i am analyzing a piece of malware in which first the address to "KiUserExceptionDispatcher" is obtained(using the Export Name Table, going to Export Ordinal Table and then finally to Export Address Table). Once the address(7773A408) is received, the malware overwrites the first 6 bytes with the following lines :
(here is the finding part)
...
mov BYTE PTR DS:[EDX], 68 -> EDX contains ntdll.KiUserExceptionDispatcher
mov DWORD PTR DS:[EDX+1], malware.004035C2
mov BYTE PTR DS:[EDX+5], 0C3
....
So, the hex window at 7773A408 (address of KiUserExceptionDispatcher) changes in the following way:
7773A408 FC 8B 4C 24 | 04 8B .... (and so on) <- original
7773A408 68 C2 35 40 | 00 C3 .....(and so on) <- after overwriting
So, what happens then is that the malware reaches a "UD2" instruction. I looked it up: it raises an invalid opcode exception. Then the malware jumps to
7773A40D RETN
which then leads me to:
004035C2 DB 8B <- clear, because 004035C2 starts at 7773A40D (hex window)
and then finally to another place where a whole new function begins. So, my question would be: Is it right to assume that the malware tries to change exception handler by overwriting it with 004035C2 to redirect the excetion flow? Why is the exception handler of UD2 the first 6 bytes of KiUserExceptionDispatcher?
best regards,