Dynamic Analysis

What is malware analysis?
andWhat is dynamic analysis?

What is Malware Analysis?
• It is to reveal malware’s behavior combining with the below methods.
• Surface Analysis• Dynamic Analysis (Runtime analysis, Black box analysis)• Static Analysis (White box analysis, Reverse (Code) Engineering, Reversing…)• Terms and definitions are not fixed.
• Sometimes, surface analysis is included in static analysis.

• There is “public source analysis” as well (in other words, googling ;-)).

Copyright Internet Initiative Japan Inc.

3

What is Malware Analysis?
• Each analysis method is related to the others.
In a few seconds to several minutes

Surface Analysis
In a few
minutes toseveral hours

Public Source
Analysis

In a few
minutes toseveral hours

Increase time cost,
but can analyze deeply

Dynamic
Analysis

Static Analysis
In several hours to several months
Copyright Internet Initiative Japan Inc.

4

What is Dynamic Analysis?
• To execute malware and record malware activities with analysis tools,
typically on a closed environment (e.g. virtual machine)• We need to record:• Process Activities• Registry Activities• File Activities• Network Activities (with Internet emulation)• Internet emulation redirects communications from malware to Internet emulation softwareand records host names and/or IP addresses of C2 servers and its contents.
Copyright Internet Initiative Japan Inc.

5

What is Dynamic Analysis?

Copyright Internet Initiative Japan Inc.

6

Copyright Internet Initiative Japan Inc.

7

What is Dynamic Analysis?
• If you do dynamic analysis manually, you
can do it with these tools.
• Virtual Machine environments••••

VMwareVirtualBox
Hyper-V…

• Process activities• Process Explorer• Process Hacker• Process Monitor• File activities• Process Monitor• regshot• Internet Emulation• Fakenet, fakenet-ng• InetSim• Network activities, packet capture• fakenet , fakenet-ng• wireshark• noriben• Sysmon• Registry activities• Process Monitor• regshot
Copyright Internet Initiative Japan Inc.

8

Exercise 1
Dynamic Analysis using Noriben, Procmon,
Fakenet-ng

Exercise 1 (1)• Double-click Fakenet32.exe• Click “yes” when the UAC dialog shows up• Double-click Noriben.py• Click “yes” when the UAC dialog shows up• Double-click kins.exe (Banking Trojan)• Wait for approximately four minutes

Copyright Internet Initiative Japan Inc.

10

Exercise 1 (2)• About four minutes later, if you see suspicious communications on Fakenet-ng window,
then press Ctrl + C and quit Fakenet-ng.

• Press Ctrl + C on Noriben window as well and wait for report creation for a few minutes.
• On the report of Noriben,• Grep activities for “kins.exe”• Grep file names, process names and registry key names related to “kins.exe”• If you need further investigation, you can use these files in Noriben folder.
• PML (raw log data of Procmon)• Timeline report (csv file)• There is a pcap file in Fakenet* folder as well.

Copyright Internet Initiative Japan Inc.

11

Exercise 1 (3)• Load a timeline report from “Noriben” into “glogg”.
• Then type “kins.exe” to collect all “kins.exe” activities.

Copyright Internet Initiative Japan Inc.

12

Exercise 1 (4)• Add the files and reg keys related to “kins.exe”• Then, you can find another activities related to this malware.

The separator is “| (pipe)"

Copyright Internet Initiative Japan Inc.

13

Benign Explorer.exe never modifies registry values formerly created by malware.

Benign Explorer.exe never register a run key to registry
for starting malware automatically when a pc is booted.

Benign Explorer.exe never modifies registry values formerly created by malware.

Copyright Internet Initiative Japan Inc.

14

Exercise 1 (5)• This is a suspicious sign for remote code injection into legitimate and existing
explorer.exe!
• Further investigation, you can find the evidence of remote thread injection from raw procmonlog (.pml file).

