Chapter 3. Performing a Séance Session

Apprehending malware red-handed is a very exhilarating feeling for an analyst. Debugging technology provides a wealth of information about a malware's inner construction and layout, and, most importantly, its modus operandi. You can take the metaphor of an ultra-high-speed camera used to capture a slow motion video of a moving bullet that plots its trajectory as a projectile, which hits its intended target and the effects thereof, and compare that with a debugger used to capture the execution trace of a malware instruction by instruction. Things are seldom that simply extrapolated, and hence you could also compare an analysis session as a criminal interrogation (analyst/debugger/target sample) in a Spook black-site (sandbox) where you have the liberty to extract information in any manner you want, while dealing with the myriad obfuscations, retaliations, and unwillingness of the participant.

The primary methodologies in malware analysis are static and...

Fortifying your debrief

Before we start with the analysis, let's explore our reporting tool Scrivener from Literature and Latte. This is quite a deep tool and you are recommended to visit their website at http://www.literatureandlatte.com/scrivener.php.

This amazing software is more popular with literary types (aka novelists and writers, many well-known names too) and academics, and not so much widespread within the computer security community. Some of the well-distributed tools for security research include MS Word, Notepad++, Ultra Edit, FreeMind, and Dradis among a slew of other text editors and such. However, it is strongly recommended that you use Scrivener for reasons that will become apparent the moment you start using it. Some of the useful features are a hierarchical note repository called Drafts managed in a Binder toward the extreme left which is a metaphor for a book binder with notes. You also have Research folder inside the Binder. The Drafts and Research components cannot be...

Debriefing – seeing the forest for the trees

The malware sample of choice is called Dark Seoul. You can get the sample from http://contagiodump.blogspot.in/2013/03/darkseoul-jokra-mbr-wiper-samples.html.

This malware is chosen for this chapter as it is relevant enough to be featured in a number of news reports and advisories—http://blog.xecure-lab.com/2013/03/lets-gossip-what-happens-in-south-korea.html and http://www.secureworks.com/cyber-threat-intelligence/threats/wiper-malware-analysis-attacking-korean-financial-sector/. It is also widely available and the features are quite interesting without being overly complex for the purpose of learning malware analysis. Since most books focus on concepts and techniques in isolation, getting an idea of top-to-bottom analysis can be daunting for beginners and even experienced IT folk who do not regularly deal with malware attacks. This chapter will help in consolidating many of the individual parts of an analysis session. Demystifying the process...

Preparing for D-Day – lab setup

When you procure a malware sample from various sources such as honeypots, or online repositories, or an infected machine, your first task is to transport it to an environment where the malware can be observed in action without harming any real-world computer system and especially via network communication or propagation. This is normally called a sandbox or a malware lab and should be set up prior to analysis.

Dedicated computer hardware can certainly be used for this purpose, though a better solution would be to use virtualization or emulation. The dividends are rich and multivalent—you recoup on the price of real computer hardware and OS backup software while you capitalize on features such as snapshots, persistent disks, host only networking, kernel mode debugging over named pipes, and running multiple OS versions on the same hardware.

VMWare and VirtualBox are two virtualization software that can be leveraged in such a setup. For our purposes, this would...

Whippin' out your arsenal

Let us see the list of tools that we will be using or referring further.

Fingerprinting

• PEiD/ExeInfo: https://tuts4you.com/download.php?list.37

• FileAlyzer (with ssdeep.dll for ssdeep hashes): http://www.safer-networking.org/products/

• HeaventoolsPEExplorer: http://heaventools.com/

• Yara: https://code.google.com/p/yara-project/downloads/list

User mode sandboxing

• BSA Buster Sandbox: http://bsa.isoftware.nl/

• Sandboxie: http://www.sandboxie.com/

• Cuckoo Sandbox: http://cuckoosandbox.org/ and www.malwr.com

• VMWare: http://www.vmwareinc.com/

Debugging and disassembly

• OllyDBG 1.10/2.0: http://www.ollydbg.de/.

