driver, Access Denial, AV and

Application Blocking

Infected by Necurs?The Dropper

§ Windows Platform (32 bit / 64 bit)

§ Query ‘Syshost32’ Service.

Query ‘Syshost32’ Service

The Dropper - Symptoms




§ ‘Syshost.exe’ in Device Manager

‘Syshost.exe’ in Device Manager


The Dropper Executable





§ Parse “HKLM\ System\ CurrentControlSet\

Services”

Parse “HKLM\System\CurrentControlSet\Services”







Services”

§ Verify Driver File Access Denial

Verify Driver File Access Denial


16 characters length of driver file name [a-f, 0-9]






Services”

§ Verify Driver File Access Denial

The ExecutableThe Dropper

§ Sample was obtained June 2014.

§ MD5 : 917406e5d63a4538e7a4e28f5dd13bef

§ Obfuscated and will eventually decrypt a new

file : 39db776b96383b491362d7f003a1ffd0

Rootkit InstallationThe Dropper

DecryptedExecutable Administrator?

Exploitvulnerability

CVE-2010-4398

NO

Privilege EscalationThe Dropper

§ Vulnerability listed as CVE-2010-4398

§ allows local users to gain admin privileges

§ bypass the User Account Control (UAC)




CVE-2010-4398

NO

DownloadRootkit

Rootkit DownloadThe Dropper

§ Manipulate Windows Firewall by netsh.exe

§ Decrypt a List of IP addresses




CVE-2010-4398

NO

DownloadRootkit

InstallRootkitKERNELMODE


§ Create System file


§ Load Rootkit as a Service

The DriverThe Rootkit

§ MD5 : eaa43802c3801389911b6ad35c0ee71

§ Sample was Downloaded June 2014

§ Obfuscated and will eventually decrypt a new file : 787328fa36df1ce151eebf44fe07c0a6

§ 16 characters file name [0-9, a-f] “.sys” extension


§ Registry Entry at “\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services”

LoadBootDeviceDrivers




SERVICE_BOOT_START


§ “\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder”


ServiceGroupOrderList



§ Able to load in Safe Mode

§ Load before other Drivers


ServiceGroupOrderList

CheckTagNumber

Driver – Dropper CommunicationThe Rootkit

§ Create device object "NtSecureSys" and a Symbolic link "\??\NtSecureSys"o 0x22000C – Request Rootkit File Patho 0x220010 – Request Rootkit Registry Patho 0x220018 – Update the rootkit driver file by a

supplied buffero 0x22001C – Uninstall the Rootkito 0x22002C – terminate a process using a

supplied process name

Access DenialThe Rootkit

§ Registry - CmRegisterCallback API


§ Registry CallBack FlowAccessRegistry

RootkitThread?

Set/DelRootkitKey?

DenyAccess

GrantAccess

YES YES

YES Services.exe/Rootkit?

YES

NONO

OpenRootkitKey?


§ File Access - Filesystem


§ FileSystem Filter Flow

DenyAccess

GrantAccess

FileAccess

FilterFileAccessType

RemovefromFileObjects

CloseFileAccess?

Component?

Write/SetFileAccess?

CheckDatabase

Rootkit/Registered?

Open/OtherFileAccess?

NO

NO

YES

YES

YES

YES

YES


§ Process / Thread v API ObRegisterCallbacksv NtOpenProcess, NtOpenThread [SSDT]


§ Process / Thread Call Back

NO

NOYES

YES

OpenProcess/Thread

Thread?

GetThreadOwnerProcess

TargetRootkitProcess?

OwnProcess?

Svchost/Lsass?

ProceedNormally

DisAllowOperation

LimitOperations

YES

NO

NO

YES

Application BlockingThe Rootkit

§ Black and White Listing Capabilitiesv Values at “\REGISTRY\MACHINE\SYSTEM\

CurrentControlSet\Services”ParseRegistryValues

“ImagePath”

ParsePEfilesatSystem32and

System32\Drivers

VersionInfoandFileName?

ComputeMD5Hash

StoreatDB1/DB6

StoreatDB2/DB5

Not Blacklisted / To White list

ContinueParsing

Blacklisted ComputeFileNameFMV–

1Hash


§ API PsSetLoadImageNotifyRoutine

ApplicationLoadedinMemory

Black/White?

ModifyEntryCodeofApplicationinMemory

END

Black


GameOver Zeus

� Resurrected as of July 2014

� Used to install CryptoLocker ransomware.

� Blamed for more than $100 million theft from banks, businesses and consumers worldwide.

Removal Tips

� Use a Boot CD e.g. [Hiren’s]

� Demonstration

References

� http://stopmalvertising.com/rootkits/analysis-of-zeus-gameover-with-necurs.html

� http://www.f-secure.com/weblog/archives/00002717.html

� http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4398

� http://www.infosecurity-magazine.com/view/29806/necurs-rootkit-not-new-but-spreading-fast-warns-microsoft

� krebsonsecurity.com/tag/gameover-zeus/� MSDN� Peter Ferrie http://pferrie.host22.com/papers/

Documents

Nico Yturriaga September 27, 2014