├── README.md ├── lab01 └── lab01.md ├── lab02 └── lab02.md ├── lab03 ├── lab03.md └── procmon.txt ├── lab04 └── lab04.md ├── lab05 ├── check_platform_and_version.png ├── determine_arch.png ├── determine_version_info.png ├── dll_main_windows_api.png ├── dll_main_windows_api_2.png ├── dns_request_host.png ├── execute_cmd.png ├── gethostbyname_graph.png ├── ida_imports.png ├── lab05.md ├── local_vars.png ├── print_sys_lang_graph.png ├── pslist.png ├── set_cmdorcommand.png └── sleep_time.png ├── lab06 └── lab06.md ├── lab07 └── lab07.md ├── lab08 └── lab08.md ├── lab09 ├── dll_base_addresses.png ├── dll_mystery_data.png ├── hexstring.png ├── lab09.md └── xor_domainencode.png ├── lab10 └── lab10.md ├── lab11 ├── ini_location.png ├── lab11.md ├── modify_rcpt_to.png ├── modify_send.png ├── process_name_check.png ├── procmon.png ├── shellcode.png ├── spoolvxx.png └── text_decoding.png ├── lab12 ├── access-resource.png ├── lab12.md ├── loadlibrary.png ├── loadresource.png ├── lpstartaddress.png └── winlogon.png ├── lab13 ├── first_attempt.png ├── immunity_instrumenting_setup.png ├── lab13.md ├── likely_decoding.png ├── refs_to_b64table.png ├── second_attempt.png ├── tempfiles.png ├── xor_search.png └── xor_search2.png ├── lab14 ├── assemble_guid.png ├── fetch_commands.png ├── get_request.png ├── lab14.md ├── noscript_search.png └── regex_writer.png ├── lab15 └── lab15.md ├── lab16 ├── anti_debugging_checks.png ├── find_window.png ├── lab16.md ├── nop_today.png └── tls_entrypoint.png └── lab19 ├── find_browser.png ├── import_terminateprocess.png ├── lab19.md ├── manual_import.png ├── shellcode_connect.png ├── shellcode_decoder.png ├── very_sneaky.png └── xor_decode_shellcode.png /README.md: -------------------------------------------------------------------------------- 1 | # practical-malware-analysis 2 | Working through Practical Malware Analysis from No Starch Press 3 | -------------------------------------------------------------------------------- /lab01/lab01.md: -------------------------------------------------------------------------------- 1 | Lab 1-1 2 | ======= 3 | 4 | 1. `Lab01-01.dll` is marked malicious for 24/56 engines; `Lab01-01.exe` is for 29/55 engines. 5 | 6 | 2. `Lab01-01.dll` was compiled on `2010-12-19 16:16:38`; `Lab01-01.exe` on `2010-12-19 16:16:19`. 7 | 8 | 3. VirusTotal indicates that `Lab01-01.dll` uses `Armadillo v1.xx - v2.xx`, while `Lab01-01.exe` uses `Armadillo v1.7.1`. 9 | 10 | 4. `Lab01-01.dll` imports `socket`, `inet_addr`, and other internet functions, suggesting it connects to the internet. `Lab01-01.exe` imports `FindFirstFileA`, `CopyFileA`, `CreateFileA`, and other file handling functions that suggest it manipulates files. 11 | 12 | 5. Each file contains several fairly unique strings that could be used as host-based indicators; `Lab01-01.dll` contains `127.26.152.13` (obviously useful as a network indicator as well), while `Lab01-01.exe` contains `WARNING_THIS_WILL_DESTROY_YOUR_MACHINE`. 13 | 14 | 6. `Lab01-01.dll` contains: 15 | 16 | ``` 17 | hello 18 | 127.26.152.13 19 | SADFHUHF 20 | ``` 21 | 22 | Which suggests to me that perhaps the message `hello` is sent to `127.26.152.13` - usable as a network indicator. 23 | 24 | 7. `Lab01-01.exe` contains some odd strings: 25 | ``` 26 | kerne132.dll 27 | kernel32.dll 28 | .exe 29 | C:\* 30 | C:\windows\system32\kerne132.dll 31 | Kernel32. 32 | Lab01-01.dll 33 | C:\Windows\System32\Kernel32.dll 34 | WARNING_THIS_WILL_DESTROY_YOUR_MACHINE 35 | ``` 36 | 37 | Along with the file handling functions imported, this suggests to me that this sample will delete at least `kerne132.dll` (interesting typo in several cases?) if not `C:\*` entirely. On the other hand, at least they warn you first. 38 | 39 | As noted in (6), `Lab01-01.dll` contains: 40 | 41 | ``` 42 | hello 43 | 127.26.152.13 44 | SADFHUHF 45 | ``` 46 | 47 | Which suggests to me that perhaps the message `hello` is sent to `127.26.152.13`. Given the set of imports shown below, the sample appears to have receive functionality as well, which could possibly implement full command and control (or could be a simple phone home). 48 | 49 | ``` 50 | socket 51 | closesocket 52 | inet_addr 53 | send 54 | WSACleanup 55 | WSAStartup 56 | connect 57 | shutdown 58 | htons 59 | recv 60 | ``` 61 | 62 | 63 | Lab 1-2 64 | ======= 65 | 66 | 1. `Lab01-02.exe` matches 36 engines on VirusTotal. 