Malware Family: Poweliks
Hash Value
SHA256: 4727b7ea70d0fc00f96a28de7fa3d97fa
9d0b253bd63ae54fbbf0bd0c8b766bb
View the Full Poweliks Malware Analysis Report
One of the key features released in VMRay Analyzer v2.1 is the enhanced analysis of fileless malware (also referred to as “non-malware”). Fileless malware is defined by malware analysis expert Lenny Zeltser as “..malware that operates without placing malicious executables on the file system.” An important nuance here is there “may” be files associated with fileless malware and they “may” modify existing file structures on the target machine.
One common method used by malware authors is to implement registry changes. To demonstrate VMRay Analyzer’s detection of registry changes we will analyze a well-known Poweliks sample . Even though its command servers are no longer online, this sample of Poweliks offers a great opportunity to study the nature of fileless malware.
Poweliks Analysis
On execution, the installer creates two registry entries containing (1) the startup code and (2) the encoded second stage of the infection (see Figure 2).
Figure 1: The startup code stored in the Windows registry
One interesting fact of the startup stub is that the malware executes the JavaScript code by creatively utilizing the rundll32 interface as thoroughly described by Stormshield .
Figure 2: Overview of the monitored interaction with Registry from the Poweliks installer
Persistence
As seen in Figure 2, the startup stub is added to the autostart key HKCU\\software\\microsoft\\windows\\currentversion\\run\\, which is automatically executed on Windows startup. Remarkably, after rebooting, the complete execution does not involve the installer anymore, thereby making it truly fileless.
Figure 3: Process graph of the execution. After rebooting, Poweliks malware gets automatically executed from the Windows registry.
Execution of the Payload
Taking a deeper look at the process graph, we can see that the second stage of the execution uses Powershell to first create the dllhost.exe process then injects and executes the actual payload.
Figure 4: Excerpt of the logged behavior from the dllhost.exe process
Taking a look at the subsection “Injection Information”, we can easily obtain all relevant information regarding the injection. In addition to looking at the used system calls in the function log, we can also download the injected data. Analyzing this binary blob, we see that it consists of some data and a DLL file, which can be used for further analysis.
Figure 5: Hexdump of the injected data including a Windows DLL image
Conclusion
In this analysis we were able to the see execution of Poweliks malware and how persistence can be achieved in a fileless manner using the Windows registry. VMRay Analyzer supports DFIR Specialists and malware analysts by accelerating common analysis tasks, like unpacking and obtaining additional information for the analysis.
View the Full Poweliks Malware Analysis Report
