Recommended
More Related Content
What's hot
What's hot (20)
Similar to Let's Talk Technical: Malware Evasion and Detection
Similar to Let's Talk Technical: Malware Evasion and Detection (20)
Recently uploaded
Recently uploaded (20)
Let's Talk Technical: Malware Evasion and Detection
- 1. Let’s talk technical: Malware Evasion and Detection James Haughom Jr XOR Security
- 2. Who am I? • Self taught cyber professional • Background in malware analysis/RE • XOR Security! • Windowless room for 10+ hours a day (SOClife) • Two degrees in music (totally relevant) • Shameless plug: http://rinseandrepeatanalysis.blogspot.com/ • Contact info: james.haughom@xorsecurity.com
- 3. Agenda • Topics: • Malware Evasion Techniques • Detection Techniques for Defenders • Why? • Evasive malware becomes more prevalent • Defenders must follow suit • Bye bye, signature-based detection! • What I pray to God you get out of it: • Thinking outside of the box for detection • Learn about some of malware’s innerworkings
- 4. Malware – all shapes and sizes PEs, PowerShell, and Shellcode.....oh my!
- 5. Microsoft Office Doc Malware Weaponization: • VBA Macros / OLE Objects • DDE • Embedded link/shortcut files (.settingcontent-ms, .iqy, .slk)
- 6. PDF Malware Weaponization: • /JavaScript • Embedded files (.exe, .settingcontent-ms, etc…) • Phishing links (boring.)
- 7. RTF Malware Weaponization: • OLE Objects (does not support macros) • Embedded files (.exe, shellcode, etc…) • Abuses native windows executables (powershell, regsvr, bitsadmin, certutil, etc…)
- 8. PowerShell, JavaScript, Shellcode Weaponization: • Usually embedded in other binaries • Used both for delivery and persistent payloads • Leveraged by Fileless and Evasive malware • Shellcode = PIC ready to hit the CPU
- 9. Portable Executables • .exe / .dll • Full persistent payload on disk • Most robust form of malware • Borland, C, C++, etc… • Abuse WinAPI • Native windows functions = API Calls • Ransomware, backdoors, trojans, worms, keyloggers, rootkits, etc… Malware.exe (process) Kernell32.dll CreateFile CreateProcess CreateThread (imported) ws_32.dll socket send Recv (imported) C:WindowsSystem32 Kernel32.dll (export) Ws_32.dll (export)
- 10. Evasion on disk, in memory, in transit..
- 11. Static Evasion - Packing • .EXEs / .DLLs = PACKED • Packing is a subset/type of obfuscation • Compression • VMProtect, Themida, Armadillo, etc.. • High entropy/low import count • Weird static properties • APIs: • LoadLibrary • GetProcAddress • VirtualAlloc • RtlDecompressBuffer • Hides functionality of the malware • Hides strings, imports, etc… • Evade AV
- 12. Static Evasion - Obfuscation • Non-PE malware is technically not packed, but obfuscated: • Garbage code • Pointless Arithmetic • Concatenation of important strings at runtime • Randomized variable names • Unused variables/functions • Multiple layers/languages • Replace(), chr(), Vbkey() • Simple encoding (XOR, Base64, Hex) • Compression (PowerShell) • Randomized order of functions
- 14. Trojanization • Masquerading as a system process: • Svchost.exe running out of AppData • Running as a service: • Background service • Svchost.exe with malicious dll • Masquerading as downloaded software
- 15. Environment-aware: Process activity • FindWindow API Call • GetModuleHandle • List running processes and compare: 1. Get a process listing: CreateToolhelp32Snapshot, EnumProcesses 2. Iterate through the list of processes: Process32First, Process32Next 3. Compare results of process listing • Virtualization: • VBoxService.exe, Vmtoolsd.exe, Vmwareuser.exe • Malware Lab: • procmon.exe, procexp.exe, wireshark.exe • Debuggers: • Ollydbg.exe, windbg.exe, x64dbg.exe
