Upload File

reversing & malware analysis training part 8 - malware memory forensics

  • Home
  • Technology
  • Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics
26
Practical Reversing III – Malware Memory Forensics Monnappa (m0nna) www.SecurityXploded.com Reverse Engineering & Malware Analysis Training

Upload: securityxploded

Post on 15-May-2015

14.652 views

Category:

Technology


1 download

Report

Tags:

DESCRIPTION

This presentation is part of our Reverse Engineering & Malware Analysis Training program.For more details refer our Security Training pagehttp://securityxploded.com/security-training.php

TRANSCRIPT

Page 1: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Practical Reversing III – Malware Memory Forensics

Monnappa (m0nna)

www.SecurityXploded.com

Reverse Engineering & Malware Analysis Training

http://www.securityxploded.com/
Page 2: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working.

However in no circumstances neither the trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here.

www.SecurityXploded.com

Page 3: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Acknowledgement

Special thanks to null & Garage4Hackers community for their extended support and

cooperation.

Thanks to all the trainers who have devoted their precious time and countless hours to make it

happen.

www.SecurityXploded.com

Page 4: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reversing & Malware Analysis Training

This presentation is part of our Reverse Engineering & Malware Analysis Training

program. Currently it is delivered only during our local meet for FREE of cost.

For complete details of this course, visit our Security Training page.

www.SecurityXploded.com

http://securityxploded.com/security-training.php
Page 5: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Who am I

Monnappa

m0nna

Member of SecurityXploded

Info Security Investigator @ Cisco

Reverse Engineering, Malware Analysis, Memory Forensics

GREM, CEH

Email: [email protected]

www.SecurityXploded.com

Page 6: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Contents

Why Memory Forensics?

Steps in Memory Forensics

Volatility Quick Overview

Volatility help and plugins

Demo

www.SecurityXploded.com

Page 7: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Why Memory Forensics?

Finding and extracting forensic artefacts

Helps in malware analysis

Determining process, network, registry activities

Reconstructing original state of the system

Assists with unpacking, rootkit detection and reverse engineering

www.SecurityXploded.com

Page 8: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Steps in Memory Forensics

Memory acquisition - Dumping the memory of a target machine

- tools: Win32dd/Win64dd, Memoryze, DumpIt, FastDump

- In Virtual machine: Suspend the VM and use .vmem file

Memory analysis - Analyzing the memory dump for forensic artifacts

- tools: Volatility, Memoryze

www.SecurityXploded.com

Page 9: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Volatility Quick Overview

Advanced memory Forensics Framework written in python

Installation details:

- http://code.google.com/p/volatility/wiki/FullInstallation

Use -h or --help option to get list of command-line switches

- example: python vol.py –h

Use -f <filename> and --profile to indicate the memory dump you are analyzing

example: python vol.py -f mem.dmp --profile=WinXPSP3x86

To know the --profile info use below command:example: python vol.py -f mem.dmp imageinfo

www.SecurityXploded.com

http://code.google.com/p/volatility/wiki/FullInstallation
Page 10: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Volatility help and plugins

www.SecurityXploded.com

-h or –help option displays help and available plug-in commands in volatility.

Page 11: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

DEMO

http://youtu.be/YcVusDjnBxw

http://youtu.be/YcVusDjnBxw
Page 12: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Demo-Scenario

Your security device alerts, show malicious http connection to ip address 208.91.197.54 from a source ip 192.168.1.100 on 8th june 2012 at around 13:30hrs...you are asked to investigate and do memory forensics on that machine 192.168.1.100

- To start with, acquire the memory image “infected.dmp” from 192.168.1.100, using memory acquistion tools (win32dd)

command: win32dd.exe /f infected.dmp

- Analyze the memory dump “infected.dmp”

www.SecurityXploded.com

Page 13: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 1 – Start With what you know

www.SecurityXploded.com

Volatility’s connections module shows connection to the malicious ip by pid 1748

Page 14: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 2 – Info about 208.91.197.54

www.SecurityXploded.com

Google search shows 208.91.197.54 associated with malware, probably “spyeye”, we need to confirm that yet.

