tutorials/notebooks/tbr-files.v0x07.dc.rat.ipynb

{
 "cells": [
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# The Refinery Files 0x07: DCRat\n",
    "\n",
    "This is a short tutorial on how to reproduce the steps from [a recent blog post on DCRat][blog].\n",
    "We will be working with the following sample:\n",
    "\n",
    "[blog]: https://embee-research.ghost.io/dcrat-manual-de-obfuscation/"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "from tutorials import boilerplate as bp\n",
    "bp.store_sample('fd687a05b13c4f87f139d043c4d9d936b73762d616204bfb090124fd163c316e', 'dc.rat')"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Unpacking Step 1\n",
    "\n",
    "The blog post explains how to dump the first stage using dynamic analysis, but we'll do it statically.\n",
    "The payload is obfuscated using a custom encoding routine, I suspect a dynamically generated one that is specific to ConfuserEx,\n",
    "but I do not know for sure.\n",
    "First, let's extract the encoded data itself - this can be done using the [dnfields] unit, which extracts the constant initialization values for fields in .NET assemblies.\n",
    "\n",
    "[dnfields]: https://binref.github.io/#refinery.dnfields"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00.315 MB; 99.99% entropy; data\n",
      "  name = DataField\n",
      "  path = DataField.uint32\n",
      "  type = uint32[78747]\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 44 1F 17 70 B3 21 63 B9 9E 54 C4 DE 0E 66 11 52 8B 2F 14 0B 95 6B E0 2D 6B A8 23 11  D..p.!c..T...f.R./...k.-k.#.\n",
      "0001C: B9 10 EB 7C 63 87 5A E6 BC 98 9F 2A 20 36 1B 38 B6 74 E9 A2 51 36 8C 3A 0E B3 58 E6  ...|c.Z....*.6.8.t..Q6.:..X.\n",
      "00038: 39 8B 3B 34 38 5E 2E E2 DA 2D D4 0F CF 3E FC 0B A6 F7 06 F8 D4 F6 D7 BD EA EC A7 23  9.;48^...-...>.............#\n",
      "00054: 5B C9 56 F5 C9 F1 4F 44 6A 3C 05 39 FB 83 7D D8 6C 97 37 88 D6 A6 D2 26 80 6D D7 C8  [.V...ODj<.9..}.l.7....&.m..\n",
      "00070: 57 F8 84 24 7A A4 9B B0 A5 A2 C8 29 4F 47 5E 4F FC 30 18 89 D6 7E 57 3C EF 09 98 C7  W..$z......)OG^O.0...~W<....\n",
      "0008C: 2D E8 29 10 90 1E 6C B7 25 FB 11 63 2E DA E4 E4 3A 34 D2 00 BB 95 1E 4D E1 E6 57 29  -.)...l.%..c....:4.....M..W)\n",
      "000A8: 95 88 8E 2F 05 1A 20 EC 3C AC 87 E8 1A 4A FF 86 F0 F8 66 02 D2 8B 52 44 F1 CC 43 84  .../....<....J....f...RD..C.\n",
      "000C4: 58 05 91 21 67 4E 0C 74 61 A0 4D F1 D7 09 69 5C D0 47 8A 79 1C 78 A5 14 EF 75 EA 53  X..!gN.ta.M...i\\.G.y.x...u.S\n",
      "000E0: A5 A7 F3 C1 0D F7 58 5C 08 AD 87 FC 1D 2D D0 C1 F0 29 5B F3 46 21 57 18 B0 8C 07 1D  ......X\\.....-...)[.F!W.....\n",
      "000FC: 4B 07 73 4F B1 7C C3 A6 69 FC DF BA E8 85 EA A2 35 77 AC 4C 11 FB 4D 57 AF 9B 01 23  K.sO.|..i.......5w.L..MW...#\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%emit dc.rat | dnfields [| peek ]"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "There is only one, really large field - so at least we do not have to figure out which one to pick from among many options.\n",
    "To reproduce the decryption, simply open the sample in [dnSpyEx], copy out the code from the function `Decrypt` (token `06000001`),\n",
    "and convert it to a refinery unit:\n",
    "\n",
    "[dnSpyEx]: https://github.com/dnSpyEx/dnSpy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "#!binary-refinery\n",
    "from refinery import Unit\n",
    "from refinery import decompress\n",
    "\n",
    "import array as ar\n",
    "\n",
    "class decrypt(Unit):\n",
    "    def process(self, data):\n",
    "        array = [0] * 16\n",
    "        array2 = [0] * 16\n",
    "        num = 306067877\n",
    "        for i in range(16):\n",
    "            num = num * num % 339722377\n",
    "            array2[i] = num\n",
    "            array[i] = num * num % 1145919227\n",
    "        array[0] = array[0] + array2[0] + 3017868035\n",
    "        array[1] = (array[1] ^ array2[1]) + 3017868035\n",
    "        array[2] = array[2] + array2[2] + 3017868035\n",
    "        array[3] = array[3] * array2[3] * 2690889427\n",
    "        array[4] = (array[4] * array2[4]) ^ 2765468969\n",
    "        array[5] = (array[5] ^ array2[5]) * 2690889427\n",
    "        array[6] = array[6] ^ array2[6] ^ 2765468969\n",
    "        array[7] = (array[7] * array2[7]) ^ 2765468969\n",
    "        array[8] = (array[8] ^ array2[8]) + 3017868035\n",