Thread ID 3976 is owned by edogo.exe (copied kins)

A “Thread Create” event occurred on Explorer.exe,
but thread ID is 3976 (again, this is owned bymalware, edogo.exe (copied kins)).
This means that edogo.exe (TID:3976) injected
Copyright
Internet
Initiative Japan
Inc. Explorer.exe.
malicious
thread(TID:3184)
into

15

Exercise 1 (6)Summary of malicious activities
Activities

Value

SourceNetwork
activities

URL

https://dimitfruit.com/s186/lkp13.jpg *1

FakenetMethodGETFakenetFileactivities

Create%AppData%\4-6random\4-6random.exe (copied itself)

Noriben/procmon

DeleteItself (original one)

Noriben/procmon

ModifyItself (copied one)

Hash value

Process
activities

CreateItself (copied one)

Noriben/procmon

Threadinjection

Target: Explorer.exe (legitimate and existing process)procmonRegistry
activities

CreateHKCU\Software\Microsoft\4-6random\random
Value: unknown binary *2

Noriben/procmon

CreateHKCU\Software\Microsoft\Windows\CurrentVersion\Run\{GUID}
Value: path_to_itself (copied one)

Noriben/procmon*1: Path does not appear in the actual
proxy log because this malware uses https.
Copyright Internet Initiative Japan Inc.
*2: Actually, this value is encrypted “BaseConfig”.

16

Exercise 1 (7)• We can get various results like the previous slide even if we don’t havecommercial sandboxes. Those free tools we mentioned earlier help us.
• Communications• C2 servers• URL / method …

• File activities• Registry activities• We can do first response using this information.
• E.g. finding other infected machines
Copyright Internet Initiative Japan Inc.

17

Exercise 1 (8)• But sometimes, we may encounter that malware doesn’t work or its
behavior is different between in real PCs and in VMs.
• Possible reasons why a malware may not work properly include:• VM or analysis environment detection• Difference in OSes, hardware, language environments• Time bomb…

Copyright Internet Initiative Japan Inc.

18

The Reason Why Malware Does not Work
• One of the most likely causes of the problem is analysis environment
detection.
• There are many techniques to detect analysis environment.
• VM detection• Detecting backdoor ports (Host-Guest communication)• Detecting differences between real PCs and VMs by executing some specific machine
instructions• Detecting virtual devices (e.g. Motherboard, NIC, HDD) from registry or via COM• Product IDs of OSes
• Detecting process and file names that works only in VM or sandbox environments• Detecting analysis tools• Checking the number of CPUs
• …
Copyright Internet Initiative Japan Inc.

19

Avoiding Analysis Environment Detection (1)• The easiest way against such detections is to execute malware on real machines.
• It’s tough to recover though.

• Recovering real machines can be done by using “FOG” or similar tools.

• The second best is to try multiple analysis environments.

• Because some malware detects only some specific VM environments.
• VMware• KVM• Hyper-V• VirtualBox• …

• However, these are not the perfect solutions for avoiding analysis environment
detection.

• Some malware samples might run okay, but many samples will detect that it is being executedon an analysis environment and quit running.
Copyright Internet Initiative Japan Inc.

20

Avoiding Analysis Environment Detection (2)• We can deal with some VM detection techniques in advance.
• Disabling the backdoor port of VMware• monitor_control.restrict_backdoor = "TRUE"• vmci0.present = "FALSE"• Increasing the number of virtual CPUs to two or more

Copyright Internet Initiative Japan Inc.

21

Avoiding Analysis Environment Detection (3)• We still can deal with such malware even when the solutions
mentioned earlier don’t work .

Copyright Internet Initiative Japan Inc.

22

Avoiding Analysis Environment Detection (4)• The solution is to read Windows APIs which malware use.

Copyright Internet Initiative Japan Inc.

