# Smokeloader Malware Analysis

**md5: 13E928FD0CC989BEAF07196FDC8D5BE2**

In this article I going to explain, how the malware works, in a summarized form, at the same time I will remark some antidebug and antivm tricks tricks that the sample uses.

### First Stage Sample Execution

The sample is strongly MFC based (virtual classes (ordinals))

![0_MFC](https://i.imgur.com/FzFHUvZ.png align="left")

Moreover, some of the strings are hidden using this stack-strings technique:

![1_1_Strings_Hidden.png](https://i.imgur.com/PM2VBkb.png align="left")

The process will create a new suspended process, a copy of itself, it will perform some modifications before resuming the thread. **This is the first antidebug trick.**

![1_CreateProcess.png](https://i.imgur.com/g0Og6PZ.png align="left")

### Child Process

Then the code injected in the child process will **overwrite the code in order to difficult the analysis**, we have to be very careful with the break points at this point.

![2_Inicio_New_process_new_thread.png](https://i.imgur.com/KJ13LM2.png align="left")

When the new code is written it will jumps to it, and it will erase the "old code" using **rep stosb byte ptr es:\[edi\], al**

![3_Erase_new_thread_init_stosb.png](https://i.imgur.com/ENvZvLm.png align="left")

rep stosb passed, code erased:

![4_code_erased.png](https://i.imgur.com/BgiJJCD.png align="left")

Then the sample **will check if there is any debugger attached using the PEB + 2 trick**, if it find other value than 0, there is a debugger attached to the process.

![5_PEB_CHECK.png](https://i.imgur.com/osxLt5H.png align="left")

Example bad case, debugger hunted :

![6_Debugger_Not_Hidden.png](https://i.imgur.com/KhHaexd.png align="left")

Debugger Hidden:

![8_Debugger_hidden.png](https://i.imgur.com/kNuJdqg.png align="left")

In addition, it will **check GlobalFlags using PEB + 68**, if it find other value than 0, the program explode :P

![5_2_PEB_68h_check.png](https://i.imgur.com/4nasZP1.png align="left")

The sample will continue **erasing the "old code" and creating the new one**:

![10_REPE_STOSB_FFFFFF.png](https://i.imgur.com/GCwMsg0.png align="left")

The code will find the functions using GetProcAddress after load user32:

![13_before_load.png](https://i.imgur.com/GuDBojS.png align="left")

Resolving addresses:

![14_after_load.png](https://i.imgur.com/wSLN26k.png align="left")

At this point, the process will use SetKernelObjectSecurity

![16_SetKernelobjectSecurity.png](https://i.imgur.com/jfZOghG.png align="left")

**Virtual Machine checks** using **GetVolumeINformationA -> GetQueryValue -> System\\CurrentControlSet\\Services\\Disk\\Enum"**

esi:"SCSI\\Disk&Ven\_VMware\_&Prod\_VMware\_Virtual\_S\\5&1ec51bf7&0&000000"

![17_VM_QEMU_CHECK.png](https://i.imgur.com/Ty2J9fh.png align="left")

Then, the sample will check if there are any string into **"SCSI\\Disk&Ven\_VMware\_&Prod\_VMware\_Virtual\_S\\5&1ec51bf7&0&000000"** related to:

* qemu
    
* virtual
    
* vmware
    
* xen
    

![19_QEMU_CHECK.png](https://i.imgur.com/42txjbs.png align="left")

![20_QEMU_VIRTUAL_VMWARE_XEN.png](https://i.imgur.com/zZZTD5Y.png align="left")

The sample will **check if its name is "sample"** and **if there is installed "AutoItv3CCleanerWIC"** using the "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" entry.

Then it will check **if sbiedll.dll (sandboxie dll) or if dbghelp (ollydbg dll) are loaded**.

![18_VM_Ollycheck.png](https://i.imgur.com/xovyerp.png align="left")

When all the **checks are bypassed**, it will creates a new suspended process, **explorer.exe**, using **CreateProcessInternalA**:

![21_CreateProcessInternalA.png](https://i.imgur.com/Zi22a0q.png align="left")

![24_Resume_Thread_Explorer.png](https://i.imgur.com/IR2tjxW.png align="left")

Some modifications into explorer.exe and finally **ResumeThread**:

![23_Explorer_Inyection.png](https://i.imgur.com/417sad5.png align="left")

Resume thread to start the malicious activity ^^

###Explorer.exe

Code injected into explorer:

![26_Hilo_explorer.png](https://i.imgur.com/NSRvPzS.png align="left")

Cyphering the info:

![27_CifradoInformacion.png](https://i.imgur.com/Bgp6uYV.png align="left")

Creating the PE and persistence:

![28_Creacion_Binario_persistencia.png](https://i.imgur.com/7TPOvUI.png align="left")

Communication with [**jirar.su**](http://jirar.su).

![25_jirar_su.png](https://i.imgur.com/gPCFXJe.png align="left")

### Tricks summarized:

* MFC Code (virtual classes)
    
* Hidden Strings
    
* Creation of child process.
    
* PEB + 2 (Debugger)
    
* PEB + 68 (GlobalFlags)
    
* Erasing/Creating code **rep stosb byte ptr es:\[edi\], al**
    
* VirtualAlloc/VirtualFree
    
* Name "sample"
    
* "System\\CurrentControlSet\\Services\\Disk\\Enum" -> QEMU, Virtual, VMWARE and XEN. (charttolower :P )
    
* "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" -> "AutoItv3CCleanerWIC"
    
* sbiedll.dll (sandboxie dll).
    
* dbghelp (ollydbg dll).
    
* Process tree:
    
    ![22_Explorer_Suspendido.png](https://i.imgur.com/pXxY4nc.png align="left")
    

## The malware connects to the C&C [http://jirar.su/](http://jirar.su/).

However this url is encrypted in the binary. The function that the malware uses to decrypt the C&C is the next:

This function uses ESI register, that points to the start of the ciphered "string", then the function will uses xor operations to descipher the string.

![29_Descifrado_jirar_su.png](https://i.imgur.com/nJ83xuL.png align="left")

![30_Ciphered_string.png](https://i.imgur.com/KDccGnY.png align="left")

![31_jirar.png](https://i.imgur.com/MMqXeJC.png align="left")

### Decryption function

```plaintext
jbe 9719A9                                      
mov al,1                                        
xor ecx,ecx                                     
mov cl,al                                       
add ecx,edi                                     
dec ecx                                         
mov cl,byte ptr ds:[ecx]                        
xor cl,byte ptr ds:[esi]                        
xor ebx,ebx                                     
mov bl,al                                       
add ebx,edi                                     
mov bl,byte ptr ds:[ebx]                        
xor bl,byte ptr ds:[esi]                        
mov byte ptr ss:[esp+4],bl                      
sub cl,byte ptr ss:[esp+4]                      
xor ebx,ebx                                     
mov bl,al                                       
add ebx,dword ptr ss:[esp]                      
dec ebx                                         
mov byte ptr ds:[ebx],cl                        
inc edi                                         
inc eax                                         
dec dl                                          
jne 97197C                                      
xor eax,eax
```