GREM · Domain 4
In-Depth Malware Analysis
About 25% of the exam
Packers, crypters, protectors
- Packer
- compresses code, stub restores it
- Crypter
- encrypts code, key ships along
- Protector
- adds anti-analysis and virtualization
- Virtualizer
- converts code to custom bytecode
- Stub
- small loader that rebuilds the original
- Original entry point
- where the real code resumes
Compression is reversible without a key; encryption is not, which is why the stub must carry the key
Spotting packed code
- Very few imports beyond a loader pair
- Section entropy far above the rest
- Virtual size much larger than raw size
- Entry point outside the main code section
- Almost no readable strings
- Unusual or vendor branded section names
Unpacking approaches
- Find the stub
- Run to the tail jump
- Locate the entry point
- Dump the process
- Rebuild imports
- Fix the header
- Breakpoint on memory becoming executable
- Watch for the stack returning to its start
- Hardware breakpoints survive memory scanning
- Multi layer packing repeats the whole cycle
Anti-dumping tricks
- Headers erased once the code is mapped
- Stolen instructions kept inside the stub
- Code decrypted only in small windows
- Import table rebuilt on every call
- Checks that memory was not read externally
- Payload never fully present at once
Obfuscation techniques
String level
- Single byte transformations with a constant
- Rotation ciphers and simple substitutions
- Stack built strings assembled at runtime
- Key derived from a hardcoded seed
- Configuration encrypted with a block cipher
Code level
- Control flow flattened into a dispatcher
- Junk instructions between real ones
- Opaque predicates that never change
- Mixed arithmetic and logic identities
- Self modifying code rewriting instructions
Import level
- Functions resolved by hashed names
- Module list walked without the loader
- Direct system call numbers resolved dynamically
- Calls proxied through unrelated wrappers
Obfuscation delays understanding but cannot remove behavior, so let the sample act and watch what it needs
Injection and stealth
- Hollowing
- suspended process image replaced
- Reflective loading
- module maps itself in memory
- Module stomping
- legitimate module overwritten in place
- Side loading
- signed program loads attacker module
- Parent spoofing
- child appears under another process
- Hook installation
- code pulled into other processes
- Kernel driver
- hides objects from user tools
Fileless techniques
- Payload stored inside a registry value
- Assembly loaded straight from a byte array
- Script executed from an encoded argument
- Management subscription triggers on an event
- Scheduled task carries the whole command
- Nothing malicious ever lands on disk
Blinding the defenders
- Scan interface patched in memory
- Event tracing provider disabled
- Script logging turned off in the registry
- Security service windows closed programmatically
- Unhooked copies of system libraries loaded
- Direct system calls bypass user mode hooks
Silence from a telemetry source is itself an indicator, so alert on the absence of expected events
Environment awareness
- Virtual machine drivers and services checked
- Firmware tables queried for vendor strings
- Processor count and memory size compared
- Screen resolution and cursor movement observed
- Installed programs and documents counted
- Uptime and domain membership inspected
Command channel identification
Where configuration hides
- Encrypted block inside a resource
- Structure decrypted only in memory
- Domain generation algorithm seeded by date
- Fallback list of hardcoded addresses
How the channel looks
- Regular interval with deliberate jitter
- Fixed request paths and headers
- Distinctive client handshake fingerprint
- Responses hidden in ordinary looking pages
- Legitimate services used as dead drops
How to confirm
- Simulate the server and watch the request
- Recover the key and decrypt the configuration
- Match the fingerprint across other hosts
- Correlate with proxy and resolver logs
Advanced persistence
- Firmware implants survive reinstallation
- Bootloader modification loads before the system
- Signed driver abused for kernel access
- Multiple layers so removal misses one
- Search order hijack inside a trusted directory
- Credential theft removes the need for malware
Deliverables from deep analysis
- Decrypted configuration and command endpoints
- Unpacked sample for detection engineering
- Rules matching memory rather than the packer
- Behavioral indicators that survive rebuilds
- Capability statement with evidence
- Recommended hunts for the environment
Key artifacts
- Tail jump
- stub handing control to the payload
- Unpacked dump
- memory image saved for analysis
- Rebuilt import table
- makes the dump loadable again
- Configuration blob
- encrypted settings inside the sample
- Mutex name
- unique marker across infections
- Handshake fingerprint
- clusters the family across infrastructure
Know the order
- Detect the packing
- Reach the entry point
- Dump and repair
- Recover configuration
- Confirm the channel
- Publish detections
Unpack first, then everything else gets easier: strings, imports and rules all come from the recovered code
Reference strip: deep analysis
Packing signals
- Tiny import table
- High section entropy
- Virtual size far above raw
- Entry point outside the code
Unpacking moves
- Break on executable allocation
- Watch the stack restore point
- Dump at the entry point
- Rebuild imports and fix headers
Obfuscation names
- Control flow flattening
- Opaque predicates and junk code
- Mixed arithmetic and logic identities
- Hashed import resolution
Stealth catalog
- Hollowing and reflective loading
- Module stomping and side loading
- Parent process spoofing
- Telemetry patching and unhooking
Outputs
- Unpacked sample and configuration
- Memory scanning rules
- Network and host indicators
- Hunting guidance for defenders
Quick exam traps
- Trap: Unpacking a sample always yields a runnable file
- Trap: High entropy alone identifies the packer family
- Trap: A virtualized protector must be fully understood before reporting
- Trap: Fileless malware leaves no forensic evidence
- Trap: Signature rules on the packed file detect the family
- Trap: Direct system calls appear in standard library hooks
- Trap: Removing one persistence mechanism removes the intrusion
cybercertprep.com · original revision sheet written from the public body of knowledge