Merovingio: mislead the malware

30

description

Merovingio: mislead the malware. Juan Carlos Montes – INTECO-CERT. Index. Malware Analysis what else? state of art why? Merovingio Sandboxie Merovingio Agent PebHooking DorianIA Merovingio Website. Index. Malware Analysis what else? state of art why? Merovingio Sandboxie - PowerPoint PPT Presentation

Transcript of Merovingio: mislead the malware

Page 1: Merovingio: mislead the malware
Page 2: Merovingio: mislead the malware

Merovingio:mislead the malware

Juan Carlos Montes – INTECO-CERT

Page 3: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 4: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 5: Merovingio: mislead the malware

Malware Analysis

What else?

• New techniques• Avoid signatures• The market is dozed• A lot of new samples daily• It’s expensive complicated have people focused on

malware analysis in a CSIRT

Page 6: Merovingio: mislead the malware

Malware Analysis

State of art

• Commercial products are similar• Same VM.• Same drivers.• Same look&feel.• SAME RESULTS.

• The commercial products are the same limits• One sample on each VM.

• Wait to reboot/reset the VM to start another analysis.• The analysis spend 2-3 minutes all times. This time is not based on the

behavior of the sample.• Attached to the company for any grown.• And… the source code is not our.

Page 7: Merovingio: mislead the malware

Malware Analysis

Why?

• Need “anything” to detect new samples and behaviors• Avoid the dependencies of the antivirus• Avoid the problems with VM.

• One sample on each VM• Samples are out of control on execution

• Hasten the analysis• Include some control on the execution• Create a system to simulate behaviors

Page 8: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 9: Merovingio: mislead the malware

Merovingio

• “Virtual Machine”• Sandboxie• Pebhooking• DorianIA

• And… his web site

Page 10: Merovingio: mislead the malware

Merovingio

sample web site VirtualBox

SandBoxie

Pebhooking

Dorian IA

Page 11: Merovingio: mislead the malware

• Run programs in a sandbox• Prevent permament changes on system• Help us to load our libraries on each process• Isolate each program execution

Page 12: Merovingio: mislead the malware

Merovingio Agent

• Tested in Windows XP and Windows 7• Developed in Python v2.7• Can manage all sandboxie instances as we want• Recover the logs and send us to next step• Multithread• Can receive more that one sample at same time• Decide on which instance must be executed the sample

• Free slot• Specific analysis

• Monitorized the analysis to detected when the analysis end

Page 13: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 14: Merovingio: mislead the malware

Pebhooking

• Published in Phrack #65• Dreg and [Shearer] (me)

• Modify the PEB in the process to exchange real libraries for our libraries

• All dynamic loaded libraries will be hooked

• Only is necessary repair the main IAT

Page 15: Merovingio: mislead the malware

process

InheritedAddressSpaceReadImageFileExecOptionsBeingDebuggedSpareMutantImageBaseAddressLoaderData

PEBLengthInitializedSsHandleInLoadOrderModListInMemoryOrderModListInInitOrderModList Flink…

LoaderData

InLoadOrderModListInMemoryOrderModListInInitOrderModListBaseAddress 7C801000…BaseDllName “kernel32.dll”

LDR_MODULE

InLoadOrderModListInMemoryOrderModListInInitOrderModList…BaseDllName “xxxxxx.dll”

LDR_MODULEInLoadOrderModListInMemoryOrderModListInInitOrderModList…BaseDllName “ntdll.dll”

LDR_MODULE

Pebhooking

Page 16: Merovingio: mislead the malware

process

InheritedAddressSpaceReadImageFileExecOptionsBeingDebuggedSpareMutantImageBaseAddressLoaderData

PEBLengthInitializedSsHandleInLoadOrderModListInMemoryOrderModListInInitOrderModList Flink…

LoaderData

InLoadOrderModListInMemoryOrderModListInInitOrderModListBaseAddress XXXXXXXXXX…BaseDllName “kernel32.dll”

LDR_MODULE

InLoadOrderModListInMemoryOrderModListInInitOrderModListBaseAddress 7C801000…BaseDllName “ph_k32.dll”

LDR_MODULEInLoadOrderModListInMemoryOrderModListInInitOrderModList…BaseDllName “ntdll.dll”

LDR_MODULE

Pebhooking

Page 17: Merovingio: mislead the malware

Pebhooking

• ph_ker32.dll• Export the same functions that kernel32.dll

• We must do a specific dll for each service pack• The functions exported have the same ordinal as

the original function• We can manage any function we want

• Store the return value• Modify params in runtime• Block the execution on any API

Page 18: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 19: Merovingio: mislead the malware

Dorian IA

• It is based on the workflows of neural networks• Set the time on each log received• Analyze the log looking for patterns• Create execution blocks• Try to link the different blocks to create behaviors• Show the results in a new log that is send to the

website• At this moment can learn new behaviors, our aim

is create a real AI

Page 20: Merovingio: mislead the malware

DorianIA

LoadLibraryW|IMM32.DLLCreateFileW | C:\ikkka.exe|0x178CreateFileW|COMCTL32.DLL|0x4CLoadLibraryW|user32.dllWriteFile | 0x178 | 0x22800 | XXXXXXXXXCloseHandle | 0x4CCloseHandle | 0x178

Log from PebHooking

CreateFileW | C:\ikkka.exe | 0x178WriteFile | 0x178 | 0x22800 | XXXXXXXXXXCloseHandle | 0x178

Block

Page 21: Merovingio: mislead the malware

DorianIALoadLibraryW|IMM32.DLLCreateFileW | C:\itself.exe|0x77ReadFile | 0x22800 | XXXXXXXXXCloseHandle | 0x77DeleteFile | C:\autoexec.batCreateFileW | C:\ikkka.exe|0x178CreateFileW|COMCTL32.DLL|0x4CLoadLibraryW|user32.dllWriteFile | 0x178 | 0x22800 | XXXXXXXXXCloseHandle | 0x4CCloseHandle | 0x178

Log from PebHooking

CreateFileW | C:\ikkka.exe | 0x178WriteFile | 0x178 | 0x22800 | XXXXXXXXXXCloseHandle | 0x178

Block

CreateFileW | C:\itself.exe|0x77ReadFile | 0x22800 | XXXXXXXXXCloseHandle | 0x77

Block

• Read itself• Write itself in other file• Similar content: we use ssdeep to compare the information with threshold

95%The sample was copied itself to another path.

DeleteFile | C:\autoexec.batBlock

Page 22: Merovingio: mislead the malware

Index

• Malware Analysis• what else?• state of art• why?

• Merovingio• Sandboxie• Merovingio Agent

• PebHooking• DorianIA• Merovingio Website

Page 23: Merovingio: mislead the malware

Website features

• User management• Able to upload different samples at same time• Hold the history to recover old reports• Able to looking samples for filename or hash

(SHA1)• All the communication with the agent is

transparent to user• Easy to get if any sample if malicious or not,

directly from the history

Page 24: Merovingio: mislead the malware

Merovingio screenshots

Home page / Send samples

Page 25: Merovingio: mislead the malware

Merovingio screenshots

History

Page 26: Merovingio: mislead the malware

Merovingio screenshotsRaw log

Page 27: Merovingio: mislead the malware

Merovingio screenshots

Analysis

Page 28: Merovingio: mislead the malware

Merovingio screenshotsAPI

Page 29: Merovingio: mislead the malware

Merovingio Achievements

• Max. runtime 2 minutes, but the analysis stop when we don’t detect any new behavior

• We can analyze over 20 samples on the same machine (VM or real)

• To grown we need add more RAM memory to allocate more process or add a new machine to get 20 slots more.

• Very cheap (information for 20 analysis):• Only one machine• 4Ghz CPU (4 cores) and 4Gb RAM• We can stop the analysis when the sample finish the

execution.

Page 30: Merovingio: mislead the malware

Merovingio numbers

• 720 samples can be analyzed on each sandbox instance daily

• 14.400 samples using 20 instances on the sandboxie

• Only 1 cheap machine to get this numbers


Misreading to Mislead - Soka Spiritsokaspirit.org/wp-content/uploads/2013/12/5_journey... · 2015-05-27 · Misreading to Mislead KEY POINTS: (1) The Priesthood Takes the Gosho Out

Misreading to Mislead - Soka Spiritsokaspirit.org/wp-content/uploads/2013/12/5_journey... · 2015-05-27 · Misreading to Mislead KEY POINTS: (1) The Priesthood Takes the Gosho Out

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Nutrigenetic Testing: Tests Purchased from Four Web Sites Mislead ...

Nutrigenetic Testing: Tests Purchased from Four Web Sites Mislead ...

How Tax Distribution Tables Mislead

How Tax Distribution Tables Mislead

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Do Firms Mislead Investors by Overstating Earnings Before … · 2017-09-28 · Do Firms Mislead Investors by Overstating Earnings Before Seasoned Equity Offerings? Abstract I examine

Do Firms Mislead Investors by Overstating Earnings Before … · 2017-09-28 · Do Firms Mislead Investors by Overstating Earnings Before Seasoned Equity Offerings? Abstract I examine

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Anatomy of a Malware Attack: The New Malware Ecosystem

Anatomy of a Malware Attack: The New Malware Ecosystem

Designed To Mislead: How Industry Insiders Mislead the Public About the Need for Interior Design Regulation

Designed To Mislead: How Industry Insiders Mislead the Public About the Need for Interior Design Regulation

Using patents to mislead rivals - University of Alberta › ~langinie › papers › patentingdec2003.pdf · Using patents to mislead rivals ... tion first has major advantages over

Using patents to mislead rivals - University of Alberta › ~langinie › papers › patentingdec2003.pdf · Using patents to mislead rivals ... tion first has major advantages over

TEN WAYS TO MISLEAD WITH STATISTICS

TEN WAYS TO MISLEAD WITH STATISTICS

The Ongoing Malware Threat: How Malware Infects Websites and ...

The Ongoing Malware Threat: How Malware Infects Websites and ...

Bush Mislead

Bush Mislead

Using patents to mislead rivals - Iowa State UniversityUsing patents to mislead rivals ... tion first has major advantages over others who file later. ... patenting decision may

Using patents to mislead rivals - Iowa State UniversityUsing patents to mislead rivals ... tion first has major advantages over others who file later. ... patenting decision may

Maps Designed to Persuade and Mislead · PDF fileMaps Designed to Persuade and Mislead ... San Jacinto Battlefield ... in reflecting upon the meanings people ascribe to place

Maps Designed to Persuade and Mislead · PDF fileMaps Designed to Persuade and Mislead ... San Jacinto Battlefield ... in reflecting upon the meanings people ascribe to place

How Language Proficiency Tests Mislead Us About Ability

How Language Proficiency Tests Mislead Us About Ability

When models mislead

When models mislead