Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Practical Malware
Analysis
Ch 2: Malware Analysis in Virtual
Machines
Updated 1-16-17
Dynamic Analysis
• Running malware deliberately, while
monitoring the results
• Requires a safe environment
• Must prevent...
Real Machines
• Disadvantages
– No Internet connection, so parts of the
malware may not work
– Can be difficult to remove ...
Virtual Machines
• The most common method
• We'll do it that way
• This protects the host machine from the
malware
– Excep...
VMware Player
• Free but limited
• Cannot take snapshots
• VMware Workstation or Fusion is a better
choice, but they cost ...
Windows XP
• The malware we are analyzing targets
Windows XP, as most malware does
• Win XP has passed its end-of-life, so...
Configuring VMware
• You can disable networking by
disconnecting the virtual network adapter
• Host-only networking allows...
Connecting Malware to the Internet
• NAT mode lets VMs see each other and the
Internet, but puts a virtual router
between ...
Snapshots
Risks of Using VMware for Malware
Analysis
• Malware may detect that it is in a VM and
run differently
• VMware has bugs: ...
Practical Malware Analysis
Ch 3: Basic Dynamic Analysis
Why Perform Dynamic Analysis?
• Static analysis can reach a dead-end, due
to
– Obfuscation
– Packing
– Examiner has exhaus...
Sandboxes: The Quick-and-
Dirty Approach
Sandbox
• All-in-one software for basic dynamic
analysis
• Virtualized environment that simulates
network services
• Examp...
Running Malware
Launching DLLs
• EXE files can be run directly, but DLLs
can't
• Use Rundll32.exe (included in Windows)
rundll32.exe DLLna...
Launching DLLs
• Example
– rip.dll has these exports: Install and Uninstall
rundll32.exe rip.dll, Install
• Some functions...
Monitoring with Process
Monitor
Process Monitor
• Monitors registry, file system, network,
process, and thread activity
• All recorded events are kept, bu...
Launching Calc.exe
• Many, many events recorded
Process Monitor Toolbar
Start/Stop
Capture
Default Filters
Registry, File system, Network,
Processes
Erase Filter
Filtering with Exclude
• One technique: hide normal activity
before launching malware
• Right-click each Process Name and ...
Filtering with Include
• Most useful filters: Process Name,
Operation, and Detail
Viewing Processes with 

Process Explorer
Coloring
• Services are pink
• Processes are blue
• New processes are green briefly
• Terminated processes are red
DLL Mode
Properties
• Shows DEP (Data
Execution Prevention)
and ASLR (Address
Space Layout
Randomization) status
• Verify button ch...
Strings
• Compare Image to
Memory strings, if
they are very
different, it can
indicate process
replacement
Detecting Malicious Documents
• Open the document (e.g. PDF) on a
system with a vulnerable application
• Watch Process Exp...
Comparing Registry Snapshots
with Regshot
• Take 1st shot
• Run malware
• Take 2nd shot
• Compare them to
see what registry
keys were changed
Regshot
Faking a Network
Using ApateDNS to Redirect DNS
Resolutions
ApateDNS Does Not Work
• I couldn't get it to redirect any traffic in
Win XP or 7
• nslookup works, but you don't see
anyt...
Ncat Listener
• Using Ncat.exe, you can listen on a single
TCP port in Windows
• In Linux, use nc (netcat)
• This will all...
Monitoring with Ncat

(included with Nmap)
Packet Sniffing with Wireshark
Follow TCP Stream
• Can save
files
from
streams
here too
Using INetSim
inetsim
INetSim Fools a Browser
INetSim

Fools

Nmap
Basic Dynamic Tools in
Practice
Using the Tools
• Procmon
– Filter on the malware executable name and
clear all events just before running it
• Process Ex...
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
Upcoming SlideShare
Loading in …5
×

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

906 views

Published on

Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.

