When the malicious code gets executed, as shown in Figure 1, it sends an HTTP request to the domain "wowrizep.ru" requesting the file "newbos2.exe."
After this, per the code in Figure 2, a call to SleepEx() with 0x0927C0 as its timeout parameter and the alterable value set to false are made. The value 0x0927C0 resolves to 600,000 milliseconds or, in other words, resolved to a 10-minute timeout. By setting the alterable to false, the malware ensures that the function does not return until the timeout period has elapsed. Since automated analysis systems are configured to execute a sample within a specified time frame, by executing a sleep call with a long timeout, Nap can prevent an automated analysis system from capturing its malicious behavior. Besides making a call to the function SleepEx(), the code also makes a call to the undocumented API NtDelayExecution() for performing sleep.
When the code of Trojan Nap is executed in a controlled environment, the behavior is pretty much the same as when it was observed executing the code in a debugger. As shown in Figure 3, the DNS request is sent to the domains wowrizep.ru and cagremub.ru.
After receiving the DNS reply, a GET request is sent to the domain to fetch the newbos2.exe file as shown in Figure 4.
The two domains, "wowrizep.ru" and "cagremub.ru," appear to be a part of the fast flux network. Normally, fast flux networks are used when the attacker wants to be extra careful to hide their identity. In contrast to a typical fast flux setup where multiple IPs are returned in a DNS response, this one returns a single IP, which looks like another attempt to appear normal. As shown in Figure 5, when the domain is resolved multiple times (10 seconds apart), each time the domain's resolution resulted in a different IP. The IPs are most probably zombies acting as front-end flux agents giving cover to the actual bot herder.
Table 1 shows some of the IPs for the domain wowrizeep.ru. These IPs are spread across the globe. Almost each IP is in a different country.
As shown in Figure 6, a very low value of TTL (0) ensures that neither the intermediate DNS servers nor the end host caches the DNS/IP mapping. This way each time when the domain is contacted by malware, it will be a new DNS lookup and the attacker can keep on providing new IPs.
When the file newbos2.exe is downloaded from the domain wowrizep.ru and is executed, it adds itself in the registry key.
The change to the registry key \CurrentVersion\Run ensures that the code gets executed each time when the computer is booted. It also makes use of the function RegOpenKeyExW() to check for the presence of the registry key SOFTWARE\Far\Plugins\FTP\Hosts.
After the first execution the downloaded code resets the permission to hide itself and opens high TCP ports for listening. Some of the ports that we have observed are 49163, 49172, and 49175. It then communicates to the external domains. Some of the domains to which the communication goes are shown in Table 2.
To summarize, Nap is a malicious downloader. It uses the fast flux technique to hide the location/identity of the attacker. Coincidently, from the NYT report, the malware used in the recent NYT breach also used a similar hiding technique where the attacker used the university computers as front-end agents and kept switching from one IP to another. Nap employs extended sleep calls, an anti-VM technique to avoid automated analysis systems capturing its behavior.
Using a long sleep is a classic technique used to stay under the radar of an automated analysis system. In addition to extended sleep calls to evade automated analysis, we have observed many techniques, like hooking to a mouse, that are actively being employed by the advanced active malwares.
Authors: FireEye security researchers Abhishek Singh and Ali Islam.