examples of modern malware
play

Examples of modern malware Malware Analysis Seminar Meeting 7 - PowerPoint PPT Presentation

Jun 09, 2023 •267 likes •703 views

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev Stuxnet (2009) Organization Core a large .dll file 2 encrypted configuration files Dropper component Core in a stub section

  1. Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

  2. Stuxnet (2009)

  3. Organization ● Core ● a large .dll file ● 2 encrypted configuration files ● Dropper component ● Core in a “stub” section ● Core is mapped into memory as a module – Control passed to one of the export functions ● A pointer to the “stub” section is always passed around: ● All components of Stuxnet have access to core, and config files

  6. Bypassing behavior detection ● Bypasses intrusion detection software which monitors LoadLibrary calls ● call LoadLibrary with a special crafted, nonexistent file name – LoadLibrary will fail – Stuxnet hooks Ntdll.dll to monitor these calls

  7. Process injection ● When an export is called Stuxnet injects itself into another process, then calls the export ● Tries to bypass behavior detection ● Extracts a template PE from itself – Large enough so the entry point falls into this template ● Writes template into another process ● Unsuspend ● Core dll file is passed via mapping a shared section

  8. Trusted processes ● Kaspersky KAV (avp.exe) ● Mcafee (Mcshield.exe) ● AntiVir (avguard.exe) ● BitDefender (bdagent.exe) ● Etrust (UmxCfg.exe) ● F-Secure (fsdfwd.exe) ● Symantec (rtvscan.exe) ● Symantec Common Client (ccSvcHst.exe) ● Eset NOD32 (ekrn.exe) ● Trend Pc-Cillin (tmpproxy.exe)

  9. Check for non-bypassable AV ● Scan registry for indication that the following programs are installed ● KAV v6 to v9 ● McAfee ● Trend PcCillin ● Extracts version information of the main image ● Chooses target injection process, or ● Fails infection

  11. Installation

  12. Installation step 2

  13. Load point after reboot ● MrxCls driver ● Signed by a compromised Verisign certificate ● Another version is signed by Jmicron ● Registered as a boot start service ● HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl Set\Services\MRxCls\”ImagePath” = “%System %\drivers\mrxcls.sys” ●

  14. Injection ● MrxCls injects Stuxnet into specific processes ● services.exe, S7tgtopx.exe, CCProjectMgr.exe – %Windir%\inf\oem7A.PNF (main Stuxnet) ● explorer.exe – never injected in the wild

  15. Command and control ● Connects via HTTP (port 80) – www[.]mypremierfutbol[.]com, www[.]todaysfutbol[.]com ● System information is collected by export 28 – Machine and domain name – Siemens Step7 and WinCC

  17. Connection ● Export 29 sends the information ● Injects itself into iexplore.exe, or default browser ● Checks Internet connectivity by contacting – www.windowsupdate.com, www.msn.com ● Payload is ● XOR'ed with 0xFF ● XOR'ed with 31-byte long byte string ● And turned into ASCI-only characters (0x23, 0x12 → 2312) – A way to bypass corporate firewalls ● Payload is sent via data parameter ● www.mypremierfutbol.com/index.php?data=2312...

  19. Backdoor ● Upload and run any code on the infected machine

  20. Rootkit ● Hide exploit files on the removable drives ● MrxNet.sys interposes on the FS chain ● Scans for the file system driver objects – \FileSystem\ntfs, \FileSystem\fastfat, \FileSystem\cdfs ● Inserts itself into driver chain to intercept FS requests – Filters out its files

  21. Propagation ● WinCC hardcoded password ● Network shares ● Print spooler 0-day ● Windows Server Service vulnerability ● Removable drives ● LNK vulnerability

  22. Duqu (October 2011)

  23. Exploit shellcode ● 0-day vulnerability in word ● Two encrypted files: ● Driver ● Installer DLL ● Injects code into services.exe ● Removes itself ● Whipes memory