67 | 68 | 2. The file appears to be packed with the UPX packer - as reported by VirusTotal. It's also telling that the PE sections are "UPX0" through "UPX2". 69 | 70 | 3. The file imports `InternetOpenA` from `WININET.dll`, as well as `CreateServiceA` from `ADVAPI32.dll`, which suggests that it spawns a service with Internet access. Since it also imports `GetProcAddress` and `LoadLibraryA`, it could load additional libraries for more functionality. (the text `InternetOpenUrlA` appears in the body of the executable, suggesting it is loaded dynamically) 71 | 72 | 4. The file contains several interesting strings, including `http://www.malwareanalysisbook.com` and `Internet Explorer 8.0`, the latter of which seems likely to be a user agent string used when accessing the earlier domain. The string `MalService` also appears (twice), suggesting (in tandem with the import of `CreateServiceA`) that this file creates a service with that name. 73 | 74 | 75 | Lab 1-3 76 | ======= 77 | 78 | 1. VirusTotal matches this sample on a huge variety of malware families; the most common seems to be `Packer.FSG.A`. 79 | 80 | 2. VirusTotal reports that the file appears to be packed with the `FSG` packer. PEiD reports `FSG 1.0 -> dulek/xt`. It cannot be unpacked using simple static analysis. 81 | 82 | 3. `Lab01-03.exe` has a variety of interesting imports, including: 83 | 84 | ``` 85 | CreateRemoteThread 86 | CreateDirectory 87 | CreateFile 88 | FindFirstFile 89 | LoadLibrary 90 | CreateNamedPipe 91 | CreatePipe 92 | IsDebuggerPresent 93 | Beep 94 | ``` 95 | 96 | 4. Without unpacking, there are very few indicators to find here. Using some of the imports as clues, it may be worthwhile to watch for a process that spawns threads and creates pipes, but that's not a particularly unique signature. 97 | 98 | 99 | Lab 1-4 100 | ======= 101 | 102 | 1. 48 VirusTotal engines match (out of 56). 103 | 104 | 2. VirusTotal reports the file is packed with `Armadilo v1.7`. PEiD, however, reports the file is not packed - bot due to entropy and a deep scan. 105 | 106 | 3. PEview reports that the file was compiled on `2019/08/30 Fri 22:26:59 UTC` - obviously faked. 107 | 108 | 4. This file has a huge number of imports, including: 109 | 110 | ``` 111 | LoadLibrary 112 | WriteFile 113 | DeleteFile 114 | CreateRemoteThread 115 | OpenThread 116 | CreatePipe 117 | CreateNamedPipe 118 | ConnectNamedPipe 119 | GetCommandLine 120 | ExpandEnvironmentStrings 121 | GetEnvironmentVariable 122 | IsDebuggerPresent 123 | Beep 124 | OpenProcessToken 125 | CreateService 126 | ControlService 127 | StartService 128 | RegLoadKey 129 | RegOpenCurrentUser 130 | DelayLoadFailureHook 131 | NsiConnectToServer 132 | CryptDecrypt 133 | CryptEncrypt 134 | WinVerifyTrust 135 | LogonUser 136 | CreateBitmap 137 | GetClipBox 138 | < various other GUI functions > 139 | PlaySound 140 | URLDownloadToCacheFile 141 | URLDownloadToFile 142 | OpenProcessToken 143 | ``` 144 | 145 | 5. Host indicators include the strings `\system32\wupdmgr.exe` (which, paired with some of the imports, suggests that this file calls out to that executable), ``, `\winup.exe` (again, likely calls out), and several dlls that are likely dynamicall imported - `urlmon.dll` and `psapi.dll` among them. 146 | 147 | Network-based indicators include the URL `http://www.practicalmalwareanalysis.com/updater.exe`. 148 | 149 | 6. The only resource available with ResourceHacker is a binary file containing the text of the program. 150 | -------------------------------------------------------------------------------- /lab02/lab02.md: -------------------------------------------------------------------------------- 1 | Lab 2 2 | ===== 3 | 4 | Lab two has no problems, but instead requires setup and configuration of a virtual machine for malware analysis. 5 | -------------------------------------------------------------------------------- /lab03/lab03.md: -------------------------------------------------------------------------------- 1 | Lab 3-1 2 | ======= 3 | 4 | 1. The softare's strings, according to Process Explorer, are: 5 | ``` 6 | jjjjjj 7 | !This program cannot be run in DOS mode. 8 | Rich 9 | .text 10 | `.data 11 | ExitProcess 12 | kernel32.dll 13 | cks=u 14 | ttp= 15 | cks= 16 | CONNECT %s:%i HTTP/1.0 17 | QSRW 18 | PWW 19 | thj@h 20 | PWW 21 | VSWRQ 22 | QVlM 23 | ^-m-m<|<|<|M 24 | advapi32 25 | ntdll 26 | user32 27 | Jbh 28 | QQVP 29 | ucj 30 | advpack 31 | StubPath 32 | SOFTWARE\Classes\http\shell\open\commandV 33 | Software\Microsoft\Active Setup\Installed Components\ 34 | test 35 | www.practicalmalwareanalysis.com 36 | admin 37 | VideoDriver 38 | WinVMX32- 39 | vmx32to64.exe 40 | SOFTWARE\Microsoft\Windows\CurrentVersion\Run 41 | SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders 42 | PWj 43 | AppData 44 | VQj 45 | ViW 46 | ``` 47 | Of particular interest are `www.practicalmalwareanalysis.com`, `CONNECT %s:%i HTTP/1.0`, and the various file path strings. 