This blog was written byVaradharajan Krishnasamy, Karthickkumar, Sakshi Jaiswal<\/p>\n
Ransomware attacks are one of the most common cyber-attacks among organizations; due to an increase in Ransomware-as-a-service (RaaS)<\/strong> on the black market. RaaS provides readily available ransomware to cyber criminals and is an effective way for attackers to deploy a variety of ransomware in a short period of time.<\/p>\n Usually, RaaS<\/strong> model developers sell or rent their sophisticated ransomware framework on the black market. After purchasing the license from the ransomware developer, attackers spread the ransomware to other users, infect them, encrypt files, and demand a huge ransom payment in Bitcoin. \u00a0Also, there are discounts available on the black market for ransomware frameworks in which the ransom money paid is shared between developers and the buyer for every successful extortion of ransom from the victims. These frameworks reduce the time and effort of creating a new ransomware from scratch using latest and advanced programming languages.<\/p>\n REvil<\/strong> is one of the most famous ransomware-as-a-service (RaaS)<\/strong> providers. The group released the Sodinokibi ransomware<\/a> in 2019, and McAfee has since observed REvil using a DLL side loading technique to execute ransomware code. The actual ransomware is a dropper that contains two embedded PE files in the resource section.\u00a0 After successful execution, it drops two additional files named MsMpEng.exe and MpSvc.dll in the temp folder. The file MsMpEng.exe is a Microsoft digitally signed file having a timestamp of March 2014 (Figure 1).<\/p>\n The malware uses DLL side loading to execute the ransomware code. This technique allows the attacker to execute malicious DLLs that spoof legitimate ones. This technique has been used in many APTs to avoid detection. In this attack, MsMpEng.exe loads the functions of MpSvc.dll during the time of execution. However, the attacker has replaced the clean MpSvc.dll with the ransomware binary of the same name. The malicious DLL file has an export function named ServiceCrtMain<\/strong>, which is further called and executed by the Microsoft Defender file. This is a clever technique used by the attacker to execute malicious file using the Microsoft digitally signed binary.<\/p>\n The ransomware uses the RC4 algorithm to decrypt the config file which has all the information that supports the encryption process.<\/p>\n Then it performs a UI language check using GetSystemDefaultUILanguage\/GetUserDefaultUILanguage<\/strong> functions and compares it with a hardcoded list which contains the language ID of several countries as shown in below image.<\/p>\n Countries excluded from this ransomware attack are mentioned below:<\/p>\nDLL SIDE LOADING<\/u><\/em><\/h2>\n
PAYLOAD ANALYSIS<\/u><\/em><\/h2>\n