44Con Malware Workshop

Malware Analysis Reverse Engineering Workshop
(44Con 2013)
SIAVOSH ZARRASVAND & INAKI RODRIGUEZ (44CON)

Grab a copy of the files
• Thumb drives being passed around
– Disclaimer about new malware of your own 
SIAVOSH ZARRASVAND & INAKI RODRIGUEZ (44CON) 2
• Wifi
– SSID hbn
– PSK ILoveTheSmellOfHackInTheMorning
– www http://192.168.252.5/

Agenda
1. Basic Concepts
2. Behaviors Analysis
3. Memory Analysis
4. Static Analysis

What is Malware
• Any piece of software that performs
malicious activities.
– Executable
– Documents
– Flash
– Java
– …

Types of Malware
• Some examples of categories
Worm Trojan
Spyware Adware
Ransomware Rootkit
Keyloggers Stealers
Virus Backdoor

Windows Executable
• An executable under the hood
• Structure:
• Imported Functions
• Exported Functions
• Sections
• Code
• Data
• Relocation information
• Certificate
• PE File

Binary Content

Interpreted Content

The BIG picture

PE Explorer
• Examining the content of a Windows
executable (exe, cpl, ocx, dll, …)
• Editor, disassembler, resource editor.
Imports Dependencies
Sections Resource
Data
Directories
General
Info
Editor

LAB – 1
• Use PE Explorer over installer.exe and
pafish.exe
• Questions
– Could you enumerate some notable
differences?
– Could you find something interesting in
installer.exe?

LAB – 1

From File to Process
• From File to Process
Loader
Read Header
Place
Executable in
Memory
Create Process
Object

Monitoring Behavior
Process
DLL
Fun1
Fun2
Fun 3
DLL DLL
Fun1
Fun2
Fun 3
Fun1
Fun2
Fun 3
• Interaction with the
Operating System
• File Activity
• Network flows
• Registry monitor
• Api Calls

Behavior Analysis
• Execution in a controlled environment.
• Not as time consuming as static analysis.
• Focused on results.
• VM and Snapshots.
• MSDN – Api calls

What are we looking for
• New processes
• Code injection
• Downloads
• File activity
• Persistence mechanism
• Registry changes
• C&C Communication
• Network activity (LAN)

Process Monitor
• Included in the Sysinternals Suite with
many other interesting tools.
Filter Search
Event
Filter by Event

Process Monitor

Lab – 2 (File Activities)
• Open Process Explorer
• Execute installer.exe
• Filter the results
• Questions
– Which file was created?
– Where?
– Why has the installer.exe vanished?

LAB – 2 (Answers)

Lab – 3 (Process Activities)
• Use the previous capture
• Questions
– How many processes were spawned?
– Could you identify who deleted the original
installer.exe file?

Lab – 3 (Answers)

Regshot
• Takes Registry Snapshots
• Compare Snapshots

Regshot Report

Lab – 4 (Registry)
• Restore the Snapshot
• Execute Regshot and take a first
snapshot.
• Execute Process Explorer.
• Execute installer.exe.
• Sleep 1m 
• Take a second snapshot and compare.

Lab – 4 (Registry)
• Questions
– Could you identify the persistence mechanism
using RegShot?
– And with Process Monitor?
– Could you find any new service added by the
malware?

Lab – 4 (Answer)

Network Activity
• Wireshark is a well known network sniffer.
• Many protocol decoders
• Drawback: Secure connections 
Restart
Stop
Start
Capture Options

Lab – 5
• Network Activity – Wireshark
• Questions
– Did the malware contact with a C&C?
– Was it successful?
– What was the IP/domain name?
– Could you find information about the C&C?
• DNS redirection (*)

Lab – 5 (Answers)

Sysanalyzer
• Logs some interesting APIs
• Sniffer
• Less noisy
• Less information

Lab – 7
• Run installer.exe and compare the results
from previous tools.

API Monitor
• Logs a set of Windows APIs from a large
set of them
• Low-level information
• Don’t try to log all 

API Monitor
Start new process
Filters

WinApiOverride32

Lab – 8
• Log the network and file activity
• Monitor newly created processes on
demand.
• Questions
– Could you find the C&C?
– Could you find when the file is deleted?

LAB – 8 (Answers)

LAB – 8 (Answers)
• Were you able to find the C&C?
• Why?

Sandbox
• Why not automation?
• Cuckoo Sandbox executes the malware
inside a VM for us.
• Analyzer and reporting system all in one
solution.
• Extensible
• Must be installed on Linux

Submit Samples
• Web interface
• Command Line

Cuckoo Architecture
Host Virtual Machine
Agent.py
Analyzer.py
Cuckoomon.dll
malware
Cuckoo.py
Processors
Signatures
Reports

Lab – 9
• Upload a sample to the Sandbox
• Meanwhile, check the report for sample
a6ff0e175acc7aaa3c2a855e44b11e3b.
• Question
– Could you identify the same indicators of
compromise from extracted from previous
tools?
– Could you find the C&C?
– And the function call?

Lab – 9 (Answers)

Post Mortem Analysis
• Volatility can extract information from a
memory dump.
• Hidden process, handles, connections, …
• Malfind
• Dump memory from Cuckoo, Winpmem,

Dumping Memory

Dumping Memory
Cuckoo
VirtualBox

Volatility
• Offline Memory analysis tool
• Search for
– Open handles
– Hooked Apis
– New Dlls
– Hidden processes
– Registry values
• No diff tool  (Anyone?)

LAB – 10
• Dump memory from a clean system
• List process list
• Find explorer.exe and list its dlls
• Store this information in a file and repeat
all the process with the malware running

LAB – 10
• Question
– Could you find anything suspicious?

LAB – 10 (Answers)

CONTACT ME
• Iñaki Rodriguez
–@virtualminds_es
– irodriguez@virtualminds.es

44Con Malware Workshop

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (7)

Similar a 44Con Malware Workshop

Similar a 44Con Malware Workshop (20)

Más de Iñaki Rodríguez

Más de Iñaki Rodríguez (7)

Último

Último (20)

44Con Malware Workshop