Table of Contents

• Introduction
• Analysis stage 2
• Jump to stage 3
• Conclusion

Introduction

Here we come to the next part of my write-up for Z2A custom sample.

Analysis stage 2

Making a quick triage summary showed that the stage 2 of this sample didn’t seem to be packed, so I decided to start analyzing it statically. The main function is at 0x401ea0

First, it tries to get the name of current module and checks something with it in the function sub_401660.

Diving into this function, I saw a repeated constant. Searching for that constant revealed that it is using CRC32 hashing. So I renamed this function to CRC32.

Returning to the main function, I deciced to use Hashdb plugin from OALab to look up the hash, and surprisingly, it resolved to svchost.exe.

The program checks if the name of the current module is svchost.exe. If it is, it jump to it’s main_routine. If not, it creates a new svchost process, writes over the process memory, and then continues to call main_routine.

I decided to focus on the main_routine function. It first resolves some APIs from wininet.dll, then decrypts a url and calls the sub_routine.

The URL contains another URL, which leads to an image of the Z2A logo. I decided to download it and continue analyzing the sub_routine function.

Inside the sub_routine function, it creates a new cruloader directory inside the temp directory and stores the image as output.jpg.

Then, it searchs for the string redaolurc inside the image, which is the reverse of the string cruloader.

Afterward, the content following the redaolurc string is XORed with 0x61. Then, a svchost process is created in a suspended state, which is a signal for process hollowing injection.

Jump to stage 3

Let’s dump stage 3 from the image and analyze it.

Well, the stage 3 is just about opening a message box. Looks like we’ve finished analyzing this sample.

Conclusion

It was a really fun and interesting challenge. However, it was quite easy when the author kept using the process hollowing technique for the injection part. I really expected to see other techniques to sharped my analysis skills. Still, I learned a lot of things from it!