23

Avoiding Analysis Environment Detection (5)• Malware needs to request many important operations to the Windows OS throughAPIs such as below.
• Communications with other hosts• File handling• Registry handling• Process creation• Code injection• Memory management• including reading and writing data from/to memory regions of other processes• Enumerating processes• …

• So, if we understand strategies of malware authors, and if we observe APIs thatthe malware uses, we can figure out the answer why the malware doesn’t work
properly and how to deal with the problems.
Copyright Internet Initiative Japan Inc.

24

Exercise 2
Rewriting API Responses with Debuggers
Avoiding HDD device name detection

Exercise 2 (1)• Next let’s see one of the VM detection techniques.
• First, revert your VM.
• Next, execute “Noriben.py” and “Fakenet-ng”.
• Double-click “gozi_ursnif.exe”.

Copyright Internet Initiative Japan Inc.

26

Exercise 2 (2)• Nothing happens • Quit “Noriben.py” and “Fakenet-ng”.

• Actually, this malware checks HDD names with this API. Let’s check thiswith a debugger!
• SetupDiGetDeviceRegistryPropertyA
BOOL SetupDiGetDeviceRegistryProperty(_In_ HDEVINFO
DeviceInfoSet,_In_ PSP_DEVINFO_DATA DeviceInfoData,_In_ DWORD
Property,_Out_opt_ PDWORD
PropertyRegDataType,_Out_opt_ PBYTE
PropertyBuffer,_In_ DWORD
PropertyBufferSize,_Out_opt_ PDWORD
RequiredSize
Copyright Internet Initiative Japan Inc.
);

27

Exercise 2 (3)• Load “gozi_ursnif.exe” into x32dbg

Copyright Internet Initiative Japan Inc.

28

Exercise 2 (4)• Options -> Preferences• Go to “Events” tab, and check “DLL Load”.

Copyright Internet Initiative Japan Inc.

29

Exercise 2 (5)• Press “F9” several times until you see “setupapi.dll” at the left bottomof the x32dbg window.

• Press “Ctrl + G” and type “SetupDiGetDeviceRegistryPropertyA” in the
text box below. And then click “OK”.

Copyright Internet Initiative Japan Inc.

30

Exercise 2 (6)• Press F2 to set a breakpoint to the head of API.

If you set a breakpoint toan address, the address
turns red

Copyright Internet Initiative Japan Inc.

31

Exercise 2 (7)• Options -> Preferences• Go to “Events” tab again and uncheck “DLL Load”.

Copyright Internet Initiative Japan Inc.

32

Exercise 2 (8)• Then press F9 twice.
• Since the first API call always fails, we need to take a look at the second call.

Copyright Internet Initiative Japan Inc.

33

Exercise 2 (9)• Execute up to ret instruction by pressing “Ctrl+F9”.

You can see the result of the API in
the stack (5th argument, this means“PropertyBuffer”, of the API)
Then, right-click and choose “Follow
DWORD in Dump”

Copyright Internet Initiative Japan Inc.

34

Exercise 2 (10)• Let’s see the second call.
• DeviceInfoData->ClassGuid (The second argument)• {4d36e967-e325-11ce-bfc1-08002be10318}• Hard Disk

• Property (The third argument)• SPDRP_FRIENDLYNAME (0xC)
https://msdn.microsoft.com/en-us/library/windows/h ardware/ff553426(v =vs.85).aspx• PropertyBuffer (The fifth argument) (Post-Call)
Pointer to the GUID “4d36e967-e325-11ce-bfc1-08002be10318” (DiskDrive)
SPDRP_FRIENDLYNAME (0xC)
Copyright Internet Initiative Japan Inc.

35

Exercise 2 (11)• This malware is likely to detect virtual HDD device in your VM
environment.

• How can we deal with this problem?
• We need to rewrite API responses.
Copyright Internet Initiative Japan Inc.

36

Exercise 2 (12)• Replace “PropertyBuffer” with arbitrary characters.

Select this area and press “Ctrl+E”,
then you can edit the buffer.
Note that you need to check “KeepSize” in “Edit data” window.

Copyright Internet Initiative Japan Inc.

