Bangeter 04-malware_identification_v50.pdf

Malware sandboxes automate malware (binaries, documents, URLs) analysis, and typically allow to quickly:

• Determin whether a sampe is malicious
• Determine IOCs
• Determine the malware family (in some cases), e.g. based on correlation of IOCs or using Yara rules

Malsware sandboxes are dynamic analysis systems:

• Samples submitted to a sandox are executed for a couple of minutes
• Then an analysis report is presented to the user.
• Analysis reports can often be read by less skillec analysts for triage purposes

• Detection of the instruments being used
  • Detection of debuggers, or prevent attaching debuggers
• Detecting virtual machines
  • Malware sleeps for a couple of minutes to defeat sandboxes
  • Malware tries to figure out whether it is on a real machine or running in a Sandbox:
    • No user interaction
    • Small memory of analysis machine
    • Only one CPU
    • etc...
• Once an analysis environmment is detected, malware will exit, or show non-malicious behavior

In general it is impossible to recontruct the original PE file from memory since some modifications cannot be undone:

• IAT
• Relocations
• Some pages may be missing from memory

Don't expect the recovered PE files to be runnable

Recovered PE files are sufficent for analysis with IDA Pro or to upload to Virustotal.

Malware sometimes modifies /destructs the PE header in memory to make reconstruction hard/impossible

PE files in memory contains more information than PE files on disk:

• DLLs used by PE file
• Dynamic data such as heap and stack

Packing is an ovfuscation technique used by malware, with two goals:

• Evading AV signatures
• Prevent or slow down static analysis

To unpack malware it is often sufficient to dump memory of the unpacked process, recieving memory injections.

PE rebuild

• prcdump
• dlldump

Raw:

• vaddump
• memdump
• malfind ... ./dumps-malfind

General limitation: Memory that is paged out cannot be dumped, which can result in corruption when dumping PE files

we can upload dll and executables that we extracted with dlldump and procdump to malfind for automatic analysis.

The dumped strings may contain:

• CC commands
• CC URLs
• Filesystem paths
• Malware names
• Names of AVs to kill
• Malware log messages
• ...

In some cases, the strings may be sufficient to identify a sample, or at least to develop a first understanding of a samples capabilities.

Simply run strings on dumped (and unpacked) process memory, DLLs ,etc..

Under linux two invocations of strings needs to be made for ASCII and unicode strings

strings -el memory.bin

stings memory.bin