MazeWalker Enriching static malware analysis and more Yevgeny - - PowerPoint PPT Presentation

▶
mazewalker
SMART_READER_LITE
LIVE PREVIEW

MazeWalker Enriching static malware analysis and more Yevgeny - - PowerPoint PPT Presentation

Aug 20, 2022 102 likes •591 views

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me Malware RE @ Trusteer, IBM, Seculert binary analysis automation sandbox development Now in vEYE Security on software container

slide-1
SLIDE 1

MazeWalker

Enriching static malware analysis and more

Yevgeny Kulakov @p_h_0_e_n_i_x

slide-2
SLIDE 2

About Me

  • Malware RE @ Trusteer, IBM, Seculert
  • binary analysis automation
  • sandbox development
  • Now in vEYE Security on software container problems
slide-3
SLIDE 3

Agenda

  • Malware vs Reverser
  • General idea behind MazeWalker Tool
  • How and What MazeWalker solves
  • Demo
  • Future work
slide-4
SLIDE 4

Malware vs Reverser

Prevent or slowdown manual analysis Make me suffer

slide-5
SLIDE 5

Some examples of annoying behaviour

slide-6
SLIDE 6

Code (un)packing

  • New executable areas introduced
  • Runtime code change
  • Stack-based execution

Sample

Layer 0

Layer 1

Decrypt code

Layer 1

Resolve + Unpack

Payload

slide-7
SLIDE 7

Code (un)packing - PiC

  • Runtime CF change - Indirect Calls & Jumps
slide-8
SLIDE 8

Environment Detection

  • Anti-VMs
  • API based
  • device enumeration
  • api monitoring detection (cuckoobox hooks)
  • ASM based
  • elapsed time diff
slide-9
SLIDE 9

Code dispersion

  • Hard to follow - several debug sessions
  • Attaching debugger may freeze the UI

Sample

  • perational

deployment svchost.exe watchdog explorer.exe CnC, rootkit Kernel Permission Elevation

slide-10
SLIDE 10

Obfuscate at rest

  • Encrypt all the things - cfg, code, etc
  • Obfuscate API calling or resolve it on each API call
  • Own API resolution - use own DLLs copies
  • Abuse asm and mix code with data
slide-11
SLIDE 11

No Run No Fun

slide-12
SLIDE 12

A word on code amount

slide-13
SLIDE 13

There is a lot of code

  • Malware is taken as a serious software project
  • release cycles, test labs, dev teams
  • copy & paste from other malware projects too
slide-14
SLIDE 14

Carberp

slide-15
SLIDE 15

Gozi

slide-16
SLIDE 16

There is a lot of code (cont)

  • Culminates in large codebase over time
  • Takes substantial amount of time to analyze
slide-17
SLIDE 17

Time is Money

both are at most insufficient

slide-18
SLIDE 18

Ideas behind MazeWalker

slide-19
SLIDE 19

MazeWalker - Main Ideas

  • It must save time !!!!
  • Maximize time spent in IDA vs time in Debugger
  • Work with non modified VMs
  • Retrieve all runtime info and push into IDA
  • Help with overall malware understanding
  • dig into asm on an interest - basis
  • enable research focusing
slide-20
SLIDE 20

PinTool IDA Plugin Python Engine

MazeWalker Tool

Memory Track

Code Analysis

Architecture

slide-21
SLIDE 21

Intel’s Pin Framework

  • VM in essence
  • Multi-platform

Pin is a dynamic binary instrumentation framework for the IA-32, x86-64 and MIC instruction-set architectures that enables the creation of dynamic program analysis tools.

  • Callbacks on everything
  • instructions
  • API calls
  • Image loading
  • Threads, Exceptions
  • memory read/writes
slide-22
SLIDE 22
slide-23
SLIDE 23

Code unpacking - memory

  • Rely on allocated page analysis
  • Tracks all executed memory by comparing

executing BBL to older copy

  • detect new PEs
  • identify known (dynamically) loaded DLLs
slide-24
SLIDE 24

Code unpacking - PiC

  • Pin helps to do Call/Jump site analysis
  • Logging call-site <-> target pair
slide-25
SLIDE 25
slide-26
SLIDE 26

System API monitoring

  • Pin’s Routine Objects
  • Harder to detect
  • Configurable
  • API Agnostic monitor interface
  • Scriptable

+

slide-27
SLIDE 27

System APIs - CreateFileW

slide-28
SLIDE 28
slide-29
SLIDE 29

Environment Detection

slide-30
SLIDE 30
slide-31
SLIDE 31

Code dispersion

  • Use scriptable APIs monitoring for code injection tracking
  • this helps Pin to find target process
  • Use Pin’s existing ability to track child processes
slide-32
SLIDE 32

Code dispersion

OpenProcess API

slide-33
SLIDE 33
slide-34
SLIDE 34

Control Flow Graph

With PIN’s BBL callbacks Covers all memory regions Covers across different processes

slide-35
SLIDE 35
slide-36
SLIDE 36

Threads everywhere

All execution metadata is on thread basis

slide-37
SLIDE 37
slide-38
SLIDE 38

Demo

slide-39
SLIDE 39
slide-40
SLIDE 40

Collected Data

slide-41
SLIDE 41

Hierarchy matters

Original IDA Maze Walker Navigate the execution flow

slide-42
SLIDE 42

Hierarchy matters

Wrapped functions get different meaning with context

slide-43
SLIDE 43

Focus

Work on Memory Part Only

slide-44
SLIDE 44

Focus

Focussing on Registry only

slide-45
SLIDE 45

ToDo…

slide-46
SLIDE 46

Further development

  • Stability and Memory consumption reduction
  • Memory dumps consolidation
  • Custom IDA Loader
  • “Maze Walk” in kernel space
  • Implement anti-instrumentation prevention logic
  • Dynamic Binary Instrumentation Frameworks: I know you're there spying on me (ReCon 2012)
slide-47
SLIDE 47

https://github.com/0xPhoeniX/MazeWalker.git

slide-48
SLIDE 48

Thank you!

@p_h_0_e_n_i_x