48 | 49 | The file has a number of interesting imports, including many related to threads, mutexes and semaphores, manipulating files, loading libraries, and creating and manipulating named pipes. 50 | 51 | 2. Host-based indicators include the strings seen above. Regshot shows no changed or added registry keys (beyond some noise), and [procmon](./procmon.txt) shows very little interesting activity - loading kernel32.dll, reading some registry keys (none of which seem unusual), then exiting. Curiously, the process exits with status `-1073741819`, which suggests to me that this malware is failing to execute properly. 52 | 53 | 3. ApateDNS seems only to turn up requests to `watson.microsoft.com` and `wpad.olin.edu`. Netcat shows the following, which seems consistent with Apate's findings: 54 | 55 | ``` 56 | C:\Users\IEUser\Desktop\nc111nt>nc -l -p 80 57 | GET /wpad.dat HTTP/1.1 58 | Connection: Keep-Alive 59 | Accept: */* 60 | Host: 127.0.0.1 61 | ``` 62 | 63 | ``` 64 | C:\Users\IEUser\Desktop\nc111nt>nc -l -p 443 65 | ▬♥☺ ⌂☺ {♥☺X┤áP♠/i(ÄGh◄PkP2☼R(▓Ç-♀WNu▀#ö┘¡d ∟└¶└‼ 9 3 5 /└ 66 | └ 8 2 67 | ‼ ♣ ♦☺ 6 ↓ ↨ ¶watson.microsoft.com 68 | ♠ ♦ ↨ ↑ ♂ ☻☺ ↨  ☺ ☺ 69 | ``` 70 | 71 | Neither of these seem to be caused by the file being analyzed. In addition, Process Explorer shows no TCP/IP connections, nor does the file seem to import any networking libraries. This is odd, since a domain name and apparent HTML connection string appear in the file's strings. 72 | 73 | Lab 3-2 74 | ======= 75 | 76 | 1. According to PE Explorer, `Lab03-02.dll` exports `Install`, `ServiceMain`, `UninstallService`, `installA`, and `uninstallA`. This implies that the malware could be installed as a service by running `rundll32.exe Lab03-02.dll,install MalService`. 77 | 78 | Unfortunately, doing so (even without any arguments - `rundll32.exe Lab03-02.dll,install`) results in a crash: 79 | 80 | ``` 81 | Version=1 82 | EventType=APPCRASH 83 | EventTime=131327951831980417 84 | ReportType=2 85 | Consent=1 86 | UploadTime=131327951832481137 87 | ReportIdentifier=cba757e2-fe06-11e6-8ca2-08002785c5cd 88 | IntegratorReportIdentifier=cba757e1-fe06-11e6-8ca2-08002785c5cd 89 | Response.type=4 90 | Sig[0].Name=Application Name 91 | Sig[0].Value=rundll32.exe 92 | Sig[1].Name=Application Version 93 | Sig[1].Value=6.1.7600.16385 94 | Sig[2].Name=Application Timestamp 95 | Sig[2].Value=4a5bc637 96 | Sig[3].Name=Fault Module Name 97 | Sig[3].Value=ntdll.dll 98 | Sig[4].Name=Fault Module Version 99 | Sig[4].Value=6.1.7601.23572 100 | Sig[5].Name=Fault Module Timestamp 101 | Sig[5].Value=57fd0335 102 | Sig[6].Name=Exception Code 103 | Sig[6].Value=c0000005 104 | Sig[7].Name=Exception Offset 105 | Sig[7].Value=00052a0e 106 | DynamicSig[1].Name=OS Version 107 | DynamicSig[1].Value=6.1.7601.2.1.0.256.4 108 | DynamicSig[2].Name=Locale ID 109 | DynamicSig[2].Value=1033 110 | DynamicSig[22].Name=Additional Information 1 111 | DynamicSig[22].Value=0a9e 112 | DynamicSig[23].Name=Additional Information 2 113 | DynamicSig[23].Value=0a9e372d3b4ad19135b953a78882e789 114 | DynamicSig[24].Name=Additional Information 3 115 | DynamicSig[24].Value=0a9e 116 | DynamicSig[25].Name=Additional Information 4 117 | DynamicSig[25].Value=0a9e372d3b4ad19135b953a78882e789 118 | UI[2]=C:\Windows\system32\rundll32.exe 119 | UI[3]=Windows host process (Rundll32) has stopped working 120 | UI[4]=Windows can check online for a solution to the problem. 