37

Exercise 2 (13)• Let’s create a snapshot of your VM.
• And start Noriben and FakeNet.
• Press F9 to execute malware and then process is terminated.
• What happened?
• Let’s take a look at Noriben report and FakeNet log.
• There is no suspicious communication in FakeNet log. But…
Copyright Internet Initiative Japan Inc.

38

Exercise 2 (14)• There are suspicious activities in Noriben report.
• We found a batch file which gozi executed in process activities.

• We also found the file creation of the batch file and an executable file which gozi created.
• Actually, this new executable has the same md5 hash as the original file, so this activity implies copy
itself to another folder.

Copyright Internet Initiative Japan Inc.

39

Exercise 2 (15)• You can find suspicious activities in Noriben report.

• We can also find the file registration which registered by gozi in run key in registry activities.

• These activities are the installation task of the malware.

• We can assume that this malware changes its behavior when the executable is located in a
specific folder.
Copyright Internet Initiative Japan Inc.

40

Exercise 2 (16)• We still have some unclear points:• What is the content of the batch file?
• What API does the malware use to execute the batch file?
• Why this malware doesn’t communicate with C2 servers?

• Revert the VM, and let’s investigate those points.

Copyright Internet Initiative Japan Inc.

41

Exercise 2 (17)• What API does malware use to execute the batch file?
• Typically, we use the following APIs to execute files.
• CreateProcess• ShellExecute, ShellExecuteEx• WinExec• Set breakpoints at APIs below to find this activity.
• CreateProcessA• ShellExecuteA• WinExec• To set break points: use “Ctrl+G” and type API name, and then press F2
Copyright Internet Initiative Japan Inc.

42

Exercise 2 (18)
• What API does malware use to execute the batch file? (Cont.)• If you have finished setting the breakpoints, hit F9.
• If you hit a breakpoint, you can get the detail of this activities.
• If you see the process termination at the left bottom of the x64dbg window, it’s sign that it
was failed.
• Then, revert your VM, and try the following APIs.

• Note that some malware use UNICODE version of API.
• In this case, the last character of API name becomes “W“ instead of “A”.
• E.g. CreateProcessW or ShellExecuteW or ShellExecuteExW• And some malware also might use low layer versions of the APIs.
• E.g. ZwCreateUserProcess or ZwCreateProcess is used instead of CreateProcess*.
Copyright Internet Initiative Japan Inc.

43

Exercise 2 (19)• Actually, we can break at ShellExecuteW!

• Now we can find the batch location.

Copyright Internet Initiative Japan Inc.

44

Exercise 2 (20)• Then we can get the contents of the batch file.

Copyright Internet Initiative Japan Inc.

45

Exercise 2 (21)• The batch file simply executes the first argument, with the second
argument as an argument to the executables specified as the firstargument, on command prompt.

• And you already know the first and the second arguments(from Noriben log).
Copyright Internet Initiative Japan Inc.

46

Exercise 2 (22)• We now have the contents of the batch file.
• And we also have “Run” key of the registry from Noriben report.

• Then we have two strategies here.

• Execute copied gozi with original one as the argument in a debugger.
• The batch file uses this method.

• Execute copied gozi simply in a debugger.

• If the installation task is finished, this method is used because of “Run” key.

• Let’s take 2nd method!
Copyright Internet Initiative Japan Inc.

47

Exercise 2 (23)• Hit F9 until the debugging process is terminated.

• Then load copied gozi into x32dbg.

Copyright Internet Initiative Japan Inc.

48

Exercise 2 (24)• Options -> Preferences• Go to “Events” tab, and check “DLL Load”.

Copyright Internet Initiative Japan Inc.

49

Exercise 2 (25)
• Press “F9” several times until you see “setup.dll” at the left bottom of
the x32dbg window.

• Press “Ctrl + G” and type “SetupDiGetDeviceRegistryPropertyA” in the
text box below. And then click “OK”.

Copyright Internet Initiative Japan Inc.

50

Exercise 2 (26)• Press F2 to set a breakpoint at the head of API.