- 17. File System / Registry Traverse File System Query Registry • Virtualization: • HKLMHARDWAREDEVICEMAPScsiScsi Port 0Scsi Bus 0Target Id 0Logical Unit Id 0“Identifier”;“VMWARE” • HKLMSOFTWAREVMware, Inc.VMware Tools • HKLMHARDWAREDescriptionSystem “SystemBiosVersion”;”VMWARE” • HKLMHARDWAREDescriptionSystem”SystemBios Version”;VBOX • HKLMSOFTWAREOracleVirtualBox Guest Additions • HKLMHARDWAREACPIDSDTVBOX • Malware Lab: • Residue from non-standalone tools • Virtualization: • C:WINDOWSsystem32driversVBoxMouse.sys • C:WINDOWSsystem32vboxhook.dll • C:WINDOWSsystem32vboxdisp.dll • C:Windowssystem32driversvmmouse.sys • C:system32driversvmhgfs.sys • Malware Lab: • Installation files , dependencies, dlls • Wireshark, Process Hacker, etc… • Sandbox: • Lack of data on the file system • AV: • Installation files, dependences, dlls
- 19. Hardware • Detect Virtualization/Lab/Sandbox: • Common MAC addresses • VirtualBox - 08:00:27 • Vmware - 00:0C:29, 00:1C:14, 00:50:56, or 00:05:69 • Check RAM/Cores: • If too robust, may exit
- 20. Sandbox • Detect Sandbox: • Check system time • Successful internet access • HttpSendRequest google.com • Mouse/keyboard activity • Empty clipboard • Sleep loop • Malware name • Some sandboxes name the malware its hash when executing • Some sandboxes name it malware malware.exe
- 21. Debuggers • Detect Debuggers: • Timing: • GetTickCount – if (GetTickCount1 – GetTickCount2 > x){ EXIT } • GetSystemTime if (GetSystemTime1 – GetSystemTime2 > x){ EXIT } • WinAPI Calls • IsDebuggerPresent, OutputDebugString, CheckRemoteDebugger, QueryInformationProcess • Manually checking flags within data structures • PEB – fs:[30] + 0x2 // gs:[60] + 0x2 • SeDebugPrivilege flag • Check running processes for common debuggers • ollydbg, x64dbg, immunity, etc…. • FindWindow • Parameter of ollydbg, x64dbg, etc… • Abuse of the Structured Exception Handler • TLS Callback Functions • The Red Pill
- 22. Miscellaneous Evasion • Cleaning up after itself: • Config files, dependencies, residue, artifacts, itself, timestomping, etc.... • Evading signatures: • Randomly generate filenames or registry values • DGA – Domain Generation Algorithm • Client/server-side • Hash or refer to sections of itself to detect tampering • Arguments.callee in JS • PEs that hash sections of own code • Hide from task manager/tasklist • Unlink itself from doubly linked list PsActiveProcessHead • Behavior dependent on other running processes • E.g. Coinminer looking for task manager • DLL Load Order Hijacking
- 23. Before timestomp
- 24. After timestomp
- 25. Code injection • Different Flavors: • Process Hollowing + Injection • CreateProcess (suspended)… • CreationFlag = 0x00000004 • UnmapViewOfSection … • WriteProcessMemory… • ResumeThread… • DLL injection • VirtualAllocEx • WriteProcessMemory • CreateRemoteThread • LoadLibrary • API Hooking • Interception/interference of code • IAT Hooking • Inline Hooking (trampoline) • Shellcode injection • Unpacking technique • Process Doppelganging
- 26. Malware analysis for hedgehogs - http://struppigel.blogspot.com/2017/07/process-injection-info-graphic.html
- 28. Evasion in transit • Blending in with expected traffic: • Heavily used ports (53, 80, 443) • Benign-looking UserAgent • Less monitored by tools: • DNS is common for phoning home • Hiding comms: • Encryption • XOR • Simple encoding • DGA • C2 Redundancy • Referrer loops through domains until 200 https://www.us-cert.gov/sites/default/files/publications/MAR- 10135536-G.PDF
- 29. Fileless…ish malware • Payload in the registry • Scripts passed to native windows executables • No files dropped to file system • PowerShell / JS • WinAPI abuse • Inject Shellcode • Uses run keys for persistence • Examples • Kovter • Poweliks • Misfox
- 30. Fileless……………ish malware cont’d • WMI • Payload in WMI repository • No files dropped to file system • Persist across reboots • AV/EDRs will not see it • Persistence = Permanent Event Subscription (rootsubscription) • Requires: • EventFilter (trigger / condition) • EventConsumer (action / payload) • FilterToConsumerBinding (binds the two) • Examples: • Poshspy • Hammertoss
