Scribd Logo
Upload

Welcome to Scribd!

  • 8 views

    Dynamiic Viet

    Uploaded by

    phamducnhon
    The document discusses various tools and techniques for conducting dynamic malware analysis. It describes Process Monitor, a tool that monitors file system, registry, and process activity in real-time. It also covers Process Hacker for process viewing and debugging, PE Tools for disassembling and analyzing portable executable files, Regshot for comparing registry snapshots before and after malware execution, and Immunity Debugger for debugging malware behavior by setting breakpoints and stepping through processes. The document provides examples of using these tools to extract network activity, memory contents, suspicious strings, and dropped files from malware samples.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Dynamiic Viet

    Uploaded by

    phamducnhon
    8 views46 pages
    The document discusses various tools and techniques for conducting dynamic malware analysis. It describes Process Monitor, a tool that monitors file system, registry, and process activity in real-time. It also covers Process Hacker for process viewing and debugging, PE Tools for disassembling and analyzing portable executable files, Regshot for comparing registry snapshots before and after malware execution, and Immunity Debugger for debugging malware behavior by setting breakpoints and stepping through processes. The document provides examples of using these tools to extract network activity, memory contents, suspicious strings, and dropped files from malware samples.

    Original Title

    Dynamiic_Viet

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses various tools and techniques for conducting dynamic malware analysis. It describes Process Monitor, a tool that monitors file system, registry, and process activity in real-time. It also covers Process Hacker for process viewing and debugging, PE Tools for disassembling and analyzing portable executable files, Regshot for comparing registry snapshots before and after malware execution, and Immunity Debugger for debugging malware behavior by setting breakpoints and stepping through processes. The document provides examples of using these tools to extract network activity, memory contents, suspicious strings, and dropped files from malware samples.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    8 views46 pages

    Dynamiic Viet

    Uploaded by

    phamducnhon
    The document discusses various tools and techniques for conducting dynamic malware analysis. It describes Process Monitor, a tool that monitors file system, registry, and process activity in real-time. It also covers Process Hacker for process viewing and debugging, PE Tools for disassembling and analyzing portable executable files, Regshot for comparing registry snapshots before and after malware execution, and Immunity Debugger for debugging malware behavior by setting breakpoints and stepping through processes. The document provides examples of using these tools to extract network activity, memory contents, suspicious strings, and dropped files from malware samples.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 46

    Dynamic malware analysis

    Parts of dynamic analysis

    Analyze Analyze
    Debug
    environment behavior

    Harder
    IOCs

    network
    registry files
    activities

    autorun processes
    Process monitor

    Process Monitor is an advanced monitoring


    tool for Windows that shows real-time file
    system, Registry and process/thread activity.

    It combines the features of two legacy


    Sysinternals utilities, Filemon and Regmon
    Its uniquely powerful features will make
    Process Monitor a core utility in your system
    troubleshooting and malware hunting toolkit.
    Process monitor

    Run process Set up target Run


    Don’t panic
    monitor process malware.exe
    Process Tree
    Filter
    Filter
    Filter
    Set up excluding
    Save reports
    Practice time

    • Run procmon
    • Set up filter
    • Rename 9e7cf8e27c3c7989b28fcfb1ed7cf28326cac767453dcc329eee3f21b2d9f51a to malware.exe
    • Run it
    • Find following
    • Created processes and their command lines
    • Dropped files
    • Malicious process
    Practice time
    Process hacker

    • Process Hacker is a free and


    open source process viewer.
    This multi-purpose tool will assist
    you with debugging, malware
    detection and system monitoring.
    Process hacker network
    Process hacker memory
    Process hacker strings
    Suspicious strings
    Group-IB TDS Sandbox Qbot Analysis
    Group-IB TDS Sandbox Qbot Analysis
    Group-IB TDS Sandbox Qbot Analysis
    Group-IB TDS Sandbox Qbot Analysis
    PE tools

    PE Tools let you actively research


    PE files and processes. Process
    Viewer and PE files Editor,
    Dumper, Rebuilder, Comparator,
    Analyzer are included. PE Tools is
    an oldschool reverse engineering
    tool with a long history since
    1999.
    Dump regions with PE tools
    Regshot

    Registry compare utility that allows you to quickly take a snapshot of your
    registry and then compare it with a second one - done after doing system
    changes or installing a new software product.

    Create Run Create


    Compare
    1st shot malware 2st shot
    Regshot
    Regshot results
    Immunity Debugger
    Immunity Debugger
    Registers

    Here you can see all the registers of you CPU and
    their values. Top selection makes general purpose
    registers, which contain temporarily values, and
    registers which are used for controlling program
    flow.

    Middle selection contains flag registers, which CPU


    changes when something of importance has
    happened in the program (like an overflow).

    The bottom selection contains registers which are


    used while executing floating point operations.
    Memory Dump

    Dump window shows you


    the hex view of entire
    program. It is divided into
    three columns.
    First column shows the
    address. Second column
    show hex characters
    located at that address.
    In the third column we can
    see ASCII representation
    of hex data.
    CPU Instructions

    Disassembly part is divided into four


    columns.
    In the first column we can see
    memory address.
    Second column shows instruction
    operation code (hex view of instruction)
    located at that address.
    Third column is assembly code.
    Since immunity is dynamic debugger,
    you can double click on any assembly
    instruction and change it.
    And forth column contains comments.
    Immunity debugger tries to guess
    some details about instructions and
    if its successful it will place details in
    the comments. 8
    Follow in Dump
    Stack

    • Memory location at which points ESP


    (stack pointer register) is shown at the top
    of the stack window. It is divided into three
    columns.
    • First column shows the address.
    • Second shows data located at that address.
    • And the third contains comments.
    Executable modules

    This view lists all dll's and


    other executables that are
    being used by the program,
    along with their starting
    address and size, so it is
    useful for getting memory
    layout of program.
    To follow certain module in
    disassembly double click on it.
    Log Data

    All information from


    commands or scripts is
    displayed in the “Log Data”
    view
    Threads

    This view lists all threads that


    are started inside our program,
    along with their starting address
    and status
    Handles

    An application cannot directly


    access object data or the system
    resource that an object represents.
    Instead, an application must obtain
    an object handle, which it can use
    to examine or modify the system
    resource.
    Breakpoints

    Software breakpoint replaces first byte


    of the targeted instruction with int 3
    instruction (opcode 0xCC). Any time
    debugger executes targeted command
    interrupt will be fired up and CPU is going
    to stop execution and transfer control to
    the debugger. After control has been
    transferred to the debugger, it will replace
    int 3 with original byte of instruction.

    You can put software breakpoint in 2 ways:

    Right click on the instruction you wish to


    put breakpoint on, choose Breakpoint
    And Toggle

    Choose instruction you wish to put


    breakpoint on and press F2
    Hot keys

    • Step into instruction - F7


    • Step over instruction - F8
    • Execute till next breakpoint - F9
    • Execute till return - Ctrl+F9
    • Follow expression in view – Ctrl+G
    • Show previous/next instruction - minus/plus (-/+)
    • Follow jump or call - Enter
    • Set EIP – Ctrl+*
    Practice time

    • Open the directory “day2”

    • Open the directory “Lazarus”

    • Try to understand the functionality

    41
    Lazarus Recon Backdoor

    42
    Lazarus Recon Backdoor

    43
    Lazarus Recon Backdoor

    44
    Lazarus Recon Backdoor

    45
    Trifonov Vitalii
    [email protected]

    www.group-ib.ru [email protected] twitter.com/groupib


    blog.group-ib.ru +7 495 984 33 64 facebook.com/group-ib

    You might also like