If you set a breakpoint toan address, the address
turns red

Copyright Internet Initiative Japan Inc.

51

Exercise 2 (27)• Options -> Preferences• Go to “Events” tab again and uncheck “DLL Load”.

• Then press F9 twice.
• The first API call always fails.

Copyright Internet Initiative Japan Inc.

52

Exercise 2 (28)
• Execute until the “ret” instruction by pressing “Ctrl+F9”.
You can see the result of the API in
the stack (the 5th argument, that is“PropertyBuffer”, of the API)
Then, right-click and choose “Follow
DWORD in Dump”

Copyright Internet Initiative Japan Inc.

53

Exercise 2 (29)
• Replace “PropertyBuffer” with arbitrary characters.

Select this area and press “Ctrl+E”,
then you can edit the buffer.
Note that you need to check “KeepSize” in “Edit data” window.

• And then, Hit F9 until the process is terminated, and after taking for a while, you will see suspicious
communications.
Copyright Internet Initiative Japan Inc.

54

Exercise 3
Dealing with the Process Hollowing / PE Reflective
Injection Technique with Debuggers

What is Process Hollowing / PE Reflective Injection?
• Process Hollowing / PE Reflective Injection are kinds of remote code
injection technique.
• A.k.a process replacement or Nebbett’s Shuttle.
• If these techniques are used, almost all API monitoring tools including
APIMonitor can’t monitor the APIs that are used in these techniques. Those
tools cannot set hooks when a target process is created because the process iscreated with the suspended option.
• Even debuggers cannot attach the suspended process at the moment.
• You need to use debuggers with a certain technique!

Copyright Internet Initiative Japan Inc.

56

What is Process Hollowing / PE Reflective Injection?
• How does the Process Hollowing / PE Reflective Injection work?
• First, malware creates Process B (e.g. svchost.exe) using CreateProcess
API with CREATE_SUSPENDED flag
Malware.text (code).data (data).rsrc (resources)

Process B
Create a suspended
process.text (code).data (data).rsrc (resources)

Original PE image…

…
Copyright Internet Initiative Japan Inc.

57

What is Process Hollowing / PE Reflective Injection?
• Second, malware removes original PE image from the memory ofProcess B using ZwUnmapViewOfSection API.
• If PE reflective injection technique is used, then this step is skipped.

Malware.text (code).data (data).rsrc (resources)

Delete PE sections

Process B.text (code).data (data).rsrc (resources)…

…
Copyright Internet Initiative Japan Inc.

Delete original
PE image58

What is Process Hollowing / PE Reflective Injection?
• Next, it copies malicious code and data in malware to Process B using
ZwMapViewOfSection API or VirtualAllocEx and WriteProcessMemory
API.

Malware.text (code).data (data).rsrc (resources)

Copy sections

Process B.text (code).data (data).rsrc (resources)…

…
Copyright Internet Initiative Japan Inc.

Copy malicious
PE image toProcess B

59

What is Process Hollowing / PE Reflective Injection?
• Then it replaces the current entry point in Process B with malware’s
one using GetThreadContext and SetThreadContext API.
• If ZwMapViewOfSection API is used, the malware might replace the legitimate
code at the entry point with the malicious code directly without
SetThreadContext API.
Malware.text (code).data (data).rsrc (resources)

Change theentry point

Process B.text (code).data (data).rsrc (resources)…

…
Copyright Internet Initiative Japan Inc.

60

What is Process Hollowing / PE Reflective Injection?
• Finary, it execute malicious code in process B using ResumeThread API.
• Note that the malicious code is executed with the access rights of the “Process
B”. If the “Process B” is an Internet Explorer, the process can access theInternet because typical personal firewall allows IE to access the Internet
communication.
Process B

Malware.text (code).data (data).rsrc (resources)

Resume the thread.text (code).data (data).rsrc (resources)…

…
Copyright Internet Initiative Japan Inc.