121 | UI[5]=Check online for a solution and close the program 122 | UI[6]=Check online for a solution later and close the program 123 | UI[7]=Close the program 124 | LoadedModule[0]=C:\Windows\system32\rundll32.exe 125 | LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll 126 | LoadedModule[2]=C:\Windows\system32\kernel32.dll 127 | LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll 128 | LoadedModule[4]=C:\Windows\system32\USER32.dll 129 | LoadedModule[5]=C:\Windows\system32\GDI32.dll 130 | LoadedModule[6]=C:\Windows\system32\LPK.dll 131 | LoadedModule[7]=C:\Windows\system32\USP10.dll 132 | LoadedModule[8]=C:\Windows\system32\msvcrt.dll 133 | LoadedModule[9]=C:\Windows\system32\imagehlp.dll 134 | LoadedModule[10]=C:\Windows\system32\ADVAPI32.dll 135 | LoadedModule[11]=C:\Windows\SYSTEM32\sechost.dll 136 | LoadedModule[12]=C:\Windows\system32\RPCRT4.dll 137 | LoadedModule[13]=C:\Windows\system32\apphelp.dll 138 | LoadedModule[14]=C:\Windows\AppPatch\AcLayers.DLL 139 | LoadedModule[15]=C:\Windows\system32\SspiCli.dll 140 | LoadedModule[16]=C:\Windows\system32\SHELL32.dll 141 | LoadedModule[17]=C:\Windows\system32\SHLWAPI.dll 142 | LoadedModule[18]=C:\Windows\system32\ole32.dll 143 | LoadedModule[19]=C:\Windows\system32\OLEAUT32.dll 144 | LoadedModule[20]=C:\Windows\system32\USERENV.dll 145 | LoadedModule[21]=C:\Windows\system32\profapi.dll 146 | LoadedModule[22]=C:\Windows\system32\WINSPOOL.DRV 147 | LoadedModule[23]=C:\Windows\system32\MPR.dll 148 | LoadedModule[24]=C:\Windows\system32\IMM32.DLL 149 | LoadedModule[25]=C:\Windows\system32\MSCTF.dll 150 | LoadedModule[26]=C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\Lab03-02.dll 151 | LoadedModule[27]=C:\Windows\system32\WS2_32.dll 152 | LoadedModule[28]=C:\Windows\system32\NSI.dll 153 | LoadedModule[29]=C:\Windows\system32\WININET.dll 154 | LoadedModule[30]=C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 155 | LoadedModule[31]=C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 156 | LoadedModule[32]=C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 157 | LoadedModule[33]=C:\Windows\system32\version.DLL 158 | LoadedModule[34]=C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 159 | LoadedModule[35]=C:\Windows\system32\normaliz.DLL 160 | LoadedModule[36]=C:\Windows\system32\iertutil.dll 161 | LoadedModule[37]=C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 162 | LoadedModule[38]=C:\Windows\system32\uxtheme.dll 163 | LoadedModule[39]=C:\Windows\system32\dwmapi.dll 164 | FriendlyEventName=Stopped working 165 | ConsentKey=APPCRASH 166 | AppName=Windows host process (Rundll32) 167 | AppPath=C:\Windows\system32\rundll32.exe 168 | ``` 169 | 170 | 2. After installation, the above-named `MalService` could theoretically be run with `net start MalService`. 171 | 172 | 3. In Process Explorer, look for the DLL `Lab03-02.dll` to be loaded into a running process; it should be under a `svchost.exe` process. 173 | 174 | 4. During the installation process, setting procmon filters for `rundll32.exe` should provide some useful filtering, and afterward once the process is identified in process explorer, either a PID or process name could be used to isolate the service's actions. 175 | 176 | 5. There are a large number of unique strings which could be used for host-based detection, but the inability to install the DLL above impedes digging deeper into the malware's activity. 177 | 178 | 6. The malware contains some strings which suggest network activity: `practicalmalwareanalysis.com`, `HTTP/1.1`, etc., and also imports `WinInet.dll`, which strongly suggests that the malware has an internet component; unfortunately, due to being unable to install the service, I'm unable to explore further. 179 | 180 | Lab 3-3 181 | ======= 182 | 183 | 1. It's odd that `Lab03-03.exe` spawns a process `svchost.exe`. 184 | 185 | 2. Yes; the `svchost.exe` process has significantly different strings on disc and in memory - and, in addition, has a number of strings in memory such as `[SHIFT]`, `[TAB]`, etc. that seem to indicate it is logging keystrokes. In addition, for some reason the `Lab03-03.exe` process has an `` message in the pane for strings in memory - this perhaps accompanies the popup when the program is executed that says "The application was unable to start correctly", so it may not be an odd indicator. 186 | 187 | 3. The string `practicalmalwareanalysis.log` present in memory for the `svchost.exe` process suggests to me this program creates a logfile somewhere. As noted in the previous question, the strings that suggest keylogging are also likely present somewhere on disk (presumably in this logfile). 188 | 189 | 4. I very strongly suspect that this is a keylogger. 