0

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to begin. The professor has mentioned that the best place to start is by taking a snapshot of your initial system setup, running the malware, and then "figuring out what has changed".

My strategy is as follows:

  1. Take a memory backup of my initial VM state.
  2. Set up my VM so that a network connection is available, but doesn't actually connect to the internet.
  3. Run the malware (in a debugger? outside of a debugger?).
  4. ???

This is where I get a little iffy. I am not sure what "checking for changes on the system" entails. Does this mean I need to take a memory dump of the OS state after the malware has run? What should I be looking for within the memory dump? Is there some tool that identifies meaningful changes between my starting state and the state after the malware runs? Do I need to audit the registry keys to see what has been changed? If I know the malware uses the network, should I be running Wireshark?

Ultimately, I am not sure what the most efficient approach is. It is a pretty powerful piece of malware with a lot of functionality and I want to make sure I collect all necessary information upfront so I don't waste time later in the project.

Thank you

  • Go to the Zoo... and watch animals! :-) – perror Mar 28 at 19:54
  • If it’s packed then in order to analyze it you will need to unpack it. In order to do this effectively you will need to determine how it’s packed. You don’t seem to have much experience with analysis and the scope of the question is quite broad, so my advice would be to study malware analysis write ups shared by professionals online to get an insight into their methodology and workflow, as well as looking through a few intro level tutorials. The web is awash with “how to get started with malware analysis”-type material. I’m sure your professor has provided you with a lot of material as well. – julian Mar 29 at 0:21
  • Try to narrow your question down to a specific technical problem, such as help identifying how the binary is packed or finding the original entry point, etc – julian Mar 29 at 0:22
4

I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be dealt with accordingly. However, here are a few steps to make your task safer and easier:

Building a malware lab:

You can follow the full procedure here by Lenny Zelster. In short, it has the following steps:

Understanding our task:

Once your lab is set, let's examine our tasks, from your words:

"checking for changes on the system" & "figuring out what has changed"

Since we are dealing with a Windows based system, we need to ask ourselves what possible system changes can be done by malware and for what purpose. For example, malware is usually looking to achieve some kind of persistency. This is usually done by the following methods:

  • Registry run keys
  • Startup folder
  • Scheduled tasks
  • Service registrations

A much more comprehensive list is available by MITRE ATT&CK here.

In addition, malware usually has some sort of intention, for example stealing cookies, hooking to a web browsers or maybe just wait for a secondary payload or update. If we ignore "Fileless" or "Memory Injections" attacks for the simplicity of this short guide, malware has to leave some file traces on the system. We need to look for files (executable or not) written to the file system.

Getting our hands dirty:

In order to monitor the system changes mentioned above, we can use Sysinternal tools initially developed by Mark Russinovich and now owned by Microsoft.

Tip: it's recommended to read Mark's Windows Internals book for anyone starting with malware analysis.

Being more specific, the tools of the Sysinternals suite you should learn how to use are:

  • Autoruns - execute and note your initial system values.
  • Process Monitor - After you read the manual, create a filter to only follow the malware you are executing. Note any file and registry changes, this will be a really good starting point.
  • Autoruns - execute and note any changes to your system and what new autoruns have been registered.

The guide above should get you to a good starting point for your project.

If you want to cheat

You can skip all this stages and use one of the publicly available malware detonation sandboxes. However, in order to become a reverse engineer or malware analyst you should only use these tools once you have learned the basics and understand what you are actually doing.

  • 1
    This is a fairly comprehensive answer, but I would add RegShot and maybe Sysmon. RegShot is straightforward. You take a snapshot before running a process, a second one after, and then to compare them. If you select "Scan dir" and enter "C:\" in the box, it will also tell you file changes. These are snapshots at the time the buttons are pressed, so may miss files that are dropped and deleted. Use Process Monitor or Sysmon for that info and more. – knowmalware Mar 31 at 23:01
  • I did not want to make his life too easy. With ProcMon he has greater chance of learning. – GelosSnake Apr 1 at 7:02
3

You may consider reading Practical Malware Analysis Book which describes in depth malware analysis process and techniques and contains in depth answers to your questions. Chapter 3 briefly describes tools you may use to monitor changes made by malware.

1

The steps i take when analyzing malware sample are:

  1. check file in cff explorer. (entrypoint section, weird section names, overlay size etc)

  2. open sample in Detect It Easy to see if its packed or not, and if so which packer is used.

  3. unpack it.

  4. Analyze unpacked sample in IDA to see what I'm dealing with.

Of course, you have to make a snapshot of your system before you run your sample. If your goal is "figuring out what has changed" rather than unpacking, checkout process explorer and process monitor from sysinternals suite. Wireshark is also a good habit to run in background.

You could also use online sandboxes for that purpose. checkout https://github.com/rshipp/awesome-malware-analysis

To get unpacking tuts and scripts check https://tuts4you.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.