THE TAO OF .NET AND POWERSHELL MALWARE ANALYSIS

With the ubiquitous adoption of Microsoft’s . NET and PowerShell frameworks, an ever increasing number of software development and IT ninjas are joining a nascent tradition of professionals leveraging these powerful environments for added effi cacy in their everyday jobs. With a wide array of libraries and cmdlets at their fi ngertips, the need to reinvent the wheel is long forgotten. Of course, malware writers are not far behind – they too have seen the light and are eager to use these convenient tools against us. Whether it’s for everyday ransomware or state-sponsored targeted campaigns, cybercriminals are now emboldened by a new arsenal that enables them to adapt with ease and agility. Are you ready to defend yourself against this emerging threat? It’s time to understand our adversaries’ capabilities. In this paper, we’ll analyse select in-the-wild malware samples, picking apart the inner workings of these dastardly creations. We’ll introduce the cloaking mechanisms adopted by cybercriminals, moving beyond managed code in execution environments to the devious packers, obfuscators and crypters leveraged in conjunction with these powerful frameworks in order to baffl e malware analysts and forensic investigators. Knowing is not enough; we must apply. Willing is not enough; we must do. With a plethora of post exploitation and lateral movement tools created and customized every day in rapid application development environments and high-level programming languages, defending against this kind of pervasive opponent is a full-time job. THE RISE OF . NET AND POWERSHELL MALWARE Gone are the days when a programming-savvy malware writer would lock him/herself up in a dark basement, looking at a glaring screen fi lled with assembly code. A challenge to the status quo has succeeded and now the self-titled cybercrime industry has become a booming business, with criminals all around the world wanting to jump on the bandwagon and get a piece of the action. With a greater availability of high-level programming languages each day, some of which are even taught in high-schooland university-level courses thanks to their simplicity, lots of curious ‘wannabe criminals’ with dubious intentions fi nd themselves surprisingly well equipped to reach into the depths of the Internet and pull out examples of source code and step-by-step tutorials to create their next malicious campaign. Instead of wanting to showcase their technical expertise or intellectual capacity, criminals have adopted proven practices from agile software development and business administration that focus on maximizing profi ts while minimizing the development time and maintenance cost of these dreadful concoctions. In 2002, Microsoft released a game-changing framework that revolutionized the software development industry and unwittingly provided malware writers with an unimaginable arsenal of weapons. While ‘script kiddies’ resorted to builders and automated environments to cobble together variations of already-available malware samples, seasoned malware writers now had access to forums with approachable lessons on how to write fresh pieces of malicious code, all with an eye to the most desirable feature of all: avoiding anti-virus detection for as long as possible. Intended to compete directly with Oracle’s JAVA platform, the . NET framework provided not only a comprehensive library of built-in functions but also an accompanying development environment capable of supporting several high-level programming languages including Microsoft’s soon-to-be-fl agship C# and the evolution of Visual Basic, dubbed VB . NET. Available by default in most Windows installations, the . NET framework has become the de facto standard for software development in Microsoft’s family of operating systems. Moreover, with the 2006 addition of the increasingly powerful PowerShell scripting framework, the interaction between . NET’s supported programming languages and scripting automation has given software developers and system administrators an easy way to interface not only with the operating system but nearly all Microsoft software, ranging from the Offi ce suite to the crown jewel, the SQL Server database engine. Vast amounts of ready-to-use functionality make the combination of . NET and PowerShell a deadly tool in the hands of cybercriminals. The straightforward value is immediate: developing simple yet effective applications to send spam, brute forcing credentials for virtually any service, or creating the next global malicious campaign. The added benefi t: PowerShell being ubiquitously whitelisted due to its importance in everyday Windows system administration and other recurring management activities makes it harder to prevent attacks that are reliant on these deeply ingrained operating system components. With access to a powerful integrated development environment (IDE) such as the newly free Visual Studio, even application lifecycle management and rapid application development practices have become easier and are increasingly adopted by today’s cybercriminals with aspirations of forming part of an organized industry. Clearly defi ned separations between programmers, designers, testers, command-and-control server administrators, and everyone involved in cybercriminal operations translates into maximum effi ciency and, in turn, maximum profi ts. Computer-enabled crime and fraud have become a faithful refl ection of their ‘real-life’ counterparts. With cybercrime gangs stealing millions of dollars from institutions (examples include Carbanak and gangs like the recently apprehended Svpeng), we are witnessing a paradigm shift in computer crime away from the ‘one-man show’ to that of an earnest team effort. On the other side of the table, we fi nd cooperation between private security research companies and law enforcement agencies proving paramount in combating these borderless threats. The evolution in the complexity and quantity of . NET and PowerShell malware is becoming a reality, and as security researchers we need to be ready to fi ght back against these types of threats with the proper tools and knowledge. THE TAO OF . NET AND POWERSHELL MALWARE ANALYSIS PONTIROLI & MARTINEZ 100 VIRUS BULLETIN CONFERENCE SEPTEMBER 2015 Whereas normal PE samples are better analysed using a debugger such as Olly or a disassembler such as IDA Pro, understanding . NET malware samples requires a specifi c set of tools that will make the malware analyst’s life much easier. The availability of free and open-source decompilers and a plethora of tools to help in our analysis tasks means that not only can cybercriminals benefi t from the use of high-level programming languages, but we can benefi t as well. As with any endeavour, building the right toolset means getting prebuilt tools but also being ready to develop our own when needed. What better than to fi ght fi re with fi re, by using Visual Studio, PowerShell and C# in our daily fi ght against malware? Integrating PowerShell with several . NET libraries and DLLs from currently available decompilers such as ILSpy will allow any analyst to create a standardized process that fi ts his needs, enabling quick determination both of the sample’s behaviour and whether it warrants further research. To understand the differences in the analysis of . NET assemblies we’ll need fi rst to briefl y review how the framework works and how a . NET PE is built. We have already seen that cybercriminals have changed their habits to adopt new malware development practices, and as defendants we should adapt our analysis environments too in order to counteract this evolving threat in an effi cient manner. NET FRAMEWORK INTERNALS It was within Microsoft’s original plans to build the . NET Framework with the ambitious goal of providing developers a single platform on which they could build all kinds of applications. In theory, this revolutionary framework was to be supported by a wide range of operating systems outside the Microsoft ecosystem, having an ECMA specifi cation in place so as to aid the development of open-source implementations (e.g. the Mono Project). Even though Microsoft has only recently shared parts of the . NET Framework with the community via the GitHub repository, it’s certainly a step in the right direction when it comes to interoperability and multi-platform support. It’s worth noting that the . NET Framework family also includes two versions for mobile or embedded device use. A reduced version of the framework, . NET Compact Framework, is available on Windows CE platforms, including Windows Mobile devices such as smartphones. Additionally, . NET Micro Framework is targeted at severely resource-constrained devices. Amidst the number of open-sourced . NET related projects, we can fi nd the compiler platform code-named ‘Roslyn’, which provides open-source C# and Visual Basic compilers with rich code analysis APIs. Moreover, the . NET Core platform is made up of several components, including the aforementioned managed compilers, the runtime, the BCL and the application model, such as ASP.NET. The majority of . NET Core platform projects typically use either the MIT or Apache 2 code licences. Some projects license their documentation and other forms of content under Creative Commons Attribution 4.0. The Mono Project is a software platform designed to allow developers to easily create cross-platform applications (Figure 1). It is an open-source implementation of Microsoft’s . NET Framework based on the ECMA standards for C# and the Common Language Runtime. Along with the implementation of the CLR we can also fi nd a cross-platform IDE named MonoDevelop, making a perfect companionship for cross-platform . NET developers. As of Windows XP SP2 (and Windows 2003 server editions), the . NET Framework is included by default in Microsoft operating systems. The inclusion of version 2.0 in Windows XP SP2 paved the way for the availability of newer versions in editions of Windows to follow.