190 | 191 | 192 | Lab 3-4 193 | ======= 194 | 195 | 1. The executable file for the lab disappears; presumably deleted. In addition, Process Monitor reports that at one point a process was creted executing `cmd.exe`, which is consistent with my observation that a command window briefly appeared and then disappeared. Process Monitor reports that the event's command line value was `"C:\Windows\System32\cmd.exe" /c del C:\Users\IEUser\Desktop\PRACTI~1\BINARY~1\CHD8AF~1\Lab03-04.exe >> NUL`. 196 | 197 | 2. The incredible speed of the process made catching it in Process Explorer quite difficult. In addition, spawning a command line process causes us to be unable to introspect some of the executable's actions since they take place in a different process. 198 | 199 | 3. The program can be run from the command line, through `explorer.exe`, or through Process Explorer. It could also be executed with a debugger attached, though we haven't gotten there yet. :) 200 | -------------------------------------------------------------------------------- /lab03/procmon.txt: -------------------------------------------------------------------------------- 1 | 2:14:08.2976661 PM Lab03-01.exe 4048 Process Start SUCCESS Parent PID: 268, Command line: "C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\Lab03-01.exe" , Current directory: C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\, Environment: 2 | =::=::\ 3 | ALLUSERSPROFILE=C:\ProgramData 4 | APPDATA=C:\Users\IEUser\AppData\Roaming 5 | CommonProgramFiles=C:\Program Files\Common Files 6 | COMPUTERNAME=IE11WIN7 7 | ComSpec=C:\Windows\system32\cmd.exe 8 | FP_NO_HOST_CHECK=NO 9 | GSTREAMER_PATH=C:\Program Files\Autopsy-4.3.0\gstreamer\bin;C:\Program Files\Autopsy-4.3.0\gstreamer\lib\gstreamer-0.10 10 | HOMEDRIVE=C: 11 | HOMEPATH=\Users\IEUser 12 | LOCALAPPDATA=C:\Users\IEUser\AppData\Local 13 | LOGONSERVER=\\IE11WIN7 14 | NUMBER_OF_PROCESSORS=1 15 | OS=Windows_NT 16 | Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Autopsy-4.3.0\gstreamer\bin;C:\Program Files\Autopsy-4.3.0\gstreamer\lib\gstreamer-0.10 17 | PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC 18 | PROCESSOR_ARCHITECTURE=x86 19 | PROCESSOR_IDENTIFIER=x86 Family 6 Model 142 Stepping 9, GenuineIntel 20 | PROCESSOR_LEVEL=6 21 | PROCESSOR_REVISION=8e09 22 | ProgramData=C:\ProgramData 23 | ProgramFiles=C:\Program Files 24 | PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ 25 | PUBLIC=C:\Users\Public 26 | SESSIONNAME=Console 27 | SystemDrive=C: 28 | SystemRoot=C:\Windows 29 | TEMP=C:\Users\IEUser\AppData\Local\Temp 30 | TMP=C:\Users\IEUser\AppData\Local\Temp 31 | USERDOMAIN=IE11WIN7 32 | USERNAME=IEUser 33 | USERPROFILE=C:\Users\IEUser 34 | windir=C:\Windows 35 | 2:14:08.2976692 PM Lab03-01.exe 4048 Thread Create SUCCESS Thread ID: 3852 36 | 2:14:08.4083838 PM Lab03-01.exe 4048 Load Image C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\Lab03-01.exe SUCCESS Image Base: 0x400000, Image Size: 0x1c00 37 | 2:14:08.4110844 PM Lab03-01.exe 4048 Load Image C:\Windows\System32\ntdll.dll SUCCESS Image Base: 0x777d0000, Image Size: 0x142000 38 | 2:14:08.4111537 PM Lab03-01.exe 4048 CreateFile C:\Windows\Prefetch\LAB03-01.EXE-3F02A4FC.pf NAME NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a 39 | 2:14:08.4112311 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager REPARSE Desired Access: Read 40 | 2:14:08.4112437 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS Desired Access: Read 41 | 2:14:08.4112573 PM Lab03-01.exe 4048 RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch NAME NOT FOUND Length: 1,024 42 | 2:14:08.4112641 PM Lab03-01.exe 4048 RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS 43 | 2:14:08.4114043 PM Lab03-01.exe 4048 CreateFile C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened 44 | 2:14:08.4115082 PM Lab03-01.exe 4048 Load Image C:\Windows\System32\kernel32.dll SUCCESS Image Base: 0x775a0000, Image Size: 0xd5000 45 | 2:14:08.4116283 PM Lab03-01.exe 4048 Load Image C:\Windows\System32\KernelBase.dll SUCCESS Image Base: 0x75990000, Image Size: 0x4b000 46 | 2:14:08.4137803 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server REPARSE Desired Access: Read 47 | 2:14:08.4137940 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS Desired Access: Read 48 | 2:14:08.4138079 PM Lab03-01.exe 4048 RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat NAME NOT FOUND Length: 548 49 | 2:14:08.4138149 PM Lab03-01.exe 4048 RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSUserEnabled SUCCESS Type: REG_DWORD, Length: 4, Data: 0 50 | 2:14:08.4138211 PM Lab03-01.exe 4048 RegCloseKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS 51 | 2:14:08.4138328 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option REPARSE Desired Access: Query Value, Set Value 52 | 2:14:08.4138401 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option NAME NOT FOUND Desired Access: Query Value, Set Value 53 | 2:14:08.4138526 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Srp\GP\DLL REPARSE Desired Access: Read 54 | 2:14:08.4138585 PM Lab03-01.exe 4048 RegOpenKey HKLM\System\CurrentControlSet\Control\Srp\GP\DLL NAME NOT FOUND Desired Access: Read 55 | 2:14:08.4138683 PM Lab03-01.exe 4048 RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Desired Access: Query Value 56 | 2:14:08.4138848 PM Lab03-01.exe 4048 RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled NAME NOT FOUND Length: 80 57 | 2:14:08.4138901 PM Lab03-01.exe 4048 RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers SUCCESS 58 | 2:14:08.4139043 PM Lab03-01.exe 4048 RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NAME NOT FOUND Desired Access: Query Value 59 | 2:14:10.3877745 PM Lab03-01.exe 4048 Thread Exit SUCCESS Thread ID: 3852, User Time: 0.0000000, Kernel Time: 0.0000000 60 | 2:14:10.3881592 PM Lab03-01.exe 4048 QueryNameInformationFile C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\Lab03-01.exe SUCCESS Name: \Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L\Lab03-01.exe 61 | 2:14:10.3881994 PM Lab03-01.exe 4048 QueryNameInformationFile C:\Windows\System32\KernelBase.dll SUCCESS Name: \Windows\System32\KernelBase.dll 62 | 2:14:10.3882217 PM Lab03-01.exe 4048 QueryNameInformationFile C:\Windows\System32\kernel32.dll SUCCESS Name: \Windows\System32\kernel32.dll 63 | 2:14:10.3882469 PM Lab03-01.exe 4048 QueryNameInformationFile C:\Windows\System32\ntdll.dll SUCCESS Name: \Windows\System32\ntdll.dll 64 | 2:14:10.3882762 PM Lab03-01.exe 4048 QueryNameInformationFile C:\Windows\System32\apisetschema.dll SUCCESS Name: \Windows\System32\apisetschema.dll 65 | 2:14:10.3883393 PM Lab03-01.exe 4048 Process Exit SUCCESS Exit Status: -1073741819, User Time: 0.0000000 seconds, Kernel Time: 0.0000000 seconds, Private Bytes: 151,552, Peak Private Bytes: 241,664, Working Set: 708,608, Peak Working Set: 712,704 66 | 2:14:10.3883623 PM Lab03-01.exe 4048 CloseFile C:\Users\IEUser\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_3L SUCCESS 67 | 68 | -------------------------------------------------------------------------------- /lab04/lab04.md: -------------------------------------------------------------------------------- 1 | This chapter is a crash course in x86 assembly, and did not include labs. Instead, I did a bunch of other random reading on assembly and read through [some old code](https://github.com/DakotaNelson/stagehand/blob/master/winstage.c) as a refresher. 2 | -------------------------------------------------------------------------------- /lab05/check_platform_and_version.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/check_platform_and_version.png -------------------------------------------------------------------------------- /lab05/determine_arch.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/determine_arch.png -------------------------------------------------------------------------------- /lab05/determine_version_info.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/determine_version_info.png -------------------------------------------------------------------------------- /lab05/dll_main_windows_api.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/dll_main_windows_api.png -------------------------------------------------------------------------------- /lab05/dll_main_windows_api_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/dll_main_windows_api_2.png -------------------------------------------------------------------------------- /lab05/dns_request_host.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/dns_request_host.png -------------------------------------------------------------------------------- /lab05/execute_cmd.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/execute_cmd.png -------------------------------------------------------------------------------- /lab05/gethostbyname_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/gethostbyname_graph.png -------------------------------------------------------------------------------- /lab05/ida_imports.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/ida_imports.png -------------------------------------------------------------------------------- /lab05/lab05.md: -------------------------------------------------------------------------------- 1 | Lab 5-1 2 | ======= 3 | 4 | 1. DllMain is at address `1000D02E`. 5 | 6 | 2. As seen in the figure below, `gethostbyname` does not appear in the IDA imports table. 7 | 8 | ![IDA imports table for malware sample](ida_imports.png) 9 | 10 | 3. Since `gethostbyname` does not appear in the imports table, I determined the number of callers using IDA's Xrefs graph. As seen in the figure below, `gethostbyname` is called by 5 different functions. 11 | 12 | ![IDA Xrefs graph showing callers of gethostbyname](gethostbyname_graph.png) 13 | 14 | 4. Based on the xefs leading to (specifically a data xref immediately before) that memory address's call to `gethostbyname`, the DNS request will go out for `pics.practicalmalwareanalysis.com`, as seen in the figure below. 15 | 16 | ![hostname seen in xrefs graph from IDA pro](dns_request_host.png) 17 | 18 | 5. IDA recognizes 22 local variables in that subroutine (prefixed with `var_` or named by IDA). They can be seen in the figure below. 19 | 20 | ![subroutine local variables identified by IDA](local_vars.png) 21 | 22 | 6. IDA recognizes one argument (prefixed with `arg_`) - it can be seen in the figure above. 23 | 24 | 7. The string `\cmd.exe /c` appears at `xdoors_d:10095B34`. 25 | 26 | 8. In the area of the code that the above string appears at, the program appears to create a pipe, get the system directory, then execute a command using the string `\\command.exe /c` or `\\cmd.exe /c` based on the results of the system directory call. It then zeros out 255 bytes of memory, and receives some data from a socket. 27 | 28 | ![IDA disassembly showing segment of assembly code](execute_cmd.png) 29 | 30 | 9. The code seen in the figure below determines the platform the code is running on. I named this subprocedure "DetermineVersionInfo". 31 | 32 | ![disassembly subprocedure to determine Windows version information](determine_version_info.png) 33 | 34 | This subprocedure is called from the disassembly seen in the figure below, which then sets the variable `dword_1008E5C4` (which I have renamed "cmdOrCommand") for later use. 35 | 36 | ![disassembly snippet from IDA](set_cmdorcommand.png) 37 | 38 | 10. If `memcmp` returns zero (the bytes are identical), the program pushes the variable `s` (a SOCKET) to the stack, then calls a method which prints (over the socket) the `Robot_WorkTime` of the system (which involves reading the registry key `SOFTWARE\Microsoft\Windows\CurrentVersion`). 39 | 40 | 11. `PSLIST` first calls a procedure which checks `dwPlatformId` and `dwMajorVersion`, as seen in the figure below. The procedure returns 1 if `dwPlatformId == 2` and `dwMajorVersion == 5`, else it returns 0. 41 | 42 | ![IDA procedure that checks dwPlatformId and dwMajorVersion](check_platform_and_version.png) 43 | 44 | The PSLIST subroutine then calls `strlen` on an argument, and uses the result to decide between two paths; one of which prints a list of processes locally, another which does so over a socket. PSLIST then returns. 45 | 46 | ![the PSLIST subroutine displayed in IDA](pslist.png) 47 | 48 | 12. I had already named this function as a part of my analysis, but based entirely on the call graph, I would name this subroutine something along the lines of `sendLangID` - since it calls `GetSystemDefaultLangID` and then a function which uses `send`, `malloc`, and `free` (strongly implying it's a function to send some data over a socket). 49 | 50 | ![IDA call graph of sub_10004E79](print_sys_lang_graph.png) 51 | 52 | 13. `DllMain` calls 4 Windows API functions directly: 53 | 54 | ![DllMain's list of called Windows API functions](dll_main_windows_api.png) 55 | 56 | At a depth of 2, things expand rapidly - at this level, DllMain calls 33 Windows API functions, by my count: 57 | 58 | ![DllMain's call graph at depth 2](dll_main_windows_api_2.png) 59 | 60 | 14. The variable I have named `sleepTime` is set to `[This is CTI]30`. While I don't understand the prefix, the `30` is obviously converted to an integer, then multiplied by 1000 to convert to milliseconds before being passed to `sleep`, as seen in the function below: 61 | 62 | ![IDA disassembly around the sleep function](sleep_time.png) 63 | 64 | 15. The three parameters to the `socket` call are 2, 6, and 1 - `af`, `type`, and `protocol`, respectively. 