Instructor: Sam Bowne

Class website: https://samsclass.info/126/126_S17.shtml

Published in: Education
  • Be the first to comment

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

  1. 1. Practical Malware Analysis Ch 2: Malware Analysis in Virtual Machines Updated 1-16-17
  2. 2. Dynamic Analysis • Running malware deliberately, while monitoring the results • Requires a safe environment • Must prevent malware from spreading to production machines • Real machines can be airgapped –no network connection to the Internet or to other machines
  3. 3. Real Machines • Disadvantages – No Internet connection, so parts of the malware may not work – Can be difficult to remove malware, so re- imaging the machine will be necessary • Advantage – Some malware detects virtual machines and won't run properly in one
  4. 4. Virtual Machines • The most common method • We'll do it that way • This protects the host machine from the malware – Except for a few very rare cases of malware that escape the virtual machine and infect the host
  5. 5. VMware Player • Free but limited • Cannot take snapshots • VMware Workstation or Fusion is a better choice, but they cost money • You could also use VirtualBox, Hyper-V, Parallels, or Xen.
  6. 6. Windows XP • The malware we are analyzing targets Windows XP, as most malware does • Win XP has passed its end-of-life, so we'll use Windows Server 2008
  7. 7. Configuring VMware • You can disable networking by disconnecting the virtual network adapter • Host-only networking allows network traffic to the host but not the Internet
  8. 8. Connecting Malware to the Internet • NAT mode lets VMs see each other and the Internet, but puts a virtual router between the VM and the LAN • Bridged networking connects the VM directly to the LAN • Can allow malware to do some harm or spread – controversial • You could send spam or participate in a DDoS attack
  9. 9. Snapshots
  10. 10. Risks of Using VMware for Malware Analysis • Malware may detect that it is in a VM and run differently • VMware has bugs: malware may crash or exploit it • Malware may spread or affect the host – don't use a sensitive host machine • All the textbook samples are harmless
  11. 11. Practical Malware Analysis Ch 3: Basic Dynamic Analysis
  12. 12. Why Perform Dynamic Analysis? • Static analysis can reach a dead-end, due to – Obfuscation – Packing – Examiner has exhausted the available static analysis techniques • Dynamic analysis is efficient and will show you exactly what the malware does
  13. 13. Sandboxes: The Quick-and- Dirty Approach
  14. 14. Sandbox • All-in-one software for basic dynamic analysis • Virtualized environment that simulates network services • Examples: Norman Sandbox, GFI Sandbox, Anubis, Joe Sandbox, ThreatExpert, BitBlaze, Comodo Instant Malware Analysis • They are expensive but easy to use • They produce a nice PDF report of results
  15. 15. Running Malware
  16. 16. Launching DLLs • EXE files can be run directly, but DLLs can't • Use Rundll32.exe (included in Windows) rundll32.exe DLLname, Export arguments • The Export value is one of the exported functions you found in Dependency Walker, PEview, or PE Explorer.
  17. 17. Launching DLLs • Example – rip.dll has these exports: Install and Uninstall rundll32.exe rip.dll, Install • Some functions use ordinal values instead of names, like rundll32.exe xyzzy.dll, #5 • It's also possible to modify the PE header and convert a DLL into an EXE
  18. 18. Monitoring with Process Monitor
  19. 19. Process Monitor • Monitors registry, file system, network, process, and thread activity • All recorded events are kept, but you can filter the display to make it easier to find items of interest • Don't run it too long or it will fill up all RAM and crash the machine
  20. 20. Launching Calc.exe • Many, many events recorded
  21. 21. Process Monitor Toolbar Start/Stop Capture Default Filters Registry, File system, Network, Processes Erase Filter
  22. 22. Filtering with Exclude • One technique: hide normal activity before launching malware • Right-click each Process Name and click Exclude • Doesn't seem to work well with these samples
  23. 23. Filtering with Include • Most useful filters: Process Name, Operation, and Detail
  24. 24. Viewing Processes with 
 Process Explorer
  25. 25. Coloring • Services are pink • Processes are blue • New processes are green briefly • Terminated processes are red
  26. 26. DLL Mode
  27. 27. Properties • Shows DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) status • Verify button checks the disk file's Windows signature – But not the RAM image, so it won't detect process replacement
  28. 28. Strings • Compare Image to Memory strings, if they are very different, it can indicate process replacement
  29. 29. Detecting Malicious Documents • Open the document (e.g. PDF) on a system with a vulnerable application • Watch Process Explorer to see if it launches a process • The Image tab of that process's Properties sheet will show where the malware is
  30. 30. Comparing Registry Snapshots with Regshot
  31. 31. • Take 1st shot • Run malware • Take 2nd shot • Compare them to see what registry keys were changed Regshot
  32. 32. Faking a Network
  33. 33. Using ApateDNS to Redirect DNS Resolutions
  34. 34. ApateDNS Does Not Work • I couldn't get it to redirect any traffic in Win XP or 7 • nslookup works, but you don't see anything in a browser or with ping • I decided to ignore it and use INetSim instead
  35. 35. Ncat Listener • Using Ncat.exe, you can listen on a single TCP port in Windows • In Linux, use nc (netcat) • This will allow malware to complete a TCP handshake, so you get some rudimentary information about its requests • But it's not a real server, so it won't reply to requests after the handshake
  36. 36. Monitoring with Ncat
 (included with Nmap)
  37. 37. Packet Sniffing with Wireshark
  38. 38. Follow TCP Stream • Can save files from streams here too
  39. 39. Using INetSim
  40. 40. inetsim
  41. 41. INetSim Fools a Browser
  42. 42. INetSim
 Fools
 Nmap
  43. 43. Basic Dynamic Tools in Practice
  44. 44. Using the Tools • Procmon – Filter on the malware executable name and clear all events just before running it • Process Explorer • Regshot • Virtual Network with INetSim • Wireshark

×