This blog was written byVaradharajan Krishnasamy, Karthickkumar, Sakshi Jaiswal
Introduction
Ransomware attacks are one of the most common cyber-attacks among organizations; due to an increase in Ransomware-as-a-service (RaaS) on the black market. RaaS provides readily available ransomware to cyber criminals and is an effective way for attackers to deploy a variety of ransomware in a short period of time.
Usually, RaaS model developers sell or rent their sophisticated ransomware framework on the black market. After purchasing the license from the ransomware developer, attackers spread the ransomware to other users, infect them, encrypt files, and demand a huge ransom payment in Bitcoin. Also, there are discounts available on the black market for ransomware frameworks in which the ransom money paid is shared between developers and the buyer for every successful extortion of ransom from the victims. These frameworks reduce the time and effort of creating a new ransomware from scratch using latest and advanced programming languages.
REvil is one of the most famous ransomware-as-a-service (RaaS) providers. The group released the Sodinokibi ransomware in 2019, and McAfee has since observed REvil using a DLL side loading technique to execute ransomware code. The actual ransomware is a dropper that contains two embedded PE files in the resource section. After successful execution, it drops two additional files named MsMpEng.exe and MpSvc.dll in the temp folder. The file MsMpEng.exe is a Microsoft digitally signed file having a timestamp of March 2014 (Figure 1).
Figure-1: Image of Microsoft Digitally signed File
DLL SIDE LOADING
The malware uses DLL side loading to execute the ransomware code. This technique allows the attacker to execute malicious DLLs that spoof legitimate ones. This technique has been used in many APTs to avoid detection. In this attack, MsMpEng.exe loads the functions of MpSvc.dll during the time of execution. However, the attacker has replaced the clean MpSvc.dll with the ransomware binary of the same name. The malicious DLL file has an export function named ServiceCrtMain, which is further called and executed by the Microsoft Defender file. This is a clever technique used by the attacker to execute malicious file using the Microsoft digitally signed binary.
Figure-2: Calling Export function
PAYLOAD ANALYSIS
The ransomware uses the RC4 algorithm to decrypt the config file which has all the information that supports the encryption process.
Figure-3: REvil Config File
Then it performs a UI language check using GetSystemDefaultUILanguage/GetUserDefaultUILanguage functions and compares it with a hardcoded list which contains the language ID of several countries as shown in below image.
Figure-4: Language Check
Countries excluded from this ransomware attack are mentioned below:
| GetUserDefaultUILanguage | Country name |
| 0x419 | Russian |
| 0x422 | Ukranian |
| 0x423 | Belarusian |
| 0x428 | Tajik (Cyrilic from Tajikistan) |
| 0x42B | Armenian |
| 0x42C | Azerbaijani (Latin from Azerbaijan) |
| 0x437 | Georgian |
| 0x43F | Kazakh from Kazakhastan |
| 0x440 | Kyrgyzstan |
| 0x442 | Turkmenistan |
| 0x443 | Latin from Uzbekistan |
| 0x444 | Tatar from Russia Federation |
| 0x818 | Romanian from Moldova |
| 0x819 | Russian from Moldova |
| 0x82C | Cyrilic from Azerbaijan |
| 0x843 | Cyrilic from Uzbekistan |
| 0x45A | Syriac |
| 0x281A | Cyrilic from Serbia |
Additionally, the ransomware checks the users keyboardlayout and it skips the ransomware infection in the machine’s which are present in the country list above.
Figure-5: Keyboardlayout check
Ransomware creates a Global mutex in the infected machine to mark its presence.
Figure-6: Global Mutex
After creating the mutex, the ransomware deletes the files in the recycle bin using the SHEmptyRecycleBinW function to make sure that no files are restored post encryption.
Figure-7: Empty Recycle Bin
Then it enumerates all the active services with the help of the EnumServicesStatusExW function and deletes services if the service name matches the list present in the config file. The image below shows the list of services checked by the ransomware.
Figure-8: Service List check
It calls the CreateToolhelp32Snapshot, Process32FirstW and Process32NextW functions to enumerate running processes and terminates those matching the list present in the config file. The following processes will be terminated.
- allegro
- steam
- xtop
- ocssd
- xfssvccon
- onenote
- isqlplussvc
- msaccess
- powerpnt
- cad
- sqbcoreservic
- thunderbird
- oracle
- infopath
- dbeng50
- pro_comm_msg
- agntsvc
- thebat
- firefox
- ocautoupds
- winword
- synctime
- tbirdconfig
- mspub
- visio
- sql
- ocomm
- orcad
- mydesktopserv
- dbsnmp
- outlook
- cadence
- excel
- wordpad
- creoagent
- encsvc
- mydesktopqos
Then, it encrypts files using the Salsa20 algorithm and uses multithreading for fast encryption of the files. Later, background wallpaper will be set with a ransom message.
Figure-9: Desktop Wallpaper
Finally, the ransomware displays ransom notes in the victim’s machine. Below is an image of readme.txt which is dropped in the infected machine.
Figure-10: Ransom Note
IOCs and Coverage
| Type | Value | Detection Name | Detection Package Version (V3) |
| Loader | 5a97a50e45e64db41049fd88a75f2dd2 | REvil.f | 4493 |
| Dropped DLL | 78066a1c4e075941272a86d4a8e49471 | REvil.e | 4493 |
Expert rules allow McAfee customers to extend their coverage. This rule covers this REvil ransomware behaviour.
MITRE
| Technique ID | Tactic | Technique Details |
| T1059.003 | Execution | Command and Scripting Interpreter |
| T1574.002 | DLL Side-Loading | Hijack Execution Flow |
| T1486 | Impact | Data Encrypted for Impact |
| T1036.005 | Defense Evasion | Masquerading |
| T1057 | Discovery | Process Discovery |
| T1082 | Discovery | System Information Discovery |
Conclusion
McAfee observed that the REvil group has utilized oracle web logic vulnerability (CVE-2019-2725) to spread the ransomware last year and used kaseya’s VSA application recently for their ransomware execution, with the help of DLL sideloading. REvil uses many vulnerability applications for ransomware infections, however the encryption technique remains the same. McAfee recommends making periodic backups of files and keeping them isolated off the network and having an always updated antivirus in place.