2

I'm testing malware that built from single EXE file and it doesn't load any other DLLs.

I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and looking in procmon, I can see that it writes values to the registry.

I tried to open the EXE file with IDA Pro 6.8 / OllyDbg, and I can't see any RegSetValue call or even reference (there is no load of Advapi32.dll).

I suspect that there is some hidden code that I can't see in these disassembles.

If there is such hidden code how can I see it? And btw, how EXE can register as COM object at all?

Improve this question
2
  • 1
    When checking the file with procmon, remember you can see the stack backtrace for each API call. This might give you a hint what happens in your executable.
    – Guntram Blohm
    Commented Dec 15, 2015 at 0:04
  • @GuntramBlohm thank you I really forget it! This can be very usefull.
    – nrofis
    Commented Dec 15, 2015 at 8:34

1 Answer 1

Reset to default
2

What you see is probably a "packed/obfuscated" malware. There are many ways to "hide" RegSetValue from static analysis but my best guess is that what you see is Runtime API Address Resolution: "There are two main types of API obfuscation. In the first type, all API function addresses are resolved before the main routine of the program begins. In the second, API function addresses are resolved individually at call-time. You can read more about it from this paper by Symantec. If you want to "see the code" you would have to unpack it first.

For your second question there is a good discussion about it over here.

Improve this answer
3
  • Thank you for your answer, its probably the situation. But what do you mean by "you would have to unpack it first"? How do I unpack it?
    – nrofis
    Commented Dec 14, 2015 at 15:04
  • 1
    @nrofis: See Unpacking Binaries.
    – Jason Geffner
    Commented Dec 14, 2015 at 15:35
  • Its a bit tricky and I will never be able to give you the "right" answer. But since you already said you are working with ollydbg, step slowly into the code, look for functions which neither write file to disk or can be used to inject code to other process. For example writeprocessmemory than try to dump the PE with OllyDumpEx . But again, its a very long shot. If you really want to learn how to deal with malware than I recommend the following book: nostarch.com/malware
    – GelosSnake
    Commented Dec 14, 2015 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.