Neprodoor flies beyond the radar

It's somewhat ironic to write this post right after we've talked in the last blog post about the real danger of current threats as compared with theorical proof of concepts like SMM rootkits.

Today I've spent some time reversing a malware that has been reported to our research lab by many users and that it was heuristically intercepted by Prevx Edge.

The infection is already known on the web as Trojan.Neprodoor, but looking on internet I haven't been able to find useful technical descriptions about this trojan, so I decided to have an in depth look at it.

After I've started the analysis, it has been immediately obvious that this infection is not trivial and it is able to evade from most of current security products.

The infection starts with a dropper, called reader_s.exe. However, this file is only the first of a long chain of installers.

This dropper is crypted with its own packer so, after startup, it unpacks itself and it's ready to start with its payload.

It'll create a copy of itself under %windir%\system32 and under user's profile folder, adding then the relative autostart keys under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry value and under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, both with value [reader_s] and path to the executable.

This can be defined as the pre-loader. After it finished the installation process, the dropper spawns a new svchost.exe process and injects there a dll. Then, it starts a new thread inside the svchost process.

The control is now passed to the real loader, which is who handle the real payload and can install all remaining components of the infection. It pings back to one of its control servers and it communicates with them using a private encrypted protocol. All the traffic is passed through TCP port 80 but it can't be checked by web filters because of the encryption.

The loader is able to steal informations from the PC, acts as proxy server, download and install other components of the infection.

Now starts the most interesting part. The loader can download another infection, which will result to be a rootkit installer. Moreover, we have monitored it downloaded a spambot component.

After the loader has downloaded in memory the other two components, it injects them inside other two svchost.exe processes. Everything is run in memory, nothing is really written on the disk.

While the spambot is a classic spambot component, what is more interesting is the rootkit installer. It infects ndis.sys driver by reading the original code, crypting it and embedding the code inside its own body. Then, the new ndis.sys overwrites the original old one and a copy of the new ndis.sys is placed into the dllcache system folder. Now, the ndis.sys driver is crypted and embedded inside the rootkit code.

By doing so, the rootkit doesn't need to add any Windows registry key to start the service and it can survive hidden in memory.

After the ndis service is reloaded, the rootkit code is able to allocate a chunk of kernel memory where it copies its malicious code, then the old ndis.sys is loaded.

The rootkit code, which is now just an untraceable piece of executable code inside Windows kernel memory, sets up a process notify routine, to intercept the loading of services.exe process.

If intercepted, the rootkit injects there the same loader I've talked before. The whole cycle can now start again, with the spambot that will be downloaded and injected inside a svchost.exe process.

Moreover to stay invisible on the disk, the rootkit will hook IofCallDriver kernel function, by changing the pointer address of the function and redirecting it to its own hooking function.

This is another way to filter disk reading, by intercepting driver calls. If any software tries to read ndis.sys driver, the original clean copy is shown and any attempt to modify the file is denied.

This malware is clearly not developed by a bored teenager, the whole concept behind the infection let us think it's the work of someone skilled, the mechanism is not trivial.

In fact, the rootkit component is able to stay invisible to most of current antirootkit technologies and the modular structure of the infection could allow the malware writer(s) to update the malicious code in an easy way.

We have heuristically found many clients infected by this malware. Prevx Edge and Prevx CSI are able to clean the infection.

When you investigate your PC looking for infections caused by possible SMM rootkits, in the meanwhile please check if a banal, trivial, kernel mode rootkit like that is subverting your operating system.