• IDA Pro 6.1 or above: http://www.hex-rays.com/products/ida/index.shtml.

• Debugging Tools for Windows(x86): This requires installation. It is available at http://www.microsoft.com/en-us/download/details.aspx?id=8442.

• Bochs 2.4.6: http://sourceforge.net/projects/bochs/files/bochs/2.4.6/.

Monitoring

• Sysinternals Suite (especially process explorer and process monitor)...

Summoning the demon!

Let us go about the steps to performing full analysis.

Step 1 – fingerprinting

Most of the time, you will need more information from the binary sample itself, or if you work with a memory dump, you will need to extract the binary executable or build it from there, so either way you will need to canvas the PE format and its dimensions and look for obvious and not so obvious signs of maliciousness. This information can be utilized for signature creation and other detection rules and will often be precursors and addendums to Indicators of Compromises (IOCs).

The particulars that can help in identification and cataloging of malware databases include hashes, packer/compression/armoring employed and their nomenclature and markers, section names, section virtual, and raw sizes and address, import and export tables, other compiled data directory structures such as TLS/debug directory/base relocation tables among others, section hashes, entropy(s), and overlays, among others. You...

Post infection

The shutdown function is executed as follows:

0040211F  /. 55    PUSH EBP
00402120  |. 8BEC  MOV EBP,ESP
00402122  |. 83EC >SUB ESP,10
00402125  |. 56    PUSH ESI
00402126  |. 8B75 >MOV ESI,DWORD PTR SS:[EBP+8]
00402129  |. 57    PUSH EDI
0040212A  |. 33FF  XOR EDI,EDI
0040212C  |. 57    PUSH EDI
0040212D  |. 8D86 >LEA EAX,DWORD PTR DS:[ESI+58E]
00402133  |. 50    PUSH EAX
00402134  |. FF96 >CALL DWORD PTR DS:[ESI+394]
;kernel32.WinExec

With parameters:

Nopping that part out (select the code area in the CPU window, press space, type nop in the dialog box, and then press Enter), so that it does not execute, we reach:

0040213A  |. 68 10>PUSH 2710
0040213F  |. FF96 >CALL DWORD PTR DS:[ESI+354]              ;
kernel32.Sleep

You can change the value in the stack just before the call to sleep is made to 0 to save time.

Call to LookupPrivilegeValue():

00402164  |. 8D86 >LEA EAX,DWORD PTR DS:[ESI+59F]
0040216A  |. 50    PUSH EAX
0040216B  |. 57    PUSH EDI
0040216C ...

Exorcism and the aftermath – debrief finale!

Try to add executive summaries so that the technical management has something to talk about from your technical analysis. Ideally, do some intelligence news gathering from online sources or any of your own and give reasons as to why you infer that the malware sample is malicious (MO?) and to what level. Give a few highlights and end with the mitigation measures as recommended by your team or as per your company guidelines. The following paragraph is a simple first draft of what you could possibly note down in a more generic manner related to the details you got out of this particular analysis session. You must also supplement your debrief using graphs and statistics if applicable.

Executive synopsis

This particular variant of the Dark Seoul malware is reported as Wiper A by some security vendors in a septet of seven samples collected till date, with six being wipers and one being a dropper. The other variants are dropped independently and their...

Summary

The preceding demonstration of the malware analysis process along with a running commentary is something that you will require to experience and do it on your own to imbibe anything from it. You learned what the prerequisites for analyzing malware are and how you can set up your own malware lab and perform static and dynamic analysis on a malware sample. You saw how the various features and actions of a malware are recorded with the relevant parts of data obtained from the analyst's toolkit and you also saw the process of how a report can be compiled. Building from the earlier chapters, by now you should have a strong understanding of the fundamentals of computing and bases, the assembly programming process and toolchain options, compiled data structures, and how they translate to assembly code from source code and back, static and dynamic analysis concepts, and the malware analysis process from fingerprinting a malware sample to performing static and dynamic analyses, and report...