Extracting ShellCode from a PowerShell loader
With my previous professional work, I’ve encountered a file-less malware or a Living Off The Land Binaries And Scripts(LOLBAS), which essentially is an obfuscated PowerShell script that executed a Cobalt Strike beacon backdoor and uses process injection into other system processes and avoid detection.
Fingerprinting the malware:
SHA256 hash: 4514a7216a986357566c150fcf0fe15b49e634ab4d31d3cde285e56d0d7314f7
Looking up the hash in VirusTotal, only (3) three vendors flagged it as malicious, at the time of writing. It’s categorized as a Trojan.
Screenshot of the sample is shown below, it’s observed that the chunk of characters are obfuscated by the malware author.
Looking at this we can deduce that it is encoded using Base64.
Get fwr00t’s stories in your inbox
Join Medium for free to get updates from this writer.
One tool that I love to use with this kind of scenario is CyberChef. Using the obfuscated string as the input in CyberChef and then using the recipe named “From Base64” will then show a familiar text, but it shows dot “.” between each characters, these are null bytes. This indicates that the output shown is in Unicode text format as opposed to ASCII.
We can easily clean this output using the recipe “Remove null bytes”, this reveals a PowerShell script which will only run in memory(RAM). We can then see another Base64 encoded string within the script, which is also compressed with gzip.
We can extract the compressed Base64 encoded string, using regular expressions(RegEx), then decode it again with recipe “From Base64” and recipe “Gunzip”.
This will reveal a plain-text powershell script as seen below. We can notice this script includes another Base64 encoded string, which is then encrypted using single byte XOR.
Now we proceed with the extraction of the shellcode, using the recipe for “Regular Expression”, “From Base64" and then “XOR”.
With the used of proper recipe, will reveal the shellcode:
The output can be downloaded into a .dat file, and we can proceed to analyze it using a shellcode debugger like scdbg.exe.
Finally, we can be certain that this piece of malware is using VirtualAlloc, named pipe, and ReadFile Windows API to perform its malicious function.
VirtualAlloc API is used to allocate memory space for the calling process.
NamePipes APIs are used for inter-process communication.
ReadFile API reads data from the specified file or input/output (I/O) device.
Please note that this is a real-life malicious sample, proper malware handling should always be practiced.
