1

During an analysis, I found the following piece of malware:

   ...
   lea eax, [ebp+ThreadId]
   push eax                   ;lpThreadId
   push ebx                   ;dwCreationFlags
   push [ebp+lpParameter]     ;lpParameter
   push [ebp+lpStartAddress]  ;lpStartAddress
   push ebx                   ;dwStackSize
   push ebx                   ;lpThreadAttributes
   push [ebp+hProcess]        ;hProcess
   call CreateRemoteThread
   ...

What I definitely know

From some previous parts, I know that

xor ebx, ebx -> ebx = NULL or zero

At the address pointed to by lpParameter, the malware stores the address of LoadLibrary. And hProcess is a handle to explorer.exe.

What I want to know

Related to lpStartAddress, I have found the following lines:

  ...
  push ebx
  push [ebp+nSize]
  push offset loc_402B58
  push [ebp+lpStartAddress]
  push [ebp+hProcess] 
  call WriteProcessMemory
  ...

So, this function writes the content of offset loc_402B58 into the region of pages started at lpStartAddress (which was allocated some lines before). Now, when I go to offset loc_402B58, I see the following (note: I use IDA PRO):

loc_402B58:
 push esi
 mov esi, [esp+8]
 lea eax, [esi+14h]
 push eax
 call dword ptr[esi]
 test eax, eax
 mov [esi+10h], eax
 jz short loc_402B80
 lea ecx, [esi+46h]
 push ecx
 push eax
 call dword ptr [esi+4]
 test eax, eax
 jz short_loc402B80
 call eax
 push 0
 call eax                  <----- edited because i have forgotten it
 push 0                    <-----                    ''
 call dword ptr [esi+8]    <-----                    ''

loc_402B80:     
 xor eax, eax
 pop esi
 retn 4

So my question would be:

What does the assembly at loc_402B58 and loc_402B80 ?

  • Can not be said with the limited information given. As you see loc_402B58 access esp+8 which is the parameter given in the CreateRemoteTHread call. So without knowledge of that there is no way of knowing – user45891 Oct 18 '14 at 15:32
  • the parameter given to CreateRemoteThread is the address of the function "LoadLibrary", as I wrote. Or, how can I look which information is at esp+8 ? – user3097712 Oct 18 '14 at 16:57
  • Yes, however I am not sure whether it's only that. Consider line 5 call [esi] which is the call to LoadLibrary(). However on line 3 it accesses the parameter + 0x14 and uses that as the DLL name that is passed to LoadLibrary. – user45891 Oct 18 '14 at 17:02
1

It should also be storing address of GetProcAddress() at <lpparm+4>

it should store a string the name of module at <lpparam+14>

it should store a string the name of proc for getProcAddress at <lpparm+46>

at [esp+8] it accesses the lpparam which was written to the remote process so you may need to find this WriteProcessMemory Also and look at the local Buffer to Know the data ie name of dll and name of Proc

or you may need to attach to the Remote process and Break on Thread CreateEvent and single Step through the BaseThreadStartThunk() Routine in this routine you will notice ebp is Zeored in there and Eax and Ebx holds LpStart and lpParam and that is how lpStart gets Executed

push [ebp+c] lpparam
call [enp+8] lpStart

esi gets the lpparm via mov esi [esp+8] which in your case holds the Address of LoadLibrary as you correctly observed but you have not observed what is at

assuming [esp+8 ] holds 403000 <lpparam>
[[esp+8] + 0 ] [403000] holds Address of LoadLibrary as you observed
[[esp+8] + 4]  [403004] will hold Address of GetProcAddress
[[esp+8] + 14] [403014] will hold a string the dll name
[[esp+8] + 46] [403046] will hold the name of  Proc in the Loaded Dll
[[esp+8] + 10] [403010] gets the Result of LoadLibrary Return in your above snippet

edit

added the annotated snippet for referance

push esi
 mov esi, [esp+8]    <lpparameter> assuming 403000
 lea eax, [esi+14h]  lpparameter+14> should be a string the name of dll 403014
 push eax            push 403014    
 call dword ptr[esi] DWORD [ lpparmeter+0 ] = [403000] = Address Of LoadLib so calling loadlib
 test eax, eax
 mov [esi+10h], eax  [lpparam+10] [403010] store LoadLibResult here
 jz short loc_402B80  failure
 lea ecx, [esi+46h] [403046] = <lpparm+46> again a string name of Proc for GetProcAddress()
 push ecx           processname     
 push eax           HandletoLoadedmod  
 call dword ptr [esi+4]  Must be Address of GetProcAddress from the looks check your code 
capture local buffer when Writing to ProcessMemory or Break on Create new Thread in the RemoteProcess
by attaching a debugger Executing the RemoteDebugge and when a new Thread Create Event is triggered 
single step to find the contents of lpparam
 test eax, eax    
 jz short_loc402B80
 call eax  <calls the  functions that was just getproc'ed>
 push 0
 call 
  • Thank you for your answer. It helps a lot. I complete the lines after the last call instruction because I have forgotten it. So, what the code construct does is to get a handle to a dll and use that handle later for GetProcAddress to retrieve the address of a process from that dll. Okay. – user3097712 Oct 19 '14 at 13:37
  • nitpick not process but proc -------------------------------The term Proc Literally Denotes a Function Address in a Process Space where Process is Term that Denotes a Collection Of threads that are Scheduleable to Execute in a Processor – blabb Oct 20 '14 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.