Practical Malware Analysis Lab Guide
Uploaded by
sonik sarungalePractical Malware Analysis Lab Guide
Uploaded by
sonik sarungaleCommon questions
Powered by AIThe program in Lab20-01.exe downloads a file from the specified URL http://www.practicalmalwareanalysis.com/cpp.html and stores it as c:\tempdownload.exe on the local system . This behavior indicates that the program's primary function is to act as a downloader, likely facilitating the installation of additional malicious payloads or updates by fetching them from an external server. The reliance on external resources signifies that the program is part of a broader attack framework designed to maintain and disseminate malware flexibly.
In Lab20-02.exe, virtual function calls are used to execute different upload functions for different file types, as demonstrated by the function call at 0x00401349 . This use of polymorphism enables the malware to dynamically choose which file handling and upload routines to execute based on the type of file it is processing, allowing for more flexible and efficient file operations in its data exfiltration process. This design choice reflects an adaptive and sophisticated approach to implementing varied functionality sizes.
The use of HTTP as a command channel in the backdoor allows malware to blend its traffic with normal web traffic, making detection more challenging . Such design complicates traditional network-based intrusion detection systems that differentiate between malicious and benign traffic based on protocol. It also enables remote control over internet-based infrastructure, facilitating command execution, data exfiltration, and system surveying. To mitigate these risks, more sophisticated behavioral analysis of network traffic and anomaly detection mechanisms are required to identify traffic patterns indicative of malware communication channels.
Analysts should consider the possible dual-payload strategy used by malware when adjusting for system architecture, as seen in Lab21-02.exe, which involves different actions for x86 and x64 environments . This includes maintaining access to both 32-bit and 64-bit virtual machines for testing, ensuring that analysis tools are capable of handling variations in file execution paths and behavior, and understanding how the presence of different resource sections might affect the malware's operational strategy. Analysts need to simulate both environments fully and utilize tooling that accurately depicts different execution contexts to uncover the full scope of the malware's capabilities. This requires robust systems for capturing and analyzing resource drops, memory injections, and process manipulations across varied architectures.
The shellcode in Lab19-02.exe communicates with IP address 192.168.200.2 on TCP port 13330 . This communication suggests that the malware authors intend to create a controlled environment for remote interactions, potentially for maintaining a backdoor into the system. Such communication patterns indicate the authors' desire for stealthy access and control, possibly to execute commands or exfiltrate data from the infected system.
The shellcode in Lab19-03.pdf extracts two files encoded within the malicious PDF, writes them to the user's %TEMP% directory as foo.exe and bar.pdf, executes foo.exe, and opens bar.pdf with the default handler . These tasks support the malware's objectives by propagating the execution of additional malicious payloads (foo.exe) and possibly presenting decoy content (bar.pdf) to divert user attention or imply legitimacy, enhancing the malware's persistence and deceit.
The shellcode in Lab19-01.bin is encoded using an alphabetic encoding method where each payload byte is stored in the low nibble of two encoded bytes . This encoding makes the shellcode less likely to be detected by basic signature-based detection systems since the raw payload bytes are obfuscated. Security systems that only search for known byte patterns would likely miss this type of encoding, requiring more advanced analysis techniques to identify the shellcode's presence and purpose.
When run without parameters, the program in Lab21-01.exe exits immediately . This behavior suggests the malware is designed to require specific inputs or conditions to activate its malicious payload, indicating an effort to avoid detection during casual inspections by relying on parameter-based execution. It likely aims to complicate static analysis and reverse engineering by researchers without the right invocation context.
The imports used by Lab20-02.exe, such as FindFirstFile, FindNextFile, InternetOpen, InternetConnect, FtpSetCurrentDirectory, and FtpPutFile, indicate that this malware may conduct searches through the victim's filesystem and upload files to a remote FTP server . This suggests that the malware's primary impact is exfiltrating data, specifically document files, from infected systems to locations controlled by the attackers. These capabilities underscore the potential for significant data breaches, affecting user privacy and organizational confidentiality.
The malware in Lab21-02.exe uses the IsWow64Process function to determine if it is running on an x64 system . Depending on the environment, it performs different actions: on an x86 machine, it drops the X86 resource as Lab21-02.dll and injects it into explorer.exe; on an x64 machine, it drops two files, Lab21-02x.dll and Lab21-02x.exe, from the X64 and X64DLL resources, launching the latter as a 64-bit process to perform DLL injection . These actions demonstrate how the malware adapts its payload and execution tactics based on the detected system architecture, optimizing its efficacy across different platforms.
