Debugging malware that will only run as a service

Question

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like configuring or install under a different name.

I'm trying to catch the network communications the malware is sending and receiving as soon as it starts as a service. If I attach to a running service/process with Immunity it already has sent the network packets and received, and I've missed what it has done with them. If I try to start it any other way I get the following error: ERROR_FAILED_SERVICE_CONTROLLER_CONNECT (00000427).

Is there another way to go about this? Or some workaround? I'm fairly new to this so I certainly be missing some obvious.

Answer 1

You can use the Image File Execution Options registry key to specify a debugger which will be launched automatically when the executable starts.

You can also always do the ancient trick of patching an endless loop (EB FE) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.

Answer 2

It sounds like you are talking about Windows Services. In which case I am not sure how to debug those. Perhaps you can figure out how to make it revert to being a normal app but then again that may not be possible.

I think this will solve your packet monitoring problem though. It allows you to monitor packets per process unlike WireShark. SmartSniff should also be able to do this job. Not sure but you might have to add the process column as it might not be displayed by default.

MicroSoft Network Monitor should in theory be the best since it will be most integrated with the OS. And have access to more information a more portable tool like Wireshark would not.

Answer 3

Several great answers here, and the one posted by Igor is perfect for debugging the service before it actually starts. One piece of insight I would like to contribute is looking into the malware to see if there are any threads that are created that hold the functionality you wish to review.

Oftentimes in my analysis, I've dealt with malware that runs as a service, but rather than go through some of the hoops you need to go through to launch a debugger when the service is invoked, I often have luck looking at the malware for a main thread that is spun off after initial criteria for the service startup is handled. Once I find the 'main', thread (assuming it exists and is standalone) I will just load the DLL/EXE in Olly, set my new origin on the thread start and proceed on with my debugging.

End of day, its really just a different approach, but something to possibly consider if the situation presents itself.

Answer 4

I would like to separate questions here:

1. How to debug service: answer of Igor is covering it. In basic - You may use any debugger, that You familiar with.

2. How to capture network traffic of malware (that run as a service): answer of cb88 is covering it. Any network sniffer able to capture communications of services. To capture traffic from service start:

• stop service

• enable network sniffer

• start service