61

Exercise 3 (1)• At this time, we will see another gozi sample that uses the reflective
PE injection.
• Load “gozi_ursnif_201610.exe”.
• This another gozi sample has multiple anti-analysis techniques.

• First, we need to deal with “file handle” issue.
• This malware opens itself using CreateFile API, but this activity is failed onsome debuggers because those debuggers don’t close a file handle ofdebuggee when they finish to load.
Copyright Internet Initiative Japan Inc.

62

Exercise 3 (2)• Some debuggers don’t close debuggee’s file handle.
Debugger

Close

OllyDbg 1.10 / 2.01

OKImmunity Debugger 1.85OKx64dbg / x32dbg (Jan 27 2017)NG

WinDbg 6.2 / 6.3

NG

IDA Pro 6.95 (Local Win32 Debugger)

NG

Copyright Internet Initiative Japan Inc.

63

Exercise 3 (3)• E.g. This sample fails to open itself on x64dbg.

CreateFile returns -1(INVALID_HANDLE_VALUE)

Copyright Internet Initiative Japan Inc.

64

Exercise 3 (4)• How to close debuggee’s file handle forcibly.
• First, start “Process Hacker” and double click on your debugger process.

Copyright Internet Initiative Japan Inc.

65

Exercise 3 (5)• How to close debuggee’s file handle forcibly (cont).
• Click “Handles” tab, and find “File” type and debuggee’s file path, then right click and choose“Close”.
(1)

(2)

(3)

Copyright Internet Initiative Japan Inc.

66

Exercise 3 (6)• Next, we need to deal with Reflective PE Injection.
• Set breakpoint at “SetThreadContext” API andpress “F9” to execute malware.
• For Win7 64 bit users (only for Win7 64 bit users), youneed to set the breakpoint on“Wow64SetThreadContext” or “ZwSetContextThread”
instead.
BOOL WINAPI SetThreadContext(_In_
HANDLE hThread,_In_ const CONTEXT *lpContext);
https://msdn.microsoft.com/jajp/library/windows/desktop/ms680632(v=vs.85).aspx
Copyright Internet Initiative Japan Inc.

> dt _CONTEXT
ntdll!_CONTEXT+0x000 ContextFlags : Uint4B+0x004 Dr0: Uint4B+0x008 Dr1: Uint4B+0x00c Dr2: Uint4B+0x010 Dr3: Uint4B+0x014 Dr6: Uint4B+0x018 Dr7: Uint4B+0x01c FloatSave: _FLOATING_SAVE_AREA+0x08c SegGs: Uint4B+0x090 SegFs: Uint4B+0x094 SegEs: Uint4B+0x098 SegDs: Uint4B+0x09c Edi: Uint4B+0x0a0 Esi: Uint4B+0x0a4 Ebx: Uint4B+0x0a8 Edx: Uint4B+0x0ac Ecx: Uint4B+0x0b0 Eax: Uint4B+0x0b4 Ebp: Uint4B+0x0b8 Eip: Uint4B
67+0x0bc SegCs: Uint4B

Exercise 3 (7)1. After execution, the debugger breaks
on SetThreadContext API.

3. Memorize this value(lpContext + 0xb0 =lpContext->Eax = Entry
point of this malware).

2. Right click on the second
argument (lpContext) andchoose “Follow in DWORD
Dump”.

0x4010e7
Copyright Internet Initiative Japan Inc.

68

Exercise 3 (8)• Execute “Process Hacker” and right click on the child process of
malware and choose “Properties”.

Copyright Internet Initiative Japan Inc.

69

Exercise 3 (8)1. Click “Memory” tab.

2. Double click this memory region.
Note that this memory region needs to include
the value you memorized previously on“SetThreadContext” API.
In this case, the value is 0x4010e7, so thememory region you need to choose is 0x400000.

Copyright Internet Initiative Japan Inc.

70

Exercise 3 (8)2. input “0x10e7“ and click “OK”.

