Thursday, June 25, 2020

my weak attempt at Trickbot analysis in IDA

Trickbot
https://app.any.run/tasks/229b1b03-c04b-4826-a9f4-1a0c60f87d9a/
md5 09CF5ED5EDF9532A802526B663277739
6/25/2020

WinMain
varSomeKeyValue = "random chars"
call subLoadMshtaAndKernel32Dll()
LoadLibrary("mshta")
LoadLibrary("kernel32")
ret1 = call subReturnAddressToNextCall
call subNoNestingCalculatAddress
LoadResource(35893)
ret2 = call ret1(CurrentProcessHandle)
loop [ move data ]
call subNoNestingPrintError
printf("Error %d: %s.\n")
call ret2 (segment that originally was not in "text/code" segment, debug042)
repeated calls [ call subNoNestingDecodeString ] (LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualProtect, ZwFlushInstructionCache)
call GetNativeSystemInfo (check vm/sandbox cores?)
call VirtualAlloc
returned EAX 0x00480000
call ZwFlushInstructionCache (ensures cpu sees the malicious "memory change")
call esi (another segment that originally was not in "text/code" segment)
threw exception invalid instruction (debug044:004AFC40)
Load String Resources
Load Bitmap Resource 138
call subNoNestingLoadResourcesAndRegisterWindow()
call subNoNestingGetWidthHeightScreenCreateWindowSetWindowPosition()
Load Accelerators (keyword shortcuts) , get messages , and dispatch messages

1 comment:

  1. I want to thank Dr Emu a very powerful spell caster who help me to bring my husband back to me, few month ago i have a serious problem with my husband, to the extend that he left the house, and he started dating another woman and he stayed with the woman, i tried all i can to bring him back, but all my effort was useless until the day my friend came to my house and i told her every thing that had happened between me and my husband, then she told me of a powerful spell caster who help her when she was in the same problem I then contact Dr Emu and told him every thing and he told me not to worry my self again that my husband will come back to me after he has cast a spell on him, i thought it was a joke, after he had finish casting the spell, he told me that he had just finish casting the spell, to my greatest surprise within 48 hours, my husband really came back begging me to forgive him, if you need his help you can contact him with via email: Emutemple@gmail.com or add him up on his whatsapp +2347012841542 is willing to help any body that need his help.

    ReplyDelete