Analysing Obfuscated VBA - Extracting indicators from a Trickbot downloader

A rather lengthy video to showcase my analysis techniques and thought processes when analysing malicious macros. In this case I review a Trickbot downloader which hides an interesting nuance if certain folders are present on the machine.
Hopefully of use to those learning how to reverse engineering high-level code.
Sample discussed:
www.virustotal...

[@rakijah]

'Str()' inserts a leading whitespace for the sign of the number. In case of positive numbers, the "+" is implied (lol), so it only leaves the whitespace.

[@cybercdh]

that's interesting - thanks for the clarity.

[@albert5326]

This channel is the only notification I immediately watch

[@cybercdh]

Albert Stoker that’s awesome, thanks!

[@HackeXPlorer]

I remember I had to analyse this malware long time back, IOC's where found from dynamic analysis. but the way this was decoded was really interesting. and the use of cyber chef is just perfect. As a KZbinr, I admire your efforts and hard work behind this video. Great JOB!!!

[@cybercdh]

thanks for the comment :)

[@B0wser998]

I love watching these analysis, it's like solving one big puzzle..

[@cybercdh]

awesome - glad you enjoyed.

[@IOwnThisHandle]

YES! Quite possibly my favourite content creator.

[@cybercdh]

Bob awesome! Thanks for the support.

[@IOwnThisHandle]

While I do not want to downplay the amount of time and effort required for a video, have you ever considered a more frequent schedule? After the video finishes, I just wish there was more.

[@cybercdh]

Bob :-) id like to do more but things have been pretty hectic lately. When I get a spare hour and an interesting sample I’ve been looking then I’ll throw something together, but sometimes it’s knowing what is of interest to others...

[@tiberiusvetus9113]

Excellent analysis. Whoever wrote this would probably be disappointed by how easily you took it apart.

[@cybercdh]

ha, hopefully! thanks for the comment.

[@anthonydidonato387]

Thanks and welcome back! Been a while since you posted a video. My team and I always enjoy the detailed overview of your analysis.

[@cybercdh]

awesome! that's great to hear and thanks for getting in touch.

[@RomanKisil]

At 9:57 you've deleted another call method with the noise. Probably won't stop you from successfully analysing the code, just wanted to mention. Great content Colin!

[@cybercdh]

someone else also noticed this - i was hoping no one would spot it haha. i'd previously analysed the function and its another function that's pointless and only serves to deliver more noise. thanks for spotting though :)

[@nornahh]

Hi Colin, been watching for videos since the start and this one has been my favourite by far. Please keep up the great work as this content is really entertaining! :)

[@cybercdh]

Thats awesome, thanks for the comment :)

[@MrLimetto]

Interesting to see your thought process. I would like to see similar videos in the future

[@cybercdh]

thanks! :)

[@argha2091]

Hi colin, its been a while not seen you posting content but your back with a bang !! Good to see your reverse Eng. To flip the code.

[@cybercdh]

thanks - appreciate the comment.

[@adolin1338]

Love watching your thought process dude, thanks a ton for uploading these

[@YalleMro18]

Siempre vale la pena esperar, por tu videos, amigo Colin Hardy

[@cybercdh]

thank you :)

[@produKtNZ]

Really good to see you back :)

[@cybercdh]

thanks!

[@produKtNZ]

Mind if I ask 'the' question? Might be obvious what it is :)

[@elviraeloramilosic9813]

This was amazing! Welcome back. Finally.

[@cybercdh]

thanks! glad you enjoyed.

[@marek-ke4xb]

Why you don't use replace all words in sublime for better analysis? Like rename noisy variables names which you know what they are used for

[@cybercdh]

marek 5816 Yep, definitely a good technique also.

[@trungucpham6074]

I hope you will open a course on Malware Analysis one day.

[@cybercdh]

hopefully I wont have to and you can get it all from this channel :)

[@ROBERT-ml7ml]

Excellent analysis as always Collin! Have you seen and studied the new "Camubot"? That should be your next video! Cheers!

