A Technical Look at WardenStealer

This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of WardenStealer malware. WardenStealer is highly evasive and uses multiple types of obfuscation, encoding, and indirect calls to prevent analysis, monitor the system and exfiltrate data. In addition, Java library use means the binary is loaded as a DLL instead of a normal PE file when run.

Technical Overview

Initial static analysis shows that the file is not packed or encrypted, and has no overlays. The anomalies lie in the export table and a blob of data within the .rdata section.

The exports show several suspicious calls to blank entries with no function name; the remainder are Java functions. Further analysis shows the blank entries duplicate Java functions called by their ordinal code. A large block of strings in the .rdata section also appears to be encoded.

When executed in a debugger, rundll32 loads the binary. The control flow is found to be handled through the TLS callback instead of the main entrypoint. Each iteration of operations ends with a return to the callback, which will then either create or move to a new thread depending on what is being monitored via API hooks. Testing shows between 4-5 threads are created and maintained during runtime. These threads coordinate handling arguments, checking the heap and stack for monitored flags, and handling memory for allocation/injection.

The large majority of operations on the victim system are done using indirect calls on the heap or through memory registers as opposed to direct library imports as one of several anti-analysis methods. These include the following anti-analysis tools:

• Sleep loops
• IsDebuggerPresent
• IsProcessFeaturePresent
• GetProcessHeap

WardenStealer traverses the PEB to load instructions, import additional libraries dynamically, and prevent noticeable errors to the user by disabling error boxes.

Rundll32 will spawn multiple instances of itself to perform tasks using the Java exports. Once instructions have been decoded in memory through multiple rounds of XOR/SHL/SHR into shellcode, Google Chrome is launched (if installed) and rundll32 will use process injection to set hooks for monitoring and control. The C2 address of ‘svinger(dot)club’ is connected to via rundll32, not the browser. PCAP data shows encrypted comms being sent to, and accepted by, the website.

Further enumeration on the system is done by querying uninstall registry keys. This also doubles as a method of checking for virtual environments when matching installed programs or OS-specific versions.

During testing, the targeted items included Firefox, Chrome, and MS Edge credential stores. This is in all likelihood not an exhaustive list of targets, as the capabilities of the sample suggest the system could be monitored or enumerated for any number of applications.

Sonicwall Protection

SonicWall Capture Labs protects against this threat via the following signature:

• GAV: WardenStealer.JLI (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™, SonicWall Endpoint Security, and the Capture Client endpoint solution.

IOC

f61de4d38d3422349be477f71adf431bc7318794abaa0587fa687e44ba863c37