2

I'm testing malware that built from single EXE file and it doesn't load any other DLLs.

I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and looking in procmon, I can see that it writes values to the registry.

I tried to open the EXE file with IDA Pro 6.8 / OllyDbg, and I can't see any RegSetValue call or even reference (there is no load of Advapi32.dll).

I suspect that there is some hidden code that I can't see in these disassembles.

If there is such hidden code how can I see it? And btw, how EXE can register as COM object at all?

  • 1
    When checking the file with procmon, remember you can see the stack backtrace for each API call. This might give you a hint what happens in your executable. – Guntram Blohm Dec 15 '15 at 0:04
  • @GuntramBlohm thank you I really forget it! This can be very usefull. – nrofis Dec 15 '15 at 8:34
2

What you see is probably a "packed/obfuscated" malware. There are many ways to "hide" RegSetValue from static analysis but my best guess is that what you see is Runtime API Address Resolution: "There are two main types of API obfuscation. In the first type, all API function addresses are resolved before the main routine of the program begins. In the second, API function addresses are resolved individually at call-time. You can read more about it from this paper by Symantec. If you want to "see the code" you would have to unpack it first.

For your second question there is a good discussion about it over here.

  • Thank you for your answer, its probably the situation. But what do you mean by "you would have to unpack it first"? How do I unpack it? – nrofis Dec 14 '15 at 15:04
  • 1
    @nrofis: See Unpacking Binaries. – Jason Geffner Dec 14 '15 at 15:35
  • Its a bit tricky and I will never be able to give you the "right" answer. But since you already said you are working with ollydbg, step slowly into the code, look for functions which neither write file to disk or can be used to inject code to other process. For example writeprocessmemory than try to dump the PE with OllyDumpEx . But again, its a very long shot. If you really want to learn how to deal with malware than I recommend the following book: nostarch.com/malware – GelosSnake Dec 14 '15 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.