Page 15: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 3 – Who is Pid 1748?

www.SecurityXploded.com

“psscan” shows pid 1748 belongs to explorer.exe, also two process created during same time reported by security device (i.e june 8th 2012)

Page 16: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 4 – Process handles of explorer.exe

www.SecurityXploded.com

Explorer.exe opens a handle to the B6232F3A9F9.exe, indicating explorer.exe created that process, which might be malicious…focusing on explorer.exe for now.

Page 17: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 5 – apihooks in explorer.exe

www.SecurityXploded.com

apihooks module show, inline api hooks in explorer.exe and jump to an unknown location

Page 18: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 6 – exploring the hooks

www.SecurityXploded.com

Disassembled hooked function (TranslateMessage), shows a short jump and then a long jump to malware location

Page 19: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 7 – Embedded exe in explorer.exe

www.SecurityXploded.com

Printing the bytes show the presence of embedded executable in explorer.exe

Page 20: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 8 – dumping the embedded exe

www.SecurityXploded.com

vaddump dumps the embedded exe from explorer.exe

Page 21: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 9 – virustotal submission

www.SecurityXploded.com

Submission to virustotal, confirms the dumped executable as component of “spyeye”

Page 22: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 10 – Can we get more info?

www.SecurityXploded.com

Strings extracted from the dumped executable, show reference to interesting artifacts (executable and the registry key)

Page 23: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 11 – Printing the registry key

www.SecurityXploded.com

Malware creates registry key to survive the reboot

Page 24: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Step 12 – Finding the malicious exe on infected machine

www.SecurityXploded.com

Finding malicious sample from infected host and virustotal submission confirms spyeye infection

Page 25: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reference

Complete Reference Guide for Reversing & Malware Analysis Training

www.SecurityXploded.com

http://securityxploded.com/malware-analysis-training-reference.php
http://securityxploded.com/malware-analysis-training-reference.php
http://securityxploded.com/malware-analysis-training-reference.php
http://securityxploded.com/malware-analysis-training-reference.php
Page 26: Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Thank You !

www.SecurityXploded.com

http://www.securityxploded.com/

Reversing malware analysis training part5 reverse engineering tools basics

Malware Forensics Field Guide for Linux Systems: Digital Forensics …cdn.ttgtmedia.com/rms/security/Malware Forensics Field... · 2014-09-02 · 164 MALWARE FORENSICS FIELD GUIDE

Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics

Reversing malware analysis training part7 unpackingupx

Reversing and Malware Analysis

Reversing & malware analysis training part 8 malware memory forensics

Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]

Detecting Malware With Memory Forensicshal/Detect_Malware_w_Memory_Forensics.pdfDetecting Malware With Memory Forensics Hal Pomeranz SANS Institute . Why Memory Forensics? Everything

Reversing and Decrypting the Communications of APT Malware (Etumbot)

Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing & malware analysis training part 12 rootkit analysis

Reversing malware analysis training part4 assembly programming basics

Reversing Malware [based on material from the textbook]

Reversing and Malware Analysis Training Articles [2012] . cracking/Reversing... · Reversing and Malware Analysis Training Articles ... Step 1: Start with what you ... Reversing and

Memory Forensics: Collecting & Analyzing Malware Artifacts from … · 2016. 10. 23. · Memory Forensics: Collecting and Analyzing Malware Artifacts from RAM . Volatility Modules

Practical Reversing III – Malware Memory Forensics

© SERG Reverse Engineering (Reversing Malware) Reversing Malware [based on material from the textbook]

Reversing & Malware Analysis Training Part 7 - Unpacking UPX

Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

Reversing & malware analysis training part 11 exploit development advanced

Reversing & Malware Analysis Training Part 4 - Assembly Programming Basics

Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Reversing & malware analysis training part 7 unpacking upx

Practical Reversing IV – Advanced Malware Analysis

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing & malware analysis training part 6 practical reversing (i)

(160820) #fitalk fileless malware forensics

Reversing & malware analysis training part 10 exploit development basics

Reversing malware analysis training part3 windows pefile formatbasics

Advanced malware analysis training session 7 malware memory forensics

Reversing malware analysis training part12 rootkitanalysis

Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute

Reversing malware analysis training part2 introduction to windows internals

Detecting Malware With Memory Forensics - Deer Run

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis