- Practice the use of user mode WinDbg for inspecting process in non-invasive mode
- Practice the use of IMM and WinDbg for data analysis
- Understand registry operations
- Understand file operations at multiple levels
- Understand the high level network operations
- Practice the general unpacking technique and searching for the decoding key
- Operating Systems
- Assembly Language
- Operating System Security
In this section, we go back to the analysis of lz32.dll and finish the rest of it. We will see a wide variety of malicious operations performed by the malicious lz32.dll injected by Max++, including disk formatting of the hidden drive, generation of network payload and configuration, unpacking of code segment, and infection of other system library files.
Our analysis will be mostly performed in the address range 0x3Cxxxx, and for some part we will have to dig into the raspppoe.sys again. We start the analysis from the address 0x3C1B3E. Follow the instructions below.
2. Lab Configuration
We could simply reuse the lab configuration of Tutorial 20. In general, you need two windows XP instances, one for taking notes and the other for running the malware. Also you need a WinDbg instance sitting on the host to debug the win_debug instance. Specifically, in the win_debug instance, you need to set a breakpoint at 0x3C1B3E. This is the place right before the call of loadDriver("raspppoe.sys"), as shown in Figure 1 below.
Figure 1. Code of Lz32.dll after zwLoadDriver |
3. Clean Up Operations
Recall that at 0x3C1B3F, max++ (at lz32.dll) calls zwLoadDriver to load rasppoe.sys. The behavior of rasppoe.sys is explained in the Tutorials 20 to 25. Now lz32.dll has to perform some clean up operations to further hide the trail of the malware. At 0x003C1B48 (see the first highlighted area of Figure 1), it closes the file handle of raspppoe.sys, and then from 0x3C1B55 to 0x3C1B3B, there is a loop which resumes a collection of threads one by one. This is actually to re-enable the windows file protection service.
Challenge 1. Use data tracing/breakpoint technique to prove that the loop from 0x3C1B55 to 0x3C1B3B is to re-enable the windows file protection service.
Note that major responsibility of the infected rasspppoe.sys is to set up the I/O handler for disk operations and also the infection of TDI (TCP/IP) service stack. Many services in raspppoe.sys are delayed for 15 seconds using deferred procedure call or delayed timer on system thread, because they need the further configuration done in lz32.dll. We now present the details.
4. Creation of Virtual Drive
The first interesting part of the code is the creation of a virtual drive. The code is shown in Figure 2. It consists of four steps: it first loads the "fmifs" library, and then it gets the procedure address of "FormatEx", and then it calls the function to format the drive. If you look at the stack content, you will notice the name of the drive is "C2CAD...". Once everything is done, it unloads the library.
Figure 2. Create Virtual Drive \??\C2CAD... |
5. Storing Malicious File in Hidden Drive
The next action performed by Max++ is to save the infected driver file raspppoe.sys into the newly created hidden drive. The details is shown in Figure 3.
Figure 3. Store Malicious raspppoe.sys file into Hidden Drive. file name: snifer67 |
Challenge 1. Prove that the section object used in the MapviewOfSection call at 0x3C2000 is the one for raspppoe.sys (infected driver).
Challenge 2. Find out when the snifer67 file in the hidden drive is used.
6.Configuration File
The next function to analyze is 0x3C2162. Figure 4 shows its function body. Its main job is to create the configuration file used by the TDI_SEND activities introduced in section 5 of Tutorial 25.
Figure 4. Writing IP/domain names of malicious servers |
As shown in Figure 4, Max++ loads and encodes several strings such as<ip>85.17.239.212</ip> and <host>intensivedive.com</host>. It's your job to find out all the malicious servers saved to the configuration file.
Challenge 3. Analyze the function at 0x003C20E0. What are its input parameters?
Challenge 4. Identify all the IP addresses and domain names saved into the configuration file in hidden drive.
Challenge 5. Find the name of the configuration file.
7. Saving Decoding Key in Registry
The next action Max++ performs is to save the "decoding key" which is used for self-packing into registry. Figure 5 shows the code.
Figure 5. Saving Decoding Key |
As shown in Figure 5, the decoding key is "1100100", which is retrieved from the PE header of Max+++downloader2010.exe and it is used in decoding/unpacking the code. Max++ creates a registry key in IE explorer and saves the value there.
Challenge 6. Prove that the key 11001800 is from the PE header of Max++.
Challenge 7. Find out where the key is used.