  24. Installer ● Decrypts 3 files from within itself ● Main .dll ● .sys driver (load point after reboot) ● Installer configuration file – 8-day installation timeframe ● Installer hooks Ntdll.dll like Stuxnet ● Injects itself into appropriate process ● Installs the .sys driver to be loaded on boot ● Main .dll is encrypted and placed into %Wndir%\inf ● It will be decrypted and executed on every boot

  26. Installation ● 3 files are left on disk ● Driver, encrypted main .dll, encrypted main .dll configuration file ● Installation is quite involved ● 7 files are decrypted ● 3 processes are injected into ● ntdll.dll is hooked multiple times ● Only one unencrypted file (load point .sys driver is written to disk)

  27. Load point (JMINET7.SYS) ● Registered driver starts on boot ● Makes sure – no debugger is running – not in the safe mode ● Encryption key for main .dll is in the registry – Also encrypted – Multiplication rolling key scheme ● Injects main .dll into services.exe – Registers a callback on PsSetLoadImageNotifyRoutine – Notification every time DLL or EXE is loaded

  28. Main .dll (NETP191.PNF) ● Checks if the sample is running for less than 30 days ● If no calls clean up routine ● Checks Internet connectivity ● DNS lookup ● Injects itself into one of the processes ● Explorer.exe, IExplore.exe, Firefox.exe, Pccntmon.exe ● Tries to bypass AV products ● Similar to Stuxnet

  29. Payload loader (Resource 302) ● Loads payload into memory and executes it in different ways

  30. Command and Control ● Download and execute files ● In memory or write to disk ● Protocols ● Encapsulated in HTTP over port 80 ● Encapsulated in HTTP over port 80 using a proxy (may be authenticated) ● Directly over port 443 ● Encapsulated in HTTPS over port 443 ● Encapsulated in SMB – Primarily for P2P command and control

  31. Protocols: HTTP & HTTPs ● Repeated GET requests to the server ● Server replies with modules to execute ● To return data Duqu uses POST with a small JPEG

  32. Direct port 433 & named pipes ● Duqu C&C is a reliable transport protocol similar to TCP ● Fragmentation, reordering, duplicate and missing packets ● Sequence and ACK numbers

  33. Direct port 433 & named pipes ● Data is encrypted and compressed ● AES key is hardcoded ● Different with each version ● VI information is exchanged in plain text ● Cookie is unique for every request ● Validated by server and client

  36. Peer-to-peer C&C ● Proxy C&C traffic to the Internet from a secured zone ● Infected computer is configured to connect back ● Connection information of the infecting computer

  37. Downloaded threats ● Info stealer ● Lists of running processes, account details, and domain information ● Drive names and other information, including those of shared drives ● Screenshots ● Network information (interfaces, routing tables, shares list, etc.) ● Key presses ● Open window names ● Enumerated shares ● File exploration on all drives, including removable drives ● Enumeration of computers in the domain through NetServerEnum ● Lifespan extender ● Simpler info stealer

  38. Propagation ● Collect network information ● Download keylogger – Collect password information ● Collect network information ● C&C instructs what to do next ● Copy itself to a network share – Authenticate with the collected password information ● Trigger execution of a file via a scheduled task on infected machine

  39. Flame (October 2011 - now)

  40. Organization ● Well designed cyber-espionage tookit ● Web server ● Database server ● SOCKS proxy, SSH ● LUA script interpreter – LUA is a scripting language designed to be embedded into other applications – Easy way to extend functionality of applicaton ● Some sort of a file system to access resources and scripts

  41. Propagation ● Network shares ● Collected credentials ● Windows print spooler (used by Stuxnet) ● Removable media ● autorun.inf (used by Stuxnet) ● LNK vulnerability (used by Stuxnet)

  42. Information collection ● Screenshots ● Recorded video ● Recorded audio ● Nearby bluetooth devices

  43. Acknowledgements ● W32.Stuxnet Dossier. Nicolas Falliere, Liam O Murchu, and Eric Chien. Symantec Security Response. ● W32.Duqu The precursor to the next Stuxnet. Symantec Security Response.