- 31. Detection catch me if you can
- 32. Detecting Delivery - host • Most common delivery methods: • Malicious email attachment • Drive by download • Parent/child process relationship anomalies: • Detection: Email Attachment Drive by download Outlook.exe ..winword.exe …powershell.exe ….malware.exe iexplore.exe ..malware.exe Email Attachment Drive by download Office applications spawning powershell.exe, cmd.exe, wscript.exe, etc…. Browser spawning unexpected process (whitelist) Email Attachment Drive by download Carbon Black Tanium Windows Event Logs (4688) Carbon Black Tanium Windows Event Logs (4688) Tool(s) for Detection:
- 33. Detection - network • UserAgent anomalies: • 1 offs • Slight deviations from expected UAs • System processes that shouldn’t be calling out • Certutil, bitsadmin, regsvr, mshta, etc… • Lack of UserAgent • Fav of malware authors = PowerShell Net.Webclient Class + Download(File|String) Blank UA! PowerShell Net.Webclient class (blank) BITSAdmin iexplore.exe Kovter
- 34. Detection: Process Activity • System processes behaving badly: • Running out of incorrect directory • Running under incorrect Parent Process • Anomalous DLLs • Unlinked DLLs • Anomalous network connections from system processes • DLL Load Order Hijacking
- 35. Execution Detection: Code Injection • Anomalous process/thread activity • Cross process activity • Remote thread activity • Anomalous regions of memory (rights) • Memory protection constants • Read, Copy, Write, Execute, etc… • Code Injection protection constants: • RWX • RCX • FPs = csrss.exe, lsass.exe, svchost.exe https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
- 36. Pattern Matching - Yara • Scanning file systems/memory with Yara signatures • Pattern match specific malware families or profile malware based off of APIs/strings • AV detections are often proprietary, don’t know what specifically makes them fire • At the perimeter or routine scans
- 37. Detecting Persistence: Favorites • Monitoring heavily used persistence mechanisms: • (HKLM|HKCU)Software MicrosoftWindowsCurrentVersion Run • HKLMSYSTEMCurrentControlSet Services • These autorun locations should not be modified often (especially not the values under HKLM) • Scheduled Tasks • WMI
- 38. Leveraging WMI • Use at scale for cheap (sysadmin style) • Lower visibility than most AV/EDR • Level the playing field • Anomalous process’ privileges • WMI spawns processes under PPID wmiprvse.exe
- 39. WMI via PS • Check for: • Persistence (FilterToConsumerBinding): • gwmi -Namespace rootsubscription -Class __FilterToConsumerBinding • Trigger/Condition (EventFilter): • gwmi -Namespace rootsubscription -Class __EventFilter • Action/Payload (EventConsumer): • gwmi -Namespace rootsubscription -Class __EventConsumer • Anomalous namespaces: • gwmi -Namespace root -class __NameSpace | select name • = database of classes/instances • Anomalous classes: • gwmi -Namespace [NameSpace] -list • = managing specific objects
- 40. Misc Detections • Clean up: • 1102: The audit log was cleared • PowerShell auditing • Get-WinEvent -LogName 'Windows PowerShell' • -EncodedCommand / -enc / -e • -nop • Net.WebClient • ‘[a-zA-Z0-9/+=]{20,}’ • -ExecutionPolicy bypass • Process relationships • Sweep for other stuff: • Mutexes, registry values, weird file types (.iqy, .slk, etc..), .pf for known bad (malware.exe.xxxx.pf) • Correlate events: • JS followed by .exe download • .exe download + Weird UA
- 41. Thank you! https://www.linkedin.com/in/james-haughom-jr-248748129 http://rinseandrepeatanalysis.blogspot.com james.haughom@xorsecurity.com These slides can be found on my blog or linkedin!