    "        array[9] = (array[9] ^ array2[9]) + 3017868035\n",
    "        array[10] = (array[10] ^ array2[10]) + 3017868035\n",
    "        array[11] = (array[11] ^ array2[11]) + 3017868035\n",
    "        array[12] = (array[12] ^ array2[12]) + 3017868035\n",
    "        array[13] = (array[13] ^ array2[13]) + 3017868035\n",
    "        array[14] = (array[14] ^ array2[14]) + 3017868035\n",
    "        array[15] = (array[15] ^ array2[15]) + 3017868035\n",
    "        array2 = [0] * 16\n",
    "        array3 = ar.array('L', data)\n",
    "        for j, c in enumerate(array3):\n",
    "            num3 = c ^ array[j & 15]\n",
    "            array[j & 15] = (array[j & 15] ^ num3) + 1037772825\n",
    "            array3[j] = num3 & 0xFFFFFFFF\n",
    "        array4 = array3.tobytes() | decompress | bytearray\n",
    "        for k, b in enumerate(array4):\n",
    "            array4[k] = b ^ (num & 0xFF)\n",
    "            if k & 255 == 0:\n",
    "                num = num * num % 9067703\n",
    "        return array4"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "I wasn't sure what sort of decompression the .NET code uses, but luckily,\n",
    "refinery already has a generic [decompress] unit which can usually determine and use the correct decompression method.\n",
    "If you didn't know, you can use existing refinery units in Python code with syntax very similar to the command-line syntax:\n",
    "```python\n",
    "array4 = array3.tobytes() | decompress | bytearray\n",
    "```\n",
    "I do this because there is another decryption step following the decompression and I did not feel like splitting this part into several custom units.\n",
    "Armed with this script, we can already decrypt the second stage with relative ease:\n",
    "\n",
    "[decompress]: https://binref.github.io/#refinery.decompress"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "    crc32 = 861f07aa\n",
      "  entropy = 43.74%\n",
      "    magic = PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\n",
      "   sha256 = e62e3e03c6d5ce19267e343b2f22d4815ca1e6e6f714b1f36b1f3a4a45813a00\n",
      "     size = 00.876 MB\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00  MZ......................@...\n",
      "0001C: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ............................\n",
      "00038: 00 00 00 00 80 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70  ................!..L.!This.p\n",
      "00054: 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20  rogram.cannot.be.run.in.DOS.\n",
      "00070: 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 17 91 F2 A7  mode....$.......PE..L.......\n",
      "0008C: 00 00 00 00 00 00 00 00 E0 00 22 01 0B 01 50 00 00 52 0D 00 00 08 00 00 00 00 00 00  ..........\"...P..R..........\n",
      "000A8: 5E 70 0D 00 00 20 00 00 00 80 0D 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00  ^p............@.............\n",
      "000C4: 00 00 00 00 06 00 00 00 00 00 00 00 00 C0 0D 00 00 02 00 00 00 00 00 00 02 00 60 85  ..........................`.\n",
      "000E0: 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00  ............................\n",
      "000FC: 00 00 00 00 0C 70 0D 00 4F 00 00 00 00 80 0D 00 B0 05 00 00 00 00 00 00 00 00 00 00  .....p..O...................\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%emit dc.rat | dnfields | ./decrypt.py | dump -t koi.exe | peek -mm"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Unpacking Step 2\n",
    "\n",
    "Now the next step is to extract the final payload from `koi.exe`.\n",
    "First, we use [dnstr] to extract all .NET user strings from the sample.\n",
    "We then use [iff] to filter for only those strings that are longer than 200 characters.\n",
    "The following command also uses [pick] to restrict the output to only 8 lines:\n",
    "\n",
    "[dnstr]: https://binref.github.io/#refinery.dnstr\n",
    "[pick]: https://binref.github.io/#refinery.pick\n",
    "[iff]: https://binref.github.io/#refinery.iff\n",
    "[transpose]: https://binref.github.io/#refinery.transpose"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "08.616 kB: TAT1IAAAAAAAAAAAAAAQAAAAAAAUAAAACsD4D8DcGsHwH0AAAAAQBEFcGoGAAAAEAAA4BDAAtMA8ACAATEAoACAAoIAwAAAA4MA8AAAAQIAcA\n",
      "08.616 kB: VAMvgABAAACAAAAAQAFAAFAAQABAAIAAQLQOgPwXhbBcRAAAEAAAgRRXBaxAAKAAAABAQhAAAAFCAuAAQAHCAXwAAAIDAVAAQAOBAMwAQAMCA\n",