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 Introduction 2/18 What is Intel SGX? Intel Software Guard Extension (SGX) A vault (enclave) to

353 views • 19 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder

Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder

Sandboxing & Virtualization: Modern Tools for Combating Malware Anup K. Ghosh, PhD Founder anup@invincea.com www.invincea.com Research Professor Center for Secure Information Systems George Mason University May 2010 The User IS the

479 views • 20 slides
Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci (1,2) , Wenke Lee (1,2) , Nick Feamster (1) (1) (2) USENIX NSDI 2010 Malware = Malicious Software Most modern cyber

601 views • 31 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

568 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise

MODERN 1 MODERN 2 MODERN 3 MODERN 4 MODERN A peep at some distant orb has power to raise and purify our thoughts like a strain picture, or a passage from the grander poets. It always does one good. 5 MODERN 6 MODERN 7 MODERN 8

524 views • 24 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
Exam 1 Review Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Format

Exam 1 Review Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Format

Exam 1 Review Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Format Fifty minutes No notes Work alone (copying or sharing answers will result in failing the course) Three questions - Multiple choice - Short

297 views • 18 slides
JReFrameworker: One Year Later ben-holland.com (daedared) jreframeworker.com I Derbycon

JReFrameworker: One Year Later ben-holland.com (daedared) jreframeworker.com I Derbycon

JReFrameworker: One Year Later ben-holland.com (daedared) jreframeworker.com I Derbycon Derbycon 3.0: My first con ever! Loved it. Derbycon 4.0: A Bug or Malware? Catastrophic consequences either way. How would you detect the

627 views • 43 slides
More WordGames Introduction to Java Graphics Check out IntroToJavaGraphics from SVN Review of

More WordGames Introduction to Java Graphics Check out IntroToJavaGraphics from SVN Review of

More WordGames Introduction to Java Graphics Check out IntroToJavaGraphics from SVN Review of WordGames Time to work on the rest of WordGames Basics of Java graphics Follow along in your own Eclipse Youll need the examples

472 views • 11 slides
POLYMORPHISM The same tool can be used in different contexts Example : color selector

POLYMORPHISM The same tool can be used in different contexts Example : color selector

INSTRUMENTAL INTERACTION POLYMORPHISM The same tool can be used in different contexts Example : color selector Change color of: Text Border Background Highlight INSTRUMENTAL INTERACTION POLYMORPHISM

330 views • 11 slides
Fun with symbolic execution Carl Svensson, 27 MSc in Computer Science, KTH Head of

Fun with symbolic execution Carl Svensson, 27 MSc in Computer Science, KTH Head of

Carl Svensson Exploit development and deobfuscation September 13, 2018 SEC-T 2018 Fun with symbolic execution Carl Svensson, 27 MSc in Computer Science, KTH Head of Security, Kry CTF-player, HackingForSoju 1 About me

695 views • 23 slides
MANAGE THE IMPRESSION YOU AND YOUR DISABILITY MAKE DURING THE JOB INTERVIEW Impression

MANAGE THE IMPRESSION YOU AND YOUR DISABILITY MAKE DURING THE JOB INTERVIEW Impression

GET THE JOB MANAGE THE IMPRESSION YOU AND YOUR DISABILITY MAKE DURING THE JOB INTERVIEW Impression management strategies and self disclosure can be used to dispel myths about disability, and strengthen your presentation during the interview.

813 views • 45 slides
Training Objectives Build a short relationship database and understand why it is necessary in

Training Objectives Build a short relationship database and understand why it is necessary in

4/5/2011 Engaging Communities and the Media by Telling Compelling Public Health Stories Webinar April 14, 2011 p , 1:30 PM 3:30 PM Sponsored by: 1 Laurie Call Director Center for Community Capacity Development Illinois Public

162 views • 14 slides
Current Quantum Measurements in . . . Cryptography Algorithm Main Idea of Quantum . . . A

Current Quantum Measurements in . . . Cryptography Algorithm Main Idea of Quantum . . . A

Why Quantum . . . Quantum . . . Remaining Problems . . . Quantum Physics: . . . Current Quantum Measurements in . . . Cryptography Algorithm Main Idea of Quantum . . . A General Family of . . . Is Optimal: A Proof What Do We Want to . . .

818 views • 40 slides

More recommend