Bangeter 01-basic_malware_techniques_4.2.pdf

1. Process A enables debug prrivilege (SE_DEBUG_PRIVILEGE). 
2. Process A opens a handle to Process B by calling OpenProcess.
3. Process A allocates memory in Proces B using VirtualAllocEx.
4. Process A transfers a string to process B containing the full path to the malicous DLL.
5. Process A calls CreateRemoteThread to start a new thread in Process B that executes the LoadLibrary function.
6. At this point the injection is complete and Process B has loaded the DLL. Process A calls VirtualFree to free the memory containing the DLLs path.
7. Process A calls CloseHandle on Process Bs process to clean up.

...

• Look for loaded DLLs in processes.
• LoadLibrary() function is a legit technique exposed by the image loader for loading DLLs, is not designed for stealth.
• LoadLibrary() creates various artefacts:
  • Entries in the PEB
    • PEB containes 3 double linkded lists of the DLLs loaded in a process.
  • Entires in the VAD

The PEB is stored in the user mode memory of each process. Therefor the PEB can be modified to perform a DLL unlinking.

Detection: The VAD runs in kernel mode and also containes a list off DLLs. So the VAD can be cross referenced with the PEB to see if an unlinking occoured.

• LoadLibrary() in DLL injection leaves traces.
• Code injection avoides using LoadLibrary() by directly injecting the entire malware code from the launcher process into the victim process.

1. Iterate over process list to select victiom process.
   • Some malware injects in all processes it gets access to other malware is more slective.
2. Run OpenProcess() to get handle of victim porcess.
3. Allocate memory in the victim useing VitualAllocEx(). Alocated memory needs to be writable + executable.
4. Inject code using WriteProcessMemory()
5. Use CreateReamoteThread() to start injected code in a seperate thread.

Since LoadLibrary() is not used the steps of the Windows loader need to be performed by the malware:

• Map sections into memory
• Loading of DLLs (DLLs used by the malicious code that arn't already loaded)
• Fill IAT
• Apply relocations

(Relocations con be avouded if so called "shell code" is injected; shell code is position independent code.

Direct code injections don't show up as process or DLLs.

They still leave following traces:

• Memory allocated by VirtualAllocEx() will be tracked in the VAD tree.
• Memory allocated by malware is mostly RWX, which is uncomon and suspicious.

Detecting the process using:

• pslist
• pstree
• psscan

If proces is trying to hide useing DKOM unlinking use:

• psxview

Use dlllist to get full path of the process exe

Traces are left on disk and in autostart mechainsm

use:

• malfind
• ldrmodules
• apihooks

The underlying ides of hooking is: to insert code into the execution path of a legitimate program and to divert the execution to some malicous code.

* Hookin and code injection are often reoated: The malicous code to which the hooks point, is often injected into the victim process.

Inline hooking :

1. Overwrite a part of the original code in the instruction stream with a jump to your code.
2. Jump to your detour code, after the detour code is executed, execute the code that was over written with the initial jump instruction (prevent program crash) then jump back to the original position in the instruction stream of the original code.

Detection heuristic:

1. Locate functions in DLLs
2. Analyze function code to check whether there are non-legitimate execution trnsfers (JMP, CALL, etc.) to outside function.

*(Not always easy to tell letitimate from non-legitmate execution transferst, executions transferst can be obfuscated and thus difficult to detect)

The IAT is, loosely speaking a table of pointers that links function calls

• IAT entries for each DLL, and each function in DLL
• IAT is filled by the loader

Idea of IAT hookin: Modify slected function pointers, so that they point to your malicous coed.

Detection heuristic:

1. Iterate through IAT / EAT entries in DLLs of process being analyzed
2. If an entry points outside of the DLL currently being inspected, the hook detected.

• There are legitimate applications of hooking, the heuristics sometimes produce false positives.
• When hooks are places "in the middle" of a function, they will be missed by the heuristics, resultin in false negatives.

DLL = Dynamic Link Library

• A DLL is a library that contains code and data that can be used by more than on program at the same time.
• By using a DLL, a program can be modularized into separate components.
• Additionally, updates are easier to apply to each module without affecting other parts of the program.
• DLLs can often be related to functionalities of a process.
  • E.g. crypto functionality, networking, etc...

• Code of main program
• Static / global data
• DLLs of processes including static & global data
• Heap
• Stack

• Executable: Main module -> PE file mapped into memory (eg. Chrome.exe)
• DLLs imported by main module
• One stack per thread. Used for storing local variables.

• Protection attributes:
  • PAGE_EXECUTE
  • PAGE_EXECUTE_READ
  • PAGE_EXECUTE_READWRITE
• Type
  • MEM_IMAGE: Indicates that the memory pages within the region are mapped into the view of an image section.
  • MEM_MAPPED Indicates that the memory pages within the region are mapped into the view of a section.
  • MEM_PRIVATE Indicates that the memory pages within the region are private (that is not shared by other processes)
• States:
  • Commited
  • Reserved

Image:

The memory represnts an executable file, such as an EXE or DLL, that has been loaded into a process by the image loader.

• Does not include executable files loaded as data files.
• Executable code regions are typically read/execute only and shareable
• Data regions, such as initialized date, are typically read/write or coppy-on-write.

Mapped File:

The memory is shareble and represents a file on disk. Mapped files are often resource DLLs and typically contain application data. 

Sharable memory is memory that can be shared with other processes and is backed by RAM or by the paging file.

A heap represents private memory allocated and managed by the user-mode heap manager and typically contains application data. Application memory allocations that use Heap memory include th C runtime malloc library, the C++ new operator, the Windows Heap APIs, and the legacy Global Alloc and LocalAlloc APIs.

The mamged heap represnts private memory that is allocated and managed by the .NET runtime and typically contains application data.

Stack memory is allocated to each thread in a process to store function parametes, local variables and invacation recors

Typically, a fixed amount of Stack memory is allocated and reserved when a thread is created, but only a relatively small amount is committed.

The amount of memory commited within the allocation will grow as need, but will not shrink.

Stack memory is freed when its thread exits.

Private Data memory is memory that is allocated by Virtual Alloc and that is not further handled by the Heap Manager or the .NET runtime, or assigned to the Stoack categroy.

• Private data memory can not be shared with other processes.

Typicaly contians:

• application data
• Process and thread envirnment blocks.

Free memory regions are spaces in the process virtual address space that are not allocated.

Unusable memory, is free memory but cannot be used because of allocation granularity restrictions. (e.g. 64KB or 0x10000)

PE = Portable Executable

Features dynamic linking, symbol exporting/importing.