Mastering Malware Analysis Techniques

1. Part 1: Basic Analysis Chapter 1: Basic Static Techniques Chapter 2: Malware Analysis in Virtual Machines Chapter 3: Basic Dynamic Analysis

2. Chapter 1: Basic Static Techniques

3. Static analysis Examine payload without executing it to determine function and maliciousness • Done via scanning content

4. File signatures Common code or data used across malware instances • e.g. embedded URL strings, decryptor code Examples • Strings search on metadata, errors, constants • Regular expression searches • Hashing (e.g. MD5, SHA)

5. Signatures generated via analysis Artifacts revealed by binary • Tools for dumping linked libraries • Dependency Walker, PEView, PEBrowse, PE Explorer, ldd • Look for common shared libraries (e.g. kernel32.dll, User32.dll, libc.so, etc) • Disassemblers

6. But… Astronomical growth in signatures Coverage by a single tool is difficult Cloud-based anti-virus • http://www.virustotal.com • Bought by Google • But, public service that allows attacker to know when their malware has been uploaded and identified! • Can use private malware sandbox analysis (VMRay)

7. Malware counter-measures Obfuscation • Code execution is hidden by author to make static analysis difficult Packing • Code compressed and encrypted to completely thwart static analysis (Figure 1-4) • Code to unpack binaries is common, however • Some can be identified (PEiD) Polymorphism and metamorphism • Code transformed into equivalent, but different form to thwart static signatures • Example: Mimikatz (Metasploit module to do weaponized credential theft on Windows) • From 54/54 (100% detection) to 4/54 when replacing ‘mimikatz’ with ‘kitikatz’ and recompiling AV with signatures is now completely dead

8. Chapter 2: Malware Analysis on VMsChapter 3: Basic Dynamic Analysis

9. Malware and VMs Most malware must be executed in order to analyze them • Requires a safe environment VirtualBox, VMware • Host-only networking to monitor network traffic • Snapshots and roll-back • Record and replay execution

10. Sandboxes Simpler alternative to VMs Behavior isolation and coarse-grained tracking of malware execution • File system activity • Registry activity • Network activity • Examples: GFI Sandbox, Norman SandBox Always use a sandbox or VM to analyze malware

11. Don’t be like…

13. But, can be subtle • FireEye anti-virus (12/2015) • Static analysis of Java byte-code via a Java decompiler (JODE) so did not run in a VM • But, did not realize decompiler executed byte code as well • Instant remote code execution • AV now *worse* than no AV

14. Monitoring execution Procmon (Sysmon) • www.sysinternals.com • Combines process, file, and registry monitoring to track execution behavior • Spits out XML on events, allows one to reconstruct process tree Prochacker (http://processhacker.sourceforge.net/) • Process (memory) monitoring Process explorer • Verify running process against the disk executable image • Determine if malicious documents are launching new processes Regshot • Flag changes in registry

15. Monitoring execution ApateDNS • Capture DNS requests and modify replies • More comprehensive follow-on tool.. • Flare-NG • https://github.com/fireeye/flare-fakenet-ng/releases Netcat • Proxying and emulating connections Wireshark • Packet capturing tool INetSim • Simulate common Internet services

16. Tools in action See p. 57 in text (msts.exe) • Setup tools (process/network/registry monitoring, setup VMs, server emulation) – Fig. 3-12 • Contacts web site (the textbook's) – ApateDNS • Creates new file (winhlp2.exe) – procmon • Modifies registry to autorun – regshot • Creates a mutex to ensure only a single execution – Process Explorer • Contacts a server over port 443 (https), but does not speak SSL – INetSim • Speaks a custom protocol – Wireshark

17. In-class exercises • Lab 1-1, Lab 1-2 • Lab 3-2, Lab 3-4