Problem with analyzing malware

Question

We have a malware that blocks all analytics software in real time.

This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.)

This software examines all items related to the software, including the following: package name,registry,driver

And if there is this softwares, it closes them and avoids re-running.

Developing proprietary software that they can not block is very time consuming and costly.

what's the solution?How can we do our analysis in this situation?

Answer 1

Not much information has been disclosed about the program to be analyzed or its execution environment, so it is difficult to provide specific recommendations or solutions.

If you are in possession of the binary executable you want to analyze then total control over its behavior should be possible. There should also not be any need to develop a bespoke tool just to deal with the anti-analysis techniques implemented by the program.

There are a variety of techniques and strategies one can employ to force a program to behave as one desires and many different tools available that can be used to accomplish this. Some are listed below.

Static binary rewriting

Static binary rewriting is a means by which changes can be made to an executable file on disk, prior to execution. Perhaps some anti-debugging mechanisms can be patched such that they always return a value you desire? Frameworks that offer this capability include syzygy (Windows) and e9patch (Linux).

Syzygy examples:

• Binary rewriting with syzygy, Pt. I
• WinAFL: Statically instrument a binary via syzygy

e9patch examples:

• project readme
• E9AFL: uses E9Patch to insert the AFL instrumentation via static binary rewriting

System call interception

System call interception/hooking can grant significant control over process behavior at runtime without making any changes at all to the executable binary to be analyzed.

On Linux this can be achieved in a variety of ways, such as:

• use of LD_PRELOAD to perform shared library injection/code interposition
• system call emulation via ptrace()
• using an instrumented version of libc.so that intercepts all system calls
• via a loadable kernel module

I'm not very familiar with windows, but Windows' DLL and kernel APIs strike me as more permissive than their Linux analogues. Here are some tools that may be of use for your analysis:

• Detours: used to intercept Win32 APIs calls within an application, such as to add debugging instrumentation
• Cheat Engine (?)

Dynamic Binary Instrumentation

Dynamic binary instrumentation is a method of changing process behavior by modifying its machine code at runtime. Tools such as Pin, Frida, QDBI and DynamoRIO provide this functionality.

Emulation

Emulation allows one to approximate process runtime behavior without directly executing it on the host. QEMU and Qiling are examples of emulators.