8. Creating HTTP Request
Max++ proceeds to function 3C220A, which creates the HTTP request header for downloading more malicious files. Figure 6 shows its contents. The highlighted area in Figure 6 shows the HTTP request header. It is basically to invoke /install/setup.ppc.php on intensivedive.com.
Figure 6. Creating HTTP Request Header |
9.Creation of Malicious File max++.00.x86
Next we analyze the function located at 0x3C16b8. Figure 7 shows its contents. It first opens the ntdll file and reads its basic file information. Then it creates a file called max++.00.x86 in the hidden drive. The file uses the same configuration (basic file information) of ntdll.
Challenge 8. Observe the function call at 0x3C16CD (in Figure 7). It creates a decoding table. Where does the decoding table start and end?
Figure 7. First Part of 0x3c16b8 |
Figure 8 shows the rest of the function. It establishes the contents of max++.00.x86. The first action is to allocate a virtual memory of 0x8000 bytes (see the highlighted area in Figure 7). Then it first establishes a decoding table in the stack (in range of 0x12D3XX). Then using this decoding table, Max++ first copies the encrypted code from 0x3C2550 to 0x380000 and deciphers the information via multiple passes of decryption. Finally it writes all the contents into max++.00.x86. The file will be later loaded by another system driver.
Figure 8. Establish file max++.00.x86 |
10. Contact Malicious Server
Next Max++ contacts the malicious server, as shown in Figure 9. It constructs a winsock and connects to 85.17.239.212 and send a HTTP request to it. Notice that the interesting part is the encoding key "11001800" is embedded in the HTTP request (see the memory dump part of Figure 9). The function does not have a receive operation though. It seems to just inform the malicious server that the infection of Max++ is successful.
Figure 9. Send Traffic to intensivedive |
Being able to share the sample?
ReplyDeleteDr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download Now
Delete>>>>> Download Full
Dr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download LINK
>>>>> Download Now
Dr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download Full
>>>>> Download LINK m7
informative post. Thanks for sharing.
ReplyDeleteBlueHost is definitely the best hosting provider with plans for any hosting requirements.
ReplyDeleteThanks for sharing, very informative blog.
ReplyDeleteReverseEngineering
For those seeking Custom Nursing Essay Writing Service that are 100% original we have plagiarism software that the company utilizes to confirm the level of originality even when offering nursing case study writing services.
ReplyDeleteNice blog!!!!!!!.
ReplyDeleteReverseEngineering
It is very important to note that sleep performs a biological function that is fundamental to the human body, especially in teenagers more than in children and adults. So should school start later essay can debunk all misconseptions in this issues.
ReplyDeleteWanna know how to write a movie critique? In this movie critique example you can see how to do it right and what to mentions in this type of writing.
ReplyDeleteRaipur Model Escorts | Cheap Raipur Escorts | Raipur Independent Escorts | Escorts Girls in Raipur | Raipur Escorts Girls
ReplyDeletePackers and Movers in Firozabad
ReplyDeletePackers and Movers in Fatehpur
Packers and Movers in Farrukhabad
Packers and Movers in Etawah
Packers and Movers in Etah
http://www.igetsolutions.in/packers-and-movers-indore
ReplyDeletehttp://www.igetsolutions.in/packers-and-movers-surat
http://www.igetsolutions.in/packers-and-movers-alwar
http://www.igetsolutions.in/packers-and-movers-ajmer
http://www.igetsolutions.in/packers-and-movers-mangalore
https://latestcracked.com/abbyy-finereader-full-download-here/
ReplyDeleteABBYY FineReader Serial Keygen maintains all original languages, also admits graphs and tables with much larger precision. Shows amazing comprehension precision and variability of maintaining the partitioning of all origin records.
https://fixedcrack.com/4k-video-downloader-free-download/
ReplyDelete4K Video Downloader Patch model can be a wonderful tool for video and audio documents instantly. It stops an individual from files that are corrupted. The downloaded data files comprise high-resolution. While adequate audio excellent. Moreover, the online video Downloader has distinct languages to satisfy the wants.
https://activatorscrack.com/usbfix-full-cracked/
ReplyDeleteUsbFix Registration Code is super easy to use. It had been created based on a fascinating menu, where the minimalism of patterns and numerous, clear colors and design are somewhat bitten.