1. Click “Go To…” button.

Copyright Internet Initiative Japan Inc.

71

Exercise 3 (8)1. At “0x401e07”, memorize two bytes“56 33“ and replace those bytes with “EB FE”
which means infinite loop in machine code!

2. Click “Write” button.

3. Click “Close” button.

Copyright Internet Initiative Japan Inc.

72

Exercise 3 (12)• Go back to x32dbg and press F9 to execute malware. Then malware is
terminated. But the child process of the malware raise the CPU rate
because we replaced the first instruction of the target process with an
infinite loop instruction.

Copyright Internet Initiative Japan Inc.

73

Exercise 3 (13)• Attach the child process of the malware.
• From menu bar of OllyDbg / x32dbg, choose “File” -> “Attach” and pick thechild process.

These have the same process ID (268 is equal to 0x10c in hex).

Copyright Internet Initiative Japan Inc.

74

Exercise 3 (14)• When we attach the process, OllyDbg 1.10 might show us the below
popup and can’t resume the thread execution. If you encounter thisissue, use OllyDbg 2.0 or other debuggers (e.g. x32dbg).

Copyright Internet Initiative Japan Inc.

75

Exercise 3 (15)• Hit F9 (execution) and F12 (pause) in a debugger, then you will see theinfinite loop.

Copyright Internet Initiative Japan Inc.

76

Exercise 3 (16)• Then press “Ctrl+E” and restore the original bytes you memorized
previously. ( in this case, “56 33”)

Replace “EB FE” to “56 33”.
Copyright Internet Initiative Japan Inc.

77

Exercise 3 (17)• Now you can debug the malicious code in the target process.

Restored instructions.

Copyright Internet Initiative Japan Inc.

78

Exercise 3 (18)• Press “Ctrl + G” and type “SetupDiGetDeviceRegistryPropertyA” in the
text box below. And then click “OK”.
• Then you can apply Exercise 2 (6) and later.
• But see next slide…

• At Exercise 2 (23), you will need to deal with Reflective PE Injection
again and the file handle technique when you analyze “copied gozi”
again.
• So you need to combine Exercise 2 with this exercise.
Copyright Internet Initiative Japan Inc.

79

Exercise 3 (19)• GetCursorInfo• Actually, this malware sample has another sandbox evasion technique.
• Malware checks mouse movement with GetCursorInfo API.
• If your sandbox system has no mouse activity emulation, this malware nevertakes any action.

Copyright Internet Initiative Japan Inc.

80

Exercise 3 (17)Sandbox Evasion CodeDifference between
last and current mousepositions.bss section decode routine

Copyright Internet Initiative Japan Inc.

81

Exercise 3 (21)• Then you can get suspicious HTTP communications.

Copyright Internet Initiative Japan Inc.

82

Exercise 3 (22)
• Difference between gozi samples Jun/2016 and Oct/2016
Jun/2016…

Oct/2016
Anti Debugger with file handle opening
Process Hollowing itself…

Sandbox Evasion (mouse event)

VM detection (HDD name)

VM detection (HDD name)

Copy and Execute malware with batch file

Copy and Execute malware with batch fileAnti Debugger with file handle opening
Process Hollowing itself (copied one)
Sandbox Evasion (mouse event) (copied one)

VM detection (HDD name) (copied one)

VM detection (HDD name) (copied one)…

…

Copyright Internet Initiative Japan Inc.

83

Detection techniques• Most of VM or sandbox detection techniques are the same old.
• If you know those techniques, you will handle almost all cases.
• Search keyword• Sandbox detection technique• VMdetect technique• …

• Sometimes we might encounter new techniques though.
• http://joe4security.blogspot.jp/2016/10/pafish-for-office-macro.html• References• https://github.com/a0rtega/pafish• http://artemonsecurity.com/vmde.pdf• http://resources.infosecinstitute.com/how-malware-detects-virtualized-environment-and-itscountermeasures-an-overview/
Copyright Internet Initiative Japan Inc.

84

To be continued…