The-FLARE-On-Challenge-01/Challenge-5

From aldeid
Jump to navigation Jump to search
You are here
Challenge 5

Identification

Download the file: http://www.flare-on.com/files/C5.zip and uncompress it using "malware" as the password:

$ 7z x C5.zip

7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=fr_FR.utf8,Utf16=on,HugeFiles=on,4 CPUs)

Processing archive: C5.zip

Extracting  5get_it
Enter password (will not be echoed) : malware


Everything is Ok

Size:       101376
Compressed: 39309

It results in a file named 5get_it which is a DLL:

$ file 5get_it 
5get_it: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

This program is a keylogger

IAT

Let's open the file into IDA Pro and check what imports we find. The presence of GetAsyncKeyState indicates that we have probably to do with a keylogger.

Flare-on-challenge-1-c5-001.png

DllMain

If we focus on the calls, we can see 2 interesting functions:

Flare-on-challenge-1-c5-002.png

sub_1000A610 (offset 0x1000A764)

A quick "Xref from" shows that sub_1000A610 (offset 0x1000A764) sets up registry keys:

Flare-on-challenge-1-c5-021.png

sub_1000A4C0 (offset 0x1000A772)

Let's have a look at sub_1000A4C0 (offset 0x1000A772). Again, there are two functions we want to analyze:

Flare-on-challenge-1-c5-003.png

sub_10001000 (offset 0x1000A53E)

This function writes to svchost.log which is very likely to be the log file where keystrokes are written.

Flare-on-challenge-1-c5-004.png

sub_10009EB0 (offset 0x1000A52C)

The Graph overview shows a typical switch case scenario:

Flare-on-challenge-1-c5-005.png

Where the cases are very likely to be the keys:

Flare-on-challenge-1-c5-006.png

The "m" key

sub_10001240 (offset 0x10001240)

Now, we have a good overview of what this program does but it did not help us find the email (solution). So we continue our anlaysis. Doing a "Xref from" graph on sub_10009EB0 shows a zone that might be interesting:

The-FLARE-On-Challenge-01-5-001.png

If we zoom on the region of interest, we see a function, sub_10001240, called from sub_10009AF0, itself called from sub_10009EB0 that we have already analyzed above

The-FLARE-On-Challenge-01-5-002.png

Flare-on-challenge-1-c5-007.png

sub_10001240 seems to build a huge stack string:

.text:10001240 sub_10001240    proc near               ; CODE XREF: sub_10009AF0+11�p
.text:10001240
.text:10001240 var_1590        = dword ptr -1590h
.text:10001240 var_158C        = word ptr -158Ch
.text:10001240 var_158A        = word ptr -158Ah
.text:10001240 var_1588        = word ptr -1588h
.text:10001240 var_1586        = word ptr -1586h
.text:10001240 var_1584        = word ptr -1584h
.text:10001240 var_1582        = word ptr -1582h
.text:10001240 var_1580        = word ptr -1580h
.text:10001240 var_157E        = word ptr -157Eh
.text:10001240 var_157C        = word ptr -157Ch
.text:10001240 var_157A        = word ptr -157Ah
[SNIP]
.text:10001240 var_C           = word ptr -0Ch
.text:10001240 var_A           = word ptr -0Ah
.text:10001240 var_8           = word ptr -8
.text:10001240 var_6           = word ptr -6
.text:10001240 var_4           = dword ptr -4
.text:10001240
.text:10001240                 push    ebp
.text:10001241                 mov     ebp, esp
.text:10001243                 mov     eax, 1590h
.text:10001248                 call    __alloca_probe
.text:1000124D                 mov     eax, ___security_cookie
.text:10001252                 xor     eax, ebp
.text:10001254                 mov     [ebp+var_4], eax
.text:10001257                 mov     [ebp+hWndParent], 0
.text:10001261                 mov     [ebp+dwInitParam], 0
.text:10001268                 mov     eax, 43h
.text:1000126D                 mov     [ebp+var_158C], ax
.text:10001274                 mov     ecx, 6Fh
.text:10001279                 mov     [ebp+var_158A], cx
[SNIP]
.text:10009286                 mov     [ebp+var_26], dx
.text:1000928A                 mov     eax, 0Ah
.text:1000928F                 mov     [ebp+var_24], ax
.text:10009293                 xor     ecx, ecx
.text:10009295                 mov     [ebp+var_22], cx
.text:10009299                 lea     edx, [ebp+var_18]
.text:1000929C                 push    edx             ; wchar_t *
.text:1000929D                 push    offset word_1001701E ; wchar_t *
.text:100092A2                 call    _wcscpy
.text:100092A7                 add     esp, 8
.text:100092AA                 lea     eax, [ebp+var_158C]
.text:100092B0                 push    eax             ; wchar_t *
.text:100092B1                 push    offset word_10017034 ; wchar_t *
.text:100092B6                 call    _wcscpy
.text:100092BB                 add     esp, 8
.text:100092BE                 lea     ecx, [ebp+var_1570]
.text:100092C4                 push    ecx             ; wchar_t *
.text:100092C5                 push    offset word_10017062 ; wchar_t *
.text:100092CA                 call    _wcscpy
.text:100092CF                 add     esp, 8
.text:100092D2                 cmp     [ebp+hWndParent], 0
.text:100092D9                 jz      short loc_100092F2
.text:100092DB                 push    0FFFFFFFAh      ; nIndex
.text:100092DD                 mov     edx, [ebp+hWndParent]
.text:100092E3                 push    edx             ; hWnd
.text:100092E4                 call    ds:GetWindowLongA
.text:100092EA                 mov     [ebp+var_1590], eax
.text:100092F0                 jmp     short loc_10009300

Since the function has no argument, let's run it in OllyDbg and change the EIP (to do that, go to offset 0x10001240, right click and select "New origin here"):

Flare-on-challenge-1-c5-071.png

Once done, run the program (F9). It will pop up the following box:

Flare-on-challenge-1-c5-072.png

sub_10009AF0 (offset 0x10009AF0)

As depicted below, the sub_10009AF0 function is checking a global variable to determine whether the "FLARE" box will be displayed and then it seems to catch the "m" key.

Flare-on-challenge-1-c5-008.png

What is this dword_100194FC variable?

The "o" key: sub_10009B60 (offset 0x10009B60)

dword_100194FC

Cross references show that dword_100194FC is set to:

Flare-on-challenge-1-c5-009.png

dword_100194FC is set to 1 by the "o" key

Looking at sub_10009B60 at offset 0x10009B60 shows that dword_100194FC is set when the "o" key is pressed.

Flare-on-challenge-1-c5-010.png

__cfltcvt_init (offset 0x10001060)

This function seems to initialize variables:

Flare-on-challenge-1-c5-020.png

We already know that dword_100194FC is set to 1 by the "o" key. Let's check cross references for the other variables.

Now, let's see where dword_100194F8 is set to 1. Cross references show that it is set to 1 in sub_10009850.

Flare-on-challenge-1-c5-022.png

And it correspond to the "c" key:

Flare-on-challenge-1-c5-023.png

The solution

At the end, we have:

.text:10001060 __cfltcvt_init proc near
.text:10001060 push    ebp
.text:10001061 mov     ebp, esp
.text:10001063 mov     dword_10017000, 1
.text:1000106D mov     dword_10019460, 0 ; set to 1 by "l" in sub_10009AA0
.text:10001077 mov     dword_10019464, 0 ; set to 1 by "0" in sub_10009440
.text:10001081 mov     dword_10019468, 0 ; set to 1 by "g" in sub_10009990
.text:1000108B mov     dword_1001946C, 0 ; set to 1 by "g" in sub_10009990
.text:10001095 mov     dword_10019470, 0 ; set to 1 by "i" in sub_10009A30
.text:1000109F mov     dword_10019474, 0 ; set to 1 by "n" in sub_10009B10
.text:100010A9 mov     dword_10019478, 0 ; set to 1 by "g" in sub_10009990
.text:100010B3 mov     dword_1001947C, 0 ; set to 1 by "d" in sub_10009880
.text:100010BD mov     dword_10019480, 0 ; set to 1 by "o" in sub_10009B60
.text:100010C7 mov     dword_10019484, 0 ; set to 1 by "t" in sub_10009CD0
.text:100010D1 mov     dword_10019488, 0 ; set to 1 by "u" in sub_10009D80
.text:100010DB mov     dword_1001948C, 0 ; set to 1 by "r" in sub_10009C30
.text:100010E5 mov     dword_10019490, 0 ; set to 1 by "d" in sub_10009880
.text:100010EF mov     dword_10019494, 0 ; set to 1 by "o" in sub_10009B60
.text:100010F9 mov     dword_10019498, 0 ; set to 1 by "t" in sub_10009CD0
.text:10001103 mov     dword_1001949C, 0 ; set to 1 by "5" in sub_100094D0
.text:1000110D mov     dword_100194A0, 0 ; set to 1 by "t" in sub_10009CD0
.text:10001117 mov     dword_100194A4, 0 ; set to 1 by "r" in sub_10009C30
.text:10001121 mov     dword_100194A8, 0 ; set to 1 by "0" in sub_10009440
.text:1000112B mov     dword_100194AC, 0 ; set to 1 by "k" in sub_10009A70
.text:10001135 mov     dword_100194B0, 0 ; set to 1 by "e" in sub_10009910
.text:1000113F mov     dword_100194B4, 0 ; set to 1 by "5" in sub_100094D0
.text:10001149 mov     dword_100194B8, 0 ; set to 1 by "a" in sub_100097D0
.text:10001153 mov     dword_100194BC, 0 ; set to 1 by "t" in sub_10009CD0
.text:1000115D mov     dword_100194C0, 0 ; set to 1 by "f" in sub_10009960
.text:10001167 mov     dword_100194C4, 0 ; set to 1 by "l" in sub_10009AA0
.text:10001171 mov     dword_100194C8, 0 ; set to 1 by "a" in sub_100097D0
.text:1000117B mov     dword_100194CC, 0 ; set to 1 by "r" in sub_10009C30
.text:10001185 mov     dword_100194D0, 0 ; set to 1 by "e" in sub_10009910
.text:1000118F mov     dword_100194D4, 0 ; set to 1 by "d" in sub_10009880
.text:10001199 mov     dword_100194D8, 0 ; set to 1 by "a" in sub_100097D0
.text:100011A3 mov     dword_100194DC, 0 ; set to 1 by "s" in sub_10009CA0
.text:100011AD mov     dword_100194E0, 0 ; set to 1 by "h" in sub_10009A00
.text:100011B7 mov     dword_100194E4, 0 ; set to 1 by "o" in sub_10009B60
.text:100011C1 mov     dword_100194E8, 0 ; set to 1 by "n" in sub_10009B10
.text:100011CB mov     dword_100194EC, 0 ; set to 1 by "d" in sub_10009880
.text:100011D5 mov     dword_100194F0, 0 ; set to 1 by "o" in sub_10009B60
.text:100011DF mov     dword_100194F4, 0 ; set to 1 by "t" in sub_10009CD0
.text:100011E9 mov     dword_100194F8, 0 ; set to 1 by "c" in sub_10009850
.text:100011F3 mov     dword_100194FC, 0 ; set to 1 by "o" key in sub_10009B60
.text:100011FD mov     dword_10019500, 0
.text:10001207 pop     ebp
.text:10001208 retn
.text:10001208 __cfltcvt_init endp

which leads to:

l0ggingdoturdot5tr0ke5atflaredashondotcom

Replacing the keywords "dot", "at", "dash" by the characters, we have:

$ echo "l0ggingdoturdot5tr0ke5atflaredashondotcom" | sed "s/dot/./g; s/at/@/; s/dash/-/"
[email protected]

Comments

blog comments powered by Disqus

Keywords: reverse-engineering challenge flare fireeye pdf shellcode