Observing a malware is one thing. Observing the very same malware in a rich context is another.<\/p>\n
The traditional approach to sandboxes focuses on scoring the sample’s badness, extracting IOCs, and not focusing that much on the in-depth analysis. It’s understandable, because in-depth analysis are not the ultimate goal. Still… being able to extract more information that may help with the manual analysis is always welcome. And it’s actually getting better – the competition is slowly changing the landscape and newer sandboxes support memory dumping, PE file rebuilding, show nice process \/ thread trees, various graphs, etc… and place more and more hooks in place. And then again, even if they intercept the most popular APIs, inline functions<\/a>, or even intercept virtual tables<\/a>, it may still not be enough.<\/p>\n I thought, what would happen if I intercepted not only the most popular APIs that are used by malware, but also these that are less-frequently looked at, and in particular, these that may help to understand a flow of events in a better context – enriching the data that sandbox presents and making the in-depth analysis easier.<\/p>\n What are these APIs?<\/p>\n Let me show you an example…<\/p>\n Imagine you intercept the function CreateToolhelp32Snapshot to take a note of the fact that the malware is enumerating processes. This may add to the ‘badness’ weight, but on its own is not a malicious feature per se. Lots of ‘clean’ processes enumerate processes.<\/p>\n What if we not only did that, but also intercepted Process32First and Process32Next?<\/p>\n This could be the result (output is simplified to demo the idea):<\/p>\n Analysing a log like this tells you straight away that the malware is enumerating processes, and when it finds explorer.exe, it injects a bunch of buffers into it (possibly mapping sections of the PE payload?), and then creates a remote thread. As a result, the explorer.exe process now is hosting malicious payload.<\/p>\n While the code injection into explorer.exe can be deducted from manual dynamic analysis, or may be even obviously apparent when we are evaluating the process tree and network connections from a report generated by a sandbox, there is a subtle difference. The context these 2 additional intercepted APIs provide allows to be quite certain that the malware is actually quite specifically looking for the explorer.exe, and not for the other process.<\/p>\n It also tells us HOW the process is found.<\/p>\n And mind you, this is actually not a trivial question if you are doing in-depth malware analysis.<\/p>\n There are cases where this determination is very important. Having an ability to quickly determine if we are missing some target process on the test system can save us a lot of time spent on mundane manual analysis. This is actually one of the first questions your customer will ask you, especially when it comes to targeted attacks. It is a very responsible job to deliver the results and not to miss stuff!<\/p>\n When you look at malware that is highly targeted, f.ex. malware that is targeting Point of Sale systems, running it through a sandbox may _not_ give you any good results, because you either won’t see the process enumeration at all, or may miss the name of the process that the malware is looking for. The malware will look ‘broken’ to us. I can’t count how many times I wasted time on manual analysis and even incorrectly concluded that the malware is ‘broken’ while looking at heavily obfuscated, or bloatwarish malware samples. Until I started looking at the context of the early exit.<\/p>\n It is really helpful to be able to cheat a bit.<\/p>\n For the case of the process enumeration one can not only intercept the Process32First and Process32Next functions, but also enhance the results with the interception of string comparison functions.<\/p>\n If we get lucky, the result could look like this:<\/p>\n That makes the in-depth malware analysis supereasy, doesn’t?<\/p>\n I think there is a potential market for supporting in-depth malware analysis with sandbox technology – make the interception configurable (offer a list of APIs to monitor, allow time to run to be selected manually, rebuild files, perhaps give live access to the analysis box, etc.).<\/p>\n Reversing ykS is the limit.<\/p>\n And while I do commercial in-depth analysis and I may be shooting myself in a foot here, I can’t stress enough how important ROI is for both you and the customer.<\/p>\n","protected":false},"excerpt":{"rendered":" Observing a malware is one thing. Observing the very same malware in a rich context is another. The traditional approach to sandboxes focuses on scoring the sample’s badness, extracting IOCs, and not focusing that much on the in-depth analysis. It’s … Continue reading CreateToolhelp32Snapshot\r\nProcess32First: [System Process]\r\nProcess32Next: System\r\nProcess32Next: smss.exe\r\nProcess32Next: csrss.exe\r\nProcess32Next: winlogon.exe\r\nProcess32Next: services.exe\r\nProcess32Next: lsass.exe\r\nProcess32Next: svchost.exe\r\nProcess32Next: svchost.exe\r\nProcess32Next: svchost.exe\r\nProcess32Next: svchost.exe\r\nProcess32Next: svchost.exe\r\nProcess32Next: spoolsv.exe\r\nProcess32Next: explorer.exe\r\nOpens Process: %WINDOWS%\\explorer.exe\r\nVirtualAllocEx: %WINDOWS%\\explorer.exe\r\nNtWriteVirtualMemory: %WINDOWS%\\explorer.exe\r\nVirtualAllocEx: %WINDOWS%\\explorer.exe\r\nNtWriteVirtualMemory: %WINDOWS%\\explorer.exe\r\nVirtualAllocEx: %WINDOWS%\\explorer.exe\r\nNtWriteVirtualMemory: %WINDOWS%\\explorer.exe\r\nVirtualAllocEx: %WINDOWS%\\explorer.exe\r\nNtWriteVirtualMemory: %WINDOWS%\\explorer.exe\r\nVirtualAllocEx: %WINDOWS%\\explorer.exe\r\nNtWriteVirtualMemory: %WINDOWS%\\explorer.exe\r\nCreateRemoteThread: %WINDOWS%\\explorer.exe\r\nNtResumeThread: %WINDOWS%\\explorer.exe<\/pre>\n
Process32First: [System Process]\r\nlstrcmpiA ([System Process], explorer.exe)\r\nProcess32Next: System\r\nlstrcmpiA (System, explorer.exe)\r\nProcess32Next: smss.exe\r\nlstrcmpiA (smss.exe, explorer.exe)\r\nProcess32Next: csrss.exe\r\nlstrcmpiA (csrss.exe, explorer.exe)\r\nProcess32Next: winlogon.exe\r\nlstrcmpiA (winlogon.exe, explorer.exe)\r\nProcess32Next: services.exe\r\nlstrcmpiA (services.exe, explorer.exe)\r\nProcess32Next: lsass.exe\r\nlstrcmpiA (lsass.exe, explorer.exe)\r\nProcess32Next: vmacthlp.exe\r\nlstrcmpiA (vmacthlp.exe, explorer.exe)\r\nProcess32Next: svchost.exe\r\nlstrcmpiA (svchost.exe, explorer.exe)\r\nProcess32Next: svchost.exe\r\nlstrcmpiA (svchost.exe, explorer.exe)\r\nProcess32Next: svchost.exe\r\nlstrcmpiA (svchost.exe, explorer.exe)\r\nProcess32Next: svchost.exe\r\nlstrcmpiA (svchost.exe, explorer.exe)\r\nProcess32Next: svchost.exe\r\nlstrcmpiA (svchost.exe, explorer.exe)\r\nProcess32Next: spoolsv.exe\r\nlstrcmpiA (spoolsv.exe, explorer.exe)\r\nProcess32Next: PERSFW.exe\r\nlstrcmpiA (PERSFW.exe, explorer.exe)\r\nProcess32Next: explorer.exe\r\nlstrcmpiA (explorer.exe, explorer.exe)<\/pre>\n