Dissecting Greenburg Campaign Ismdoor and Shamoon / Disttrack.B

April 30, 2017

Dissecting Greenburg Campaign Ismdoor and Shamoon / Disttrack.B

So recently I got my hands on Ismdoor backdoor from the Greenburg campaign, which is linked to spreading Shamoon 2 or Disttrack.B mainly at numerous entities in the Gulf region. Machines infected with Shamoon 2, also had traces and indicators of Ismdoor backdoor on them. It is theorized that Ismdoor was responsible for getting foothold in the network, moving laterally and harvesting credentials, which were later used by Shamoon 2 to spread in the network and creat havoc.

https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon

This blog post is interesting, as here I have analysed Ismdoor, Shamoon dropper, communication module and the wiper module.

It took me some time to evade the anti-analysis techniques deployed by malware author. However, this was not because the techniques were very advanced but mainly because I was not looking at the right place ;) . Also non-usage of packing or obfuscation techniques was favorable scenario.

The Ismdoor sample I got hold had a compilation date of 26 July 2016.

MD5: bf4b07c7b4a4504c4192bd68476d63b5

VT: https://virustotal.com/en/file/7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c/analysis/

Some indicators

We can see addresses of APIs are being XORs and stored

And then the XOR key (5E644B57h) itself being stored for later use to get API names

Some file names can be seen in the resource section Tmp765643.txt, Tmp9932u1.bat and tmp43hh11.txt. Also a reference to some strings like "tasklist" "findstr -i", indicates that the sample will look for certain task from the running processes:

Now this is crazy. Why would the author have all of these strings in clear text and unobfuscated. This clearly shows the purpose of the code, to gather a lot of information about the running system:

Following are what I found:

All of this info is to be pushed to Tmp765643.txt. There is information about domain, username, ipconfig, net view to give info on other machines in the network, list of local users using net user, netstat -anb to get info on connections, systeminfo to get info on what is installed on the machine, patches, network card info, BIOS info, timezone etc, tasklist to see what is running, sc query to get list of all services, using WMIC to gather info like Antivirus, Firewall, Antispyware installed on the machine

-------------------------------------------------------------------------------------------------------------------------

WinHttpClientGETPOSTCookie: charset={[A-Za-z0-9\-_]+}Content-Length: {[0-9]+}Location: {[0-9]+}Set-Cookie:\b*{.+?}\n; ;utf-8{<html>}{</html>}\Microsoft\Windows\Tmp98871\Microsoft\Windows\TmpFiles.txthttp://

//:localhostC:\ddd\wer2.txtHome/CCContent-Length:

Content-Type: application/x-www-form-urlencoded

Ok txt

cmd /a /c echo ========================== (User Name) ========================== > "%localappdata%\Microsoft\Windows\jTmp765643.txt"

cmd /a /c echo %userdomain%\%username% >>"%localappdata%\Microsoft\Windows\jTmp765643.txt" 2>&1

cmd /a /c @echo off