[@cybercdh]

thanks, ive not seen that malware so will check it out. thanks for the tip

[@pupper_doggo]

These are really interesting to watch

[@cybercdh]

thanks!

[@marcelogrsp]

how does the VBA compile the obfuscated code?

[@TheYouTubeCuber888]

Why did you delete the call to veLaIBETOCxcuZjAXRYGr at 9:55? How did you know that call did nothing relevant?

[@cybercdh]

TheKZbinCuber :-) nice catch. I think I mistakenly deleted that call but new it was benign from my initial analysis prior to the video. Guess I was hoping no one would notice haha.

[@HeikkiHeiskanen]

Fantastic! Really interesting stuff.

[@cybercdh]

thanks! glad you enjoyed.

[@Stdvwr]

so basically delete all the noise and leave only meaningful lines that are indistinguishable from noise, right?

[@cybercdh]

pretty much :)

[@JanivzZ]

please make more !! thank you !

[@cybercdh]

JanivzZ thanks, will keep trying :-)

[@x10creeper52]

9:56 did you delete a potentially important call here?

[@cybercdh]

:-) not the first to notice. i was hoping no one would notice as i only realised a little later, lol, however it was not important as it was a call to a 'junk' function. feel free to verify :)

[@AlexKiraly]

Quality content right here

[@cybercdh]

thanks :) appreciate the comment.

[@악분]

Good video! Very thank you.

[@cybercdh]

thanks :)

[@orionweblab]

Say “hey.” If your channel is awesome

[@cybercdh]

hey.

[@user-cy7hk3jx3o]

If I used windows or linux on vm to analyze kind of this app . Could the viruses transfer to my real device?

[@cybercdh]

in this case, the macros are designed to download a secondary payload from the C2, so no. However, there likely exists malware that can escape a VM therefore caution should be used when analysing anything unknown.

[@ossamahjaji7985]

it can happen if you have shared folders with your VM

[@dwarez]

Hey Colin, long time no see : ]

[@cybercdh]

DWarez hey :-)

[@ajwas8565]

How does vba run the code when it is so obfuscated? Is there a function that is ran first that decodes it? And if that is the case, wouldn't a virus scanner detect it once it was decoded?

[@cybercdh]

The VBA has all it needs to run and inject the malicious code into a process, nothing additional is needed despite it being so obfuscated. It's obfuscated to us as a human-reader, but your CPU just sees the same 1's and 0's.

[@ajwas8565]

@@cybercdh I guess I'm still a little confused even after watching the video a few times. Is the original code in base10 then xor'd with that for loop?

[@gahlotmindset]

hey, very informative video. Would love if you do a live stream :)

[@cybercdh]

thanks for the comment - i may do one in future..

[@mrnano1991]

guys one question .. Does these peopel who wrote this malware used these strange variable names or after they finished coding they just encoded the entire code? I mean did they wrote the code like that? or they wrote it as normal software then they mess it up with some encoding stuff?

[@NeXtdra42]

nobody can write code like that, it's simply obfuscated afterwards

[@cybercdh]

yeh i agree, its probably another piece of code that does the obfuscation. there's lots out there.

[@m0rtale195]

33:22 Prolly because those AVs monitor command execution or run time scan lel.

[@cybercdh]

yeh, most likely. thanks for the comment.

[@akshayverma6836]

Awesome stuff :)

[@cybercdh]

thanks :)

[@sent4dc]

I would bet Sergey (the author of that malware) wrote a PY script that turns a perfectly readable VBA script into that gibberish.

[@kcinplatinumgaming2598]

We thought you got hacked it been so long ...thought you ended up in Tron :D

[@cybercdh]

ha!

[@sent4dc]

Visual Basic is such a shit language. It starts array indexes at 1. So if someone asks you, what programming language should they start learning first, and if you really hate that person, suggest VB. PS. But honestly, please don't do it. Have a mercy!