      "08.616 kB: qA0ZEAAAAA5ABAUAAA0AAAAYMAAAAAA4kC0D4D8GoGwH0AAAAAIAcEUFgGsAAAA+AAQBAAATEA4ABAA9IAcAAAAaAAUADAATIAsACAAkEAMAB\n",
      "08.616 kB: QAhGLgACAA0GAAAAAFAAFAAQAFAAAAAAJwNgOwPBaxcBdAAAAAAAIRVxYhbAFAAAAAAQDQAwANDApAAAAIBAHwAgAKCAmwAgACCAJQAAAGCAe\n",
      "08.616 kB: AAVUAAAAAAZAAArAAEAAAAAAAoAAAAMACwD4D8DgGsHwHAIMAAAACEFcGoGAAAD0AIBAAAxEAEACAAvEAIACAAgIAYABAAgAAkACAA+IA8AAA\n",
      "08.616 kB: AAGuQABFAAXuAAAAFAAFAARAFAALAAAAQMQOgPwYhbBcRAAAAAAEARRXBaxBAAQEAAQeAAgABBAWAAQAABAlQAAAEDAhgAAAFDAPgAAAEDApg\n",
      "08.616 kB: MAhDgBAAAAhcBQUAcAAAAAgAQAAAACAAkD0D4D8GoGwH0AAABAAAkEUFkGsAACAAAAAAUoEAYACAAhEAEACAAvEAIABAAfAAIACAAnIAAACAA\n",
      "08.616 kB: AApQAAABAA0nAADAAAFAAgAFAARAAgAAJANgOwPBaxcBdQAAgACAJhVxZhbAAgAOAAMAAwAMBAvAAwAFCAqwAgABCAfgAQAGCACgAgAGCAXQA\n"
     ]
    }
   ],
   "source": [
    "%emit koi.exe | dnstr -u [| iff size -ge 200 | pick :8 | peek -be ]"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We can already see the familiar `TVqQAA` pattern of a base64-encoded PE header when reading the output column-wise.\n",
    "The unit [transpose] can be used to perform the operation that we are looking for here, and subsequently we use [b64] to decode the result.\n",
    "\n",
    "[b64]: https://binref.github.io/#refinery.b64\n",
    "[pad]: https://binref.github.io/#refinery.pad\n",
    "[transpose]: https://binref.github.io/#refinery.transpose"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "------------------------------------------------------------------------------------------------------------------------\n",
      "    crc32 = a07f4088\n",
      "  entropy = 72.00%\n",
      "    magic = PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\n",
      "   sha256 = f6b193ae794a423a4cd5a4dcd284437823336658d1d0752b48c297a02d5fb46a\n",
      "     size = 00.323 MB\n",
      "------------------------------------------------------------------------------------------------------------------------\n",
      "00000: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00  MZ......................@...\n",
      "0001C: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ............................\n",
      "00038: 00 00 00 00 80 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70  ................!..L.!This.p\n",
      "00054: 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20  rogram.cannot.be.run.in.DOS.\n",
      "00070: 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 84 61 DD 62  mode....$.......PE..L....a.b\n",
      "0008C: 00 00 00 00 00 00 00 00 E0 00 22 01 0B 01 08 00 00 E6 04 00 00 06 00 00 00 00 00 00  ..........\".................\n",
      "000A8: FE 03 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00  ..............@.............\n",
      "000C4: 00 00 00 00 04 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 98 D9 05 00 02 00 40 85  .............`............@.\n",
      "000E0: 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00  ............................\n",
      "000FC: 00 00 00 00 B0 03 05 00 4B 00 00 00 00 20 05 00 1C 03 00 00 00 00 00 00 00 00 00 00  ........K...................\n",
      "------------------------------------------------------------------------------------------------------------------------\n"
     ]
    }
   ],
   "source": [
    "%emit koi.exe | dnstr -u [| iff size -ge 200 | transpose ]| b64 | dump -t payload.bin | peek -mm"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Config Extraction\n",
    "\n",
    "Now that we have the payload extracted, let's extract the config data:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "http[:]//battletw.beget[.]tech/@==wYpxmY1BHdzVWdxVmc\n",
      "http[:]//battletw.beget[.]tech/@==wYpxmY1BHdzVWdxVmc\n"
     ]
    }
   ],
   "source": [
    "%%emit payload.bin | carve -lt4 b64 [\n",
    "    | b64\n",
    "    | zl\n",
    "    | rev\n",
    "    | scope 1\n",
    "    | b64\n",
    "    | xtjson SCRT\n",
    "    | xtjson\n",
    "    | cfmt {path}{}\n",
    "    | transpose\n",
    "    | pop d s\n",
    "    | max size\n",
    "    | map eat:s eat:d\n",
    "    | b64\n",
    "    | xtjson H1 H2\n",
    "    | defang ]]"
   ]
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "4bb4b02bf57a2c25456a741474d02d2de926aec3c451f22b312ec34f66909bb4"
  },
  "kernelspec": {
   "display_name": "Python 3.9.7 64-bit (system)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.12.6"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}