3

I am kind of new in the field of reverse engineering, so sorry if it is a silly question.

I have to analyse some malwares for my bachelor thesis and I am currently trying to reverse engineer a malware called "Dexter" which is a point-of-sale malware.

Now to my question:
After some static analysis I tied to debug Dexter with OllyDbg, but the malware is injecting itself into the iexplore.exe process, and the original process of the malware is terminating itself. How can I debug the injected code in the iexplore.exe process? I know that you can attach OllyDbg to a running process but I can't really find the injected malware code in the memory map.

3

Most of the times when a malware does something like that it's simply to make debugging it harder. Therefore, you can easily breakpoint on the injection procedure and redirect it to another process. Make sure you redirect both the memory writes/injections and the code execution.

Redirecting it to the same process might work, but it may also cause issues. It is probably reasonable to create a dummy process (I often use calc.exe) you created debugged, let the malware inject into that process instead of original target, then BP the injected code and let it run.

You can also debug iexplore.exe if you're interested. You'll need to kill it and then reopen it from within ollydbg.

EDIT: Instead of changing the target process you can do as C0rK1 suggested in his answer, and modify the first two bytes to jmp self (x86/64 bytes are EB FE), and then let the malicous code execute in that loop, suspend the process, place a breakpoint on the jump self loop and replace it with the original code manually. This is another common trick.

  • 1
    I often change the pid to make the malware inject a notepad instance. When you open the process in Olly first, you can set it to stall on thread creation. – Nordwald Mar 12 '17 at 16:13
  • Yes, a lot of guys favor notepad.exe for that. Idk why I use calc but I always did so I'm sticking with it :) – NirIzr Mar 14 '17 at 9:31
1

Most of the time when a malware has injected itself into another process,it will call "SetThreadContext" to set the CONTEXT structure.You can easily get the "oep" of the target process through the "eax" member in the CONTEXT structure.The "oep" stands for the original address when target process resumes,you can make a loop at the "oep" so that the target process will always run in the loop.But how to make a loop in the"oep"?

A malware often call "WriteProcessMemory" to write codes into target process.The second parameter of "WriteProcessMemory" is "lpBaseAddress",it means where this codes begin in the target process.And the third parameter is "lpBuffer",it stands for the buffer contains this codes.

You can easily calculate the offset between "oep" and "lpBaseAddress",then, if the offset>0 as well as the offset< parameter "nSize",add the offset to "lpBuffer",you will get the address contains "oep" codes in the buffer.

For example, the "oep" of target process is 0x401000, the parameter "lpBaseAddress" is 0x400000,the parameter "lpBuffer" is 0x120000,so the address contains "oep" codes in the buffer is 0x401000-0x400000+0x120000=0x121000.

Then,you can change the instructions in the address contains "oep" to "jmp itself"(that is patching the first 2 bytes to EB FE).In the above example it's "jmp 0x121000".After calling "WriteProcessMemory" and "SetThreadContext",you will see codes run in a loop at the "oep" of target process because the instructions are changed to "jmp oep",in the above example it's "jmp 0x401000".the target process "stops".

Now you can attach it with OllyDbg and begin your work!

In some cases malware injects itself into target process using other ways such as Shared Sections, Atombombing.Now you may not find "WriteProcessMemory" in these cases,but you will find malware uses other ways to inject codes.So you can change the entry of codes injected into target process by patching the first 2 bytes to EB FE,the target process will run in a loop the same as what it does in first case.

  • Downvoted because this answer contains wrong facts. There are pleanty of API functions in windows which allow process injection. Interesstingly, new techniques for code injections are still being discovered. For example QueueUserAPC + Shared Sections or Atombombing. Of course, you can also use ntdll functions like NtWriteVirtualMemory and others. – Nordwald Mar 13 '17 at 12:51
  • Please also note that a 'jmp itself' is always archived by patching the first two bytes to EB FE (pretty common) – Nordwald Mar 13 '17 at 13:05
  • It's my fault that I didn't consider other cases such as Atombombing, Shared Section.What I mean is that you can change the entry of codes injecting targeting process to "jmp itself",that is patching the first 2 bytes to EB FE.I think it's easy to do it before injecting,not only when using WriteProcessMemory but also when using other ways. –  C0rK1 Mar 14 '17 at 3:40
  • I don't mean to offend you, I just don't want an answer with some gaps become the highest rated answer. If you adapt it a little, I'll upvote again ;) – Nordwald Mar 14 '17 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.