Decoding BATLOADER 2.X: Unmasking the Threat of Stealthy Malware Tactics

Estimated reading time: 5 minutes

Overview:

Batloader is not a new malware in the series – it is an emerging one. In our previous blogs, we discussed how Batloader can deploy different types of malware, including stealers and ransomware. We also delved into its role as an initial access gainer, and highlighted its highly evasive nature, along with its ability to continuously upgrade itself over time.

Various techniques are employed in delivering malware to the user’s system. Such methods include phishing emails, masquerading documents, or downloading cracked software. Amongst these, downloading cracked software may seem harmless to regular users since malware often utilizes genuine file names and conducts most of the malicious activities in the background, or injects a clean file with malicious code.

In this blog, we will analyze how Batloader loads the payload, which in this case, is a stealer.

Technical Analysis:

Figure 1: Infection Chain

The cabinet file contains a bat file, which is dropped at a temporary location, executed, and later deleted.

Figure 2: Cabinet File

Figure 3: Bat File Extracted

The starting comment for the obfuscated bat file is a base64 encoded, AES-encrypted gZip stream. This is later decrypted to a dotnet file and then dropped at a temp location.

Figure 4: Obfuscated Bat File

Figure 5: Obfuscated Bat File

The deobfuscated bat file contains a PowerShell script that copies the genuine powershell.exe to the current folder and executes it. The PowerShell script then takes the starting comment in the bat file to perform the below actions –

1. Remove specific keywords.
2. Convert it from Base64 encoding.
3. AES decryption with CBC mode.
4. Decompressed the GZipStream received from 3^rd
5. Load the Assembly from EntryPoint.

Figure 6: PowerShell Script

The powershell script drops the Asyncrat malware dotnet exe under the temp folder and starts its execution.

Stage 3: AsyncRat

The dropped file is unprotected and deobfuscated.

Figure 7: Dropped Exe File

Execution of asyncrat starts with Initializing the configurations by decrypting the values, which are AES encrypted in CBC mode with base64 encoding.

Figure 8: Configuration Initialization

Figure 9: AES Decryption

Anti Analysis Module

It examines the environment to find out if the sample is under analysis by checking for the presence of a debugger, sandbox, and other indicators. If any are detected, it terminates its execution.

Figure 10: Anti-Analysis Module

If any amongst the list of processes like Taskmgr, ProcessHacker, ProcExp, etc., are detected during execution, results in the processes being terminated.

Figure 11: Terminating Process

AMSI and Event Tracing Bypass

To bypass AMSI/event tracing it identifies the system architecture based on which corresponding functions are called.

Figure 12: ByPass

AMSI is a windows Anti Malware Scan Interface that allows applications and services to integrate with anti-malware product.

Components that are integrated with AMSI are:

• User Access Control
• Powershell
• Windows Script Host
• JavaScript and VBScript
• Office VBA Macro

To bypass it patches amsi.dll’s amsiscanbuffer() function.

Figure 13: AMSI ByPass

 To achieve this

• First it retrieves the address of the corresponding function – amsiscanbuffer
• Then, it changes the memory protection, using NtProtectVirtualMemory(), for the page to write the new instructions.
• Further, it patches the memory with corresponding new bytes:
  • x86_am_si_patch = 0xB8, 0x57, 0x00, 0x07, 0x80, 0xc2, 0x18, 0x00;
  • x64_am_si_patch = 0xB8, 0x57, 0x00, 0x07, 0x80, 0xc3;

Figure 14: Patching Memory

Event tracing is a mechanism used to trace user and kernel level applications/drivers and is a part of the windows operating system. It is an important feature that helps security vendors to identify anomalous behavior in the running applications.

To bypass, it patches the EtwEventWrite() function of ntdll. To achieve this, the process is the same as mentioned above for amsi bypass. Newly written bytes are:

• x64_etw_patch = 0x48, 0x33, 0xc0, 0xc3;
• x86_etw_patch = 0x33, 0xc0, 0xc2, 0x14, 0x00;

Figure 15: Event Tracing ByPass

Persistence

It creates a run entry if it has admin rights. Otherwise it creates a scheduled task for timely execution.

Figure 16: Registry Entry

Figure 17: Schedule Task

It creates a temporary bat file to copy itself to %temp% location and later deletes the bat file and starts execution of dropped file.

Figure 18: Installation

Then it checks for Pastebin details if that is set to null, it tries to connect with url “jzx100.myddns.me”. After that, it keeps on trying to connect in loop until it gets the connection.

Figure 19: CnC Connection

Once the connection is successful it will send the below information username, OS, Camera, antivirus installed, etc., as shown in the pic.

Figure 20: Sending Info to CnC

At the time of our analysis the url was not active. Through code analysis it also looks like it will receive below commands from CnC and it will work accordingly where it seems to invoke the plugin received in the packet and keep the connection alive.

Figure 21: CnC Commands

Conclusion:

Users should avoid downloading cracked software as they do more harm without users’ knowledge. Stealers sending sensitive data to the CnC could be used further to plan attacks or to gain profit. Moreover, these stealers have features to download more payloads, which can lead to the deployment of ransomware onto the system.

IOC’s:

96B07F8951F4BDEB95856D9477071865

1528F443777A42B09AE19D7E6F5F508A

Author:

Rumana Siddiqui