## 3 Flame
### Flame Analysis
#### 3.1.3 Code Injection  
Flame injects code into running system processes, but the code injection method is different from that of Duqu. In case of Duqu, ZwCreateSection and ZwMapViewOfSection were used to copy code, and LoadLibrary and LoadLibraryEx were used to load a library into running processes. These techniques can easily be detected as the inserted DLLs appear in the PEB's InLoadOrderModuleList, InInitializationOrderModuleList or InMemoryOrderModuleList. In case of Flame, the code injection mechanism is stealthier, and the presence of the code injection cannot be determined by conventional methods such as listing the modules of the corresponding system processes (_i.e._, winlogon, services, explorer). The only trace we found was that certain memory regions are mapped \begin{table}
\begin{tabular}{c l} \hline \hline
**Module** & **Description** \\ \hline \multirow{3}{*}{Beetlejuice} & Enumerates Bluetooth devices around the infected machine. May turn itself into a beacon: announces the computer as a discoverable device and encode the status of the malware in device information using base64. \\ \hline \multirow{3}{*}{Microbe} & Records audio from existing hardware sources. Lists all multimedia devices, stores complete device configuration, tries to select suitable recording device. \\ \hline \multirow{3}{*}{Infectmedia} & Selects one of the methods for infecting media, _i.e._, USB disks. Available \\  & methods: Autorun_infector, Euphoria. \\ \hline \multirow{3}{*}{Autorun_infector} & Creates autorun.inf that contains the malware and starts with a custom “open” command. The same method was used by Stuxnet before it employed the LNK exploit. \\ \hline \multirow{3}{*}{Euphoria} & Creates a “junction point” directory with desktop.ini and target.lnk. \\  & The directory acts as a shortcut for launching Flame. \\ \hline \multirow{3}{*}{Limbo} & Creates backdoor accounts with login “HelpAssistant” on the machines within the network domain if appropriate rights are available. \\ \hline \multirow{3}{*}{Frog} & Infects machines using pre-defined user accounts. The only user account specified in the configuration resource is “HelpAssistant” that is created by the Limbo attack. \\ \hline \multirow{3}{*}{Munch} & HTTP server that responds to /view.php and /wpad.dat requests. \\ \hline \multirow{3}{*}{Snack} & Listens on network interfaces, receives and saves NBNS packets in a log file. Has an option to start only when Munch is started. Collected data is then used for replicating by network. \\ \hline \multirow{3}{*}{Gadget} & Communicates with Snack and Munch, and provides facilities for handling different events that come from those modules. Together with Snack and Munch, implements a replication method that is based on the Windows Update service. \\ \hline \multirow{3}{*}{Boot_dll_loader} & Configuration section that contains the list of all additional modules that should be loaded and started. \\ \hline \multirow{3}{*}{Weasel} & Creates a directory listing of the infected computer. \\ \hline \multirow{3}{*}{Boost} & Creates a list of files using several filename masks. \\ \hline \multirow{3}{*}{Telemetry} & Logging facilities. \\ \hline \multirow{3}{*}{Gator} & When an Internet connection becomes available, it connects to the C\&C servers, downloads new modules, and uploads collected data. \\ \hline \multirow{3}{*}{Security} & Identifies programs that may be hazardous to Flame, _i.e._, anti-virus programs and firewalls. \\ \hline \multirow{3}{*}{Headache} & Attack parameters or properties. \\ \hline \multirow{3}{*}{Bunny Dbquery Driller} & The purpose of these modules was not known at the time of this writing. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The modules of Flame as described by researchers from Kaspersky Lab. with the suspicious READ, WRITE and EXECUTE protection flags.