65 | 66 | 16. After applying the symbolic constants, the arguments to the `socket` call are `AF_INET`, `SOCK_STREAM`, and `IPPROTO_TCP`. 67 | 68 | 17. The exported functions `InstallRT`, `InstallSB`, and `InstallSA`, all of which calls the subroutine containing the `in` instruction, have a string "Found Virtual Machine,Install Cancel.", which strikes me as pretty damning evidence of virtual machine detection. 69 | 70 | 18. There's a long, odd procession of ASCII characters. 71 | 72 | 19. I do not have IDA Pro, but this looks like shellcode. 73 | 74 | 20. Highlighting the desired bytes and pressing "A" will convert them to an ASCII string. 75 | 76 | 21. The Python script XORs each byte with `0x55`, which must be a decoding constant discovered some other way and used to obfuscate this shellcode. Since I can't use the IDA script, I instead wrote: 77 | 78 | ``` 79 | s = "-1::',27h,'u<&u!=<&u746>1::',27h,'yu&!',27h,'<;2u106:101u3:',27h,'u',5,27h,'46!<649u',18h,'49\"4',27h,'0u',14h,';49,&<&u',19h,'47uo|dgfa" 80 | d = [ord(c)^(0x55) for c in (s)] 81 | "".join([hex(x) for x in d]).replace("0x", " ") 82 | ``` 83 | 84 | Which duly prints: 85 | 86 | ``` 87 | ' 78 64 6f 6f 72 79 67 62 3d 79 72 20 69 73 20 74 68 69 73 20 62 61 63 6b 64 6f 6f 72 79 67 62 3d 79 72 2c 20 73 74 72 79 67 62 3d 79 72 69 6e 67 20 64 65 63 6f 64 65 64 20 66 6f 72 79 67 62 3d 79 72 20 72 79 60 79 67 62 3d 79 72 61 63 74 69 63 61 6c 20 72 79 64 6d 3d 79 72 61 6c 77 61 72 79 67 62 3d 79 72 65 20 72 79 64 61 3d 79 72 6e 61 6c 79 73 69 73 20 72 79 64 6c 3d 79 72 61 62 20 3a 29 31 32 33 34' 88 | ``` 89 | 90 | In a hex editor, this is: 91 | 92 | ``` 93 | xdoorygb=yr is this backdoorygb=yr, strygb=yring decoded forygb=yr ry`ygb=yractical rydm=yralwarygb=yre ryda=yrnalysis rydl=yrab :)1234 94 | ``` 95 | 96 | Which doesn't appear quite right, but is pretty close! I'm not sure what all the `ygb=y` strings are, but removing them leaves: 97 | 98 | ``` 99 | xdoorr is this backdoorr, strring decoded forr ry`ractical rralwarre rrnalysis rrab :)1234 100 | ``` 101 | 102 | Which I'll call good enough for having done it myself. 103 | -------------------------------------------------------------------------------- /lab05/local_vars.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/local_vars.png -------------------------------------------------------------------------------- /lab05/print_sys_lang_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/print_sys_lang_graph.png -------------------------------------------------------------------------------- /lab05/pslist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/pslist.png -------------------------------------------------------------------------------- /lab05/set_cmdorcommand.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/set_cmdorcommand.png -------------------------------------------------------------------------------- /lab05/sleep_time.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/DakotaNelson/practical-malware-analysis/849eb0871b7bfd8a639d7a9c5ecc42e11b7af2d0/lab05/sleep_time.png -------------------------------------------------------------------------------- /lab06/lab06.md: -------------------------------------------------------------------------------- 1 | Lab 6-1 2 | ======= 3 | 4 | 1. Main calls the subroutine `sub_401000`, which contains an if statement. 5 | 6 | 2. The subroutine appears to write data out. 7 | 8 | 3. Above all else, this program seems to do a lot of useless math. Other than that, it seems to determine whether or not the internet is connected (using `InternetGetConnectedState`). 9 | 10 | 11 | Lab 6-2 12 | ======= 13 | 14 | 1. The first subroutine called by `main` determines if there is an internet connection. 15 | 16 | 2. The subroutine appears to write data out (printf?). 17 | 18 | 3. The second subroutine attempts to open (connect to) `http://www.practicalmalwareanalysis.com/cc.htm". 19 | 20 | 4. This subroutine appears to use if statements, and perhaps a for loop. 21 | 22 | 5. The User Agent is set to `Internet Explorer 7.5/pma`, and the program reaches out to a set url (see question 3). 23 | 24 | 6. This malware attempts to open and read from a specified URL, then expects the URL to contain a string `\