PV204 Security technologies In-Memory Malware Analysis Vclav Lorenc - - PowerPoint PPT Presentation
PV204 Security technologies In-Memory Malware Analysis Vclav Lorenc Senior Security Analyst, Oracle + NetSuite Agenda Basic intro No assembly required No malware (de)obfuscation magic How does the OS look inside?
PV204 Security technologies
In-Memory Malware Analysis Václav Lorenc Senior Security Analyst, Oracle + NetSuite
Agenda
– No assembly required – No malware (de)obfuscation magic
– Processes and other data structures – How the memory is organized
– What are the important system indicators?
2
| PV204 In-Memory Malware Analysis
Why memory analysis?
– It used to be different in the past
– Easy way how to learn more about the attackers – Malicious binary may only be present in memory
– No binary obfuscation present – the code has to run
3
| PV204 In-Memory Malware Analysis
4
| PV204 In-Memory Malware Analysis
Challenges in Reverse Engineering (RE)
– Plus undocumented instructions (or behavior)
– Exceptions, interrupts, PE manipulations, time checking, ...
– Uncommon behavior of known instructions – Registry detections, HW detections
– The most challenging to overcome, mostly
5
| PV204 In-Memory Malware Analysis
6
| PV204 In-Memory Malware Analysis
PE File Format
7
| PV204 In-Memory Malware Analysis
PDF File Format
‘cause reverse engineering ninjas are busy
8
| PV204 In-Memory Malware Analysis
MEMORY ANALYSIS…
x86/x64 Memory organization
– RAM; what we really have installed
– Separation of logical process memory from the physical – Logical address space > physical (e.g. swap) – Address space shared by several processes, yet separated
– Possible memory organization approaches
9
| PV204 In-Memory Malware Analysis
Segmentation Paging Physical Address
10
| PV204 In-Memory Malware Analysis
11
| PV204 In-Memory Malware Analysis
Win32 Address Space
12
| PV204 In-Memory Malware Analysis
Linux Address Space
Operating System Data Structures
– A lot of ‘metadata’ for important data – Based on C/C++ data structures (see MSDN documentation)
– Another common data structure (not only in OS) – Method for implementing lists in computer memory
– Used for manipulating the structures to hide malicious stuff
13
| PV204 In-Memory Malware Analysis
Double Linked Lists
14
| PV204 In-Memory Malware Analysis
DKOM – Direct Kernel Object Manipulation
– Maintained by kernel – Processes, threads, opened files, memory allocations, …
– Hiding from the sight of the user
– Rootkits need to run on the system – … and need to remain hidden at the same time
– Anti-analysis techniques are known as well
15
| PV204 In-Memory Malware Analysis
Windows Process Structures
16
| PV204 In-Memory Malware Analysis
Interesting OS Structures
17
| PV204 In-Memory Malware Analysis
Memory Pages
– Read/write/executable pages – Helping OS to organize memory efficiently
– Why is it bad?
– Allocating a memory that can be modified (unpacked, decoded, decrypted) and executed. – Used by legitimate processes too (Windows OLE)
18
| PV204 In-Memory Malware Analysis
DLL/Process Injection
19
| PV204 In-Memory Malware Analysis
So that Internet Explorer behaves like a malicious process…
And now something completely…
20
| PV204 In-Memory Malware Analysis
Memory (re)sources
– The most common source for analysis – Easier to obtain from virtualized hosts
– Used by operating systems to allocate more memory then available RAM
– Very limited analysis options
21
| PV204 In-Memory Malware Analysis
22
| PV204 In-Memory Malware Analysis
VM?
Memory Dump Snapshot Clone
Running?
Hibernation File Page File (Swap) Crash Dumps
Got root?
Dumping locally Remote access? Cost / Benefits Tool Footprint FireWire PCI Probes Yes Yes Yes No No No
Memory Acquisition
Memory Acquisition
– VMWare, VirtualBox, … – VirtualBox –dbg –startvm “MalwareVM” (and .pgmphystofile command)
– windd, fastdump, memoryze – Or we can hibernate the system (hiberfil.sys)
– Encase Enterprise, Mandiant Intelligent Response, Access Data FTK
– Unsupported OS (Linux, MacOS; 32bit/64bit) – Swap (portions of memory on drive) – Malware not running inside a virtual machine
23
| PV204 In-Memory Malware Analysis
Memory Acquisition (2)
– Unless you have plenty of money, try to get root/admin access to the host – Better to acquire to external storage (USB, network) – The lower tool’s memory footprint, the better – If you run malware in VM, better have less RAM
24
| PV204 In-Memory Malware Analysis
Memory Acquisition (3)
– Very useful for fast Incident Response – Requires enterprise licenses for the commercial tools – Acquisition is done over network – Agents already in memory, no extra memory demands
– GRR (Google Rapid Response) – Still in development, primarily Incident Response tool – Allows remote memory acquisition
25
| PV204 In-Memory Malware Analysis
Memory Analysis Tools
– Free, available for Windows
– Community Edition available against registration
– Open source, no GUI
– Open source, ‘Volatility done right’, GUI – Google supported (part of GRR agent)
26
| PV204 In-Memory Malware Analysis
Mandiant/FireEye Redline
– Not open-source, though – .NET executable (runs only under Windows)
– Very nice analysis workflow – Perfect for searching for string information – Rates the level of suspiciousness over processes
– Memory analysis not reliable, process rating as well
27
| PV204 In-Memory Malware Analysis
Redline: Start
Redline: Timeline
Redline: Time Wrinkles
HBGary Responder (Pro/CE)
– Very expensive – Yet not very well maintained in the last few years
– .NET written, supports only Windows images
– Digital DNA
– Visual ‘Canvas’ debugger
31
| PV204 In-Memory Malware Analysis
HBGary Responder Pro -- DDNA
– Does the process communicate over TCP/IP? – Does it manipulate with registry? – Did the analysis reveal any known bad stuff (strings, IPs, mutexes?) – Does the process access any other process in the system? – Does it access some system-critical process? – Did the analysis find any evidence of obfuscation? – …
32
| PV204 In-Memory Malware Analysis
Responder Pro: DDNA
Responder Pro: DDNA
Responder Pro: Canvas
Volatility Framework
– GPL licensed
– Available for variety of platforms (Linux, Windows, Mac OS) – Can be automated; many contributed plugins
– Windows, Linux, MacOS, Android – Both 32-bit and 64-bit versions
Google Rekall
– Included as a part of GRR (Google Rapid Response) agent
– Shared commands – Different architectural concepts
– Better workflows
37
| PV204 In-Memory Malware Analysis
Additional Important Tools
– Both *nix and Windows – Extracts strings information from the file – Can be used in cooperation with Volatility/Rekall – Beware of text encoding! (ascii, utf-8, …)
– Forensic tool – Can extract various data files from an image (or process)
38
| PV204 In-Memory Malware Analysis
Forensic analysis of RAM?
– Executable images – PDF/Doc documents
– Images – URLs
– Works better on servers (always online, higher uptime, way more RAM)
39
| PV204 In-Memory Malware Analysis
What to search for in Operating System?
40
| PV204 In-Memory Malware Analysis
Known Bad Mutexes
41
| PV204 In-Memory Malware Analysis
Known Good Processes/Locations
Process Name Expected Path lsass.exe \windows\system32 services.exe \windows\system32 csrss.exe \windows\system32 explorer.exe \windows spoolsv.exe \windows\system32 smss.exe \windows\system32 svchost.exe \windows\system32 iexplore.exe \program files \program files (x86) winlogon.exe \windows\system32
42
| PV204 In-Memory Malware Analysis
Operational Security (OpSec)
– “Think before you act” mentality – Limited information sharing
– You can often upload dumped executables to VirusTotal
– However, incomplete binaries still can infect your system!
43
| PV204 In-Memory Malware Analysis
Recommended Analysis Process
– What OS is being analyzed? (imageinfo) – Network connections? (+ whois records, …) – Processes (hidden, odd, non-standard; timestamps, …) – Mutexes (+ files open) – Dump processes when needed (OpSec!) – Strings (URIs, C-like strings %s %d, domains, …)
44
| PV204 In-Memory Malware Analysis
More information
– https://dior.ics.muni.cz/~valor/pv204/
– Public memory images for analysis – Reverse Engineering for Beginners (amazing PDF doc) – REMnux: All you need to start with RE – ContagioDump blog (for additional malware samples)
45
| PV204 In-Memory Malware Analysis
Answers & Questions Thank you for your attention.
46
| PV204 In-Memory Malware Analysis
LAB
47
| PV204 In-Memory Malware Analysis
Lab Requirements
– And enough space on your hard drive (12 GB at least)
– strings, foremost
48
| PV204 In-Memory Malware Analysis
Recommended Analysis Process
– What OS is being analyzed? – Network connections? (+ whois records, …) – Processes (hidden, odd, non-standard; timestamps, …) – Mutexes (+ files open) – Strings (URIs, C-like strings %s %d, domains, …) – …
49
| PV204 In-Memory Malware Analysis
Volatility Framework – cheat sheet
50
| PV204 In-Memory Malware Analysis
Analysis: xp-infected.vmem
– Volatility, Rekall (or Redline)
– Get familiar with memory of your first infected system
51
| PV204 In-Memory Malware Analysis
Analysis: win7_x64.vmem
– Volatility, Rekall (or Redline)
– Get familiar with memory of Win7 x64 system – Can you see any differences from the previous sample?
52
| PV204 In-Memory Malware Analysis
Analysis: zeus.vmem
– Volatility, Rekall
– Find suspicious network connections – Find process responsible for the network activity – Can you figure out what infections this
53
| PV204 In-Memory Malware Analysis
Analysis: zeus2x4.vmem
– Volatility, Rekall
– Find suspicious network connections – Find process responsible for the network activity – Can you figure out what infections this – Can you dump the virus configuration?
54
| PV204 In-Memory Malware Analysis
Analysis: bob.vmem
– Volatility, Rekall, Foremost, Strings
– Find suspicious network connections – Find process responsible for the network activity – Can you figure out what caused the infection? – Can you dump the initial source vector? – What known vulnerability (CVE) has been exploited?
55
| PV204 In-Memory Malware Analysis
More information
– https://dior.ics.muni.cz/~valor/pv204/
– Public memory images for analysis – Reverse Engineering for Beginners (amazing PDF doc) – REMnux: All you need to start with RE – ContagioDump blog (for additional malware samples)
56
| PV204 In-Memory Malware Analysis
Answers & Questions Thank you for your attention.
57
| PV204 In-Memory Malware Analysis