https://greencracks.com/lucky-patcher-latest/
ReplyDeleteLucky Patcher APK is the best android app and patches any apps or games. it is the most popular rooted apps. it can block ads and remove unwanted system app. You Can Control easily installed apps on your Android Phone using by Patcher rooted app.
https://crackedhere.com/magix-music-maker-torrrents/
ReplyDeleteMagix Music Maker Crack is a very powerful and amazing software for music makers, in order to create and control projects without inconvenience, in a user-friendly environment. Great recordings are now able to be achieved even more quickly helping you to capture your opinions before the motivation slips away.
https://activatorskey.com/flixgrab-premium-crack-plus-license-key/
ReplyDeleteFlixGrab Crack is an effective program for totally installing net FLIX series. It helps to download TV shows, films, and music. The users can install all documents with quick speed. The users can install any film from net FLIX, and enjoy it offline. You can load your download list from a file, and then start to install it.
https://approvedcrack.com/clip-studio-paint-ex-crack-torrent/
ReplyDeleteClip Studio Paint EX Crack s a part of software application. It a manga studio marketed in North America. It is known as Kurisu in japan. It’s a software application for windows and macOS. It’s developed by celsius. It’s a graphics company of Japanese. Clip Studio is a software company.
https://thinkcrack.com/clip-studio-paint-torrent-crack/
ReplyDeleteClip Studio Paint Crack software is known in Japan in Kurita. macOS, Microsoft Windows, and software for iOS applications are included in it, and Celsus’s creat from the graphic software company of Japan. It is used to create a digital comic.
https://crackeypc.com/device-doctor-license-key/
ReplyDeleteDevice Doctor Crack is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.
All matters related to medical laboratory and simple procedures People are performing a huge amount of tests daily basis on several labs world wide. but you can have all the test procedure, reporting etc here.
ReplyDeleteBlood Grouping Principle and Procedure
Hey guys! I want to thanks to all of you! Firstly to thr arthour of that wonderful blog and of course to the guys-readers of that blog! Really informative article which will be a great addition to my paper pre written to me by the group of professional writers from cheap-papers service the link to which is that one https://cheap-papers.com/buy-presentation-completed-by-experts.php so you can use their help in order to receive only the highest grades
ReplyDeleteexcellent publish, very informative. I wonder why the other specialists of this sector do not notice this.
ReplyDeleteYou must continue your writing. I’m confident, you’ve a
great readers’ base already!
Here is the Link of Free & Latest Multimedia crack:
https://softserialskey.com/cyberlink-powerdirector-ultimate-crack/
It offers a great combination of advanced functionality and great features for video editing.
It’s very simple and easy to use, so creators of every skill level can easily access its great features.
Find Latest Job Vacancies In Noida, Delhi For Freshers And Experienced. Filter Job Opportunities By Salary, Experience, Industry, Company Etc ...
ReplyDeleteHOW TO SETUP HP ENVY 7155 TO WIFI, introduce and design simple strides to interface printers, wireless setup , driver introduce, streaming gadgets, information recuperation, email arrangement and pc rules.
ReplyDeleteGreat Article
ReplyDeleteCyber Security Projects
Networking Security Projects
JavaScript Training in Chennai
JavaScript Training in Chennai
The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training
Lahore Smart City is going to be the best choice for commercial, investment and residential point of view. The scheme will have everything to attract national and international investors. In return, investors will get high revenue. On the other hand, the housing society is equipped with state of the art facilities. The facilities are just dream of come true for the people of Lahore. Peace, safety and eco-friendly behaviors. Future Development Holding hires and corporate’s with world-class developers, architectures and planners. This Smart City Lahore will have golf clubs and fields designed by experienced and world-recognized designers.
ReplyDeleterussian escorts in andheri
ReplyDeleterussian andheri escorts
Tyre Service Dubai
ReplyDeleteBest Tyre Shop Dubai
Waterjet Mosaic supplier
ReplyDeletemosaic glass supplier
Iobit keygen protected folder Keep your data and files private in the program. The only way to get this information is your password. You no longer have to worry about losing privacy.
ReplyDeleteDownload the latest Cracks with CracCOol website
ReplyDeletepatch, Serial Key, License Key and Keygen Full Free
Then again, the housing society is prepared with state of the art facilities. the facilities are simply dream of come actual for the humans of lahore. peace, protection and green behaviors. future development conserving hires and company’s with world-magnificence developers, architectures and planners. knitted ponte de roma fabrics manufacturers | knitted jacquard fabrics manufacturers
ReplyDeleteGreat web site. A lot of useful information here. I’m sending it to several friends ans also sharing in delicious. And obviously, thanks in your effort! 야설
ReplyDeleteAlso visit my web site;
야설
Very good information. Lucky me I recently found your website by accident I have book marked it for later!
ReplyDelete일본야동
Also visit my web site 일본야동
This blog is very informative the stuff you provide I really enjoyed reading 국산야동
ReplyDeleteAlso visit my web site 국산야동
I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well. 일본야동
ReplyDeleteAlso visit my web site 일본야동
I have read your blog it is very helpful for me. I want to say thanks to you. I have bookmark your site for future updates.
ReplyDelete야설
Also visit my web site 야설
Security is the main aspect of computer. Different viruses and hackers attack on your computer. You discus rootkit configuration in detail. All the key points are informative. Due to some condition garage door could be broken. For this solution garage door repair Springfield provide best services.
ReplyDeleteThank you for sharing informative information. You deliver theoretical and practical work and out rootkit configuration. This post is very helpful for me. Moreover, Roofing Services Quincy MA provide the quality work at affordable price. Our expert team fulfill your desire requirements.
ReplyDeleteAmazing article mate, an everything contemplated befuddling article. I've end up being your fan happening to investigating your befuddling article. You may tragically checkout my work. Arrangement Given under. Free Download software
ReplyDeleteDirect Download Link
My brother is amazed by this Rootkit configuration that I found for him. But really I was looking for history essay questions that I have to prepare for the next week. But it's so nice too because my brother is happy now.
ReplyDeleteTechnologistan is the popoular and most trustworthy resource for technology, telecom, business and auto news in Pakistan
ReplyDeleteIts great opportunity to get know about, What is Google My Business.
ReplyDeleteThank you for another informative blog. Where else could I get that kind of info written in such a perfect way? 홀덤
ReplyDeleteThank you so much admin for uploading such amazing content with us your blog is really helpful for me. wish you all the best for upcoming comments. I am also wanted to write blog kindly guide me if my topic is Utility Vehicle Suppliers then what should I do first and how will I create new and unique content on this topic
ReplyDeleteYou deliver information related to malware analysis and discuss related to rootkit configuration in detail. Thanks for sharing this post with us. Moreover, This time to take advantages of https://wilderperez.com/real-estate-agent-in-home-springs-ca/ for quality work.
ReplyDeleteYou deliver information related to malware analysis and discuss related to rootkit configuration in detail. Thanks for sharing this post with us. Moreover, This time to take advantages of real estate agent in home springs ca for quality work.
ReplyDeleteEnjoyed reading the article above, Really explains everything in detail, the article is very interesting and effective. Thank you and good luck for the upcoming articles...For more please visit: SEO Service USA...
ReplyDeleteYou deliver the informative information related to security and algorithms in detail. This post is very helpful for IT students. Further, This time to take advantages of car locksmiths in san Antonio tx for quality work.
ReplyDeleteVery Informative & watchful content, You guys also try it
ReplyDeleteReal Estate Agents Meridian ID
for best Relocation services
Why couldn't I have the same or similar opinions as you? T^T I hope you also visit my blog and give us a good opinion.casino online
ReplyDeleteVery nice article and straight to the point. I don’t know if this is truly the best place to ask but do you folks have any idea where to get some professional writers? Thank you. 호텔카지노
ReplyDeleteHi there, I simply hopped over in your website by way of StumbleUpon. Now not one thing I’d typically learn, but I favored your emotions none the less. Thank you for making something worth reading. 메이저사이트순위
ReplyDeleteI finally found what I was looking for! I'm so happy. 우리카지노
ReplyDeleteYour information was very useful to me. That's exactly what I've been looking for 샌즈카지노!
ReplyDeleteHard to ignore such an amazing article like this. You really amazed me with your writing talent. Thank you for sharing again.
ReplyDelete바카라사이트
Thank you for providing a good quality article.
ReplyDelete카지노사이트
This article is very helpful and interesting too. Keep doing this in future. I will support you.
ReplyDelete토토
I finally found great post here. Thanks for the information. Please keep sharing more articles.
ReplyDelete온라인카지노
Good morning!! I am also blogging with you. In my blog, articles related to are mainly written, and they are usually called 우리카지노. If you are curious about , please visit!!
ReplyDeleteIt seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 바카라사이트 . seems very easy, but it's a difficult kind of article, and it's perfect.
ReplyDeleteI really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog. 한국야동
ReplyDeletePlease visit once. I leave my blog address below
야설
일본야동
Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. 한국야동
ReplyDeletePlease visit once. I leave my blog address below
야설
한국야동
Thanks for taking the time to discuss this, I feel strongly about it and love learning more on this topic. If possible, as you gain expertise, would you mind updating your blog with extra information? It is extremely helpful for me. 야동
ReplyDeletePlease visit once. I leave my blog address below
국산야동
일본야동
Excellent read, I just passed this onto a friend who was doing some research on that. I will learn a lot of new stuff right here! 국산야동
ReplyDeletePlease visit once. I leave my blog address below
한국야동
국산야동
Great article with excellent idea!Thank you for such a valuable article. I really appreciate for this great information. 한국야동
ReplyDeletePlease visit once. I leave my blog address below
야동
일본야동
I'm looking for a lot of data on this topic. The article I've been looking for in the meantime is the perfect article. Please visit my site for more complete articles with him! 메이저검증
ReplyDeleteThere are also articles on these topics on my blog and I hope you visit once and have a deep discussion! 메이저놀이터
ReplyDeleteYour writing is perfect and complete. However, I think it will be more wonderful if your post includes additional topics that I am thinking of. I have a lot of posts on my site similar to your topic. Would you like to visit once? keonha cai
ReplyDeleteThis is the post I was looking for 메이저사이트 I am very happy to finally read about the Thank you very much. Your post was of great help to me. If you are interested in the column I wrote, please visit my site .
ReplyDeleteExcellent article. Very interesting to read. I really love to read such a nice article. Thanks! keep rocking.
ReplyDeleteIDM Crack
Ezdrummer Crack
Windows 10 Activatior Crack
REFX Nexus VST Crack
Virtual Serial Ports Crack
Kerio Control Crack
This is really helpful post and very informative there is no doubt about it. It’s awesome dude I found this one pretty fascinating and it should go into my collection. 슬롯머신사이트
ReplyDeleteAttractive component of content. I just stumbled upon your site and in accession capital to claim that I acquire actually enjoyed account your blog posts. Anyway I will be subscribing for your feeds or even I success you access consistently quickly.
ReplyDelete섯다
I am sure this post has touched all the internet users, its really really pleasant piece of writing on building up new webpage.
ReplyDelete토토
I am really glad to glance at this website posts which includes plenty of
ReplyDeleteuseful data, thanks for providing such information.
일본야동
Thank you for posting this awesome article. I’m a long time reader but I’ve never been compelled to leave a comment.
ReplyDeleteI subscribed to your blog and shared this on my Facebook.
Thanks again for a great article!
토토사이트
great & nice articles with a lot of information to read...great people keep posting and keep updating people..thank you , Hello, this is very useful material.
ReplyDelete스포츠토토존
I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post. I am writing on this topic, so I think it will help a lot. I leave my blog address below. Please visit once.!
ReplyDelete바카라사이트비즈
The setup process for every Canon model is almost similar, however the download through https //ij.start.cannon or http //ij.start.cannon and installation process may differ.Depending on your requirement, it offers a type printer including PIXMA, SELPHY, MAXIFY, etc. canon.com/ijsetup Some factors need to be in mind while choosing an inkjet printer for you. Later, you can easily set up your Canon printer through drivers from ij.start.cannon wireless connection, USB, and a few components. Https //ij.start.cannon
ReplyDeleteGreat Post. Keep Writing and Inspiring. Looking Forward to More.
ReplyDeleteThank you for sharing such a Wonderful Blog.
ReplyDeleteI really enjoy your Post. Very creative and Wonderful.
ReplyDeleteDr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download Now
ReplyDelete>>>>> Download Full
Dr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download LINK
>>>>> Download Now
Dr. Fu'S Security Blog: Malware Analysis Tutorial 26: Rootkit Configuration >>>>> Download Full
>>>>> Download LINK
Great post, beautiful weblog with great informational content. This is a really interesting and informative content. 토토사이트
ReplyDeleteThis is very nice article. Everyone should read. 경마
ReplyDeleteHere are several of the sites we advise for our visitors 토토
ReplyDeleteGreat Post. Looking Forward to more.
ReplyDelete슬롯커뮤니티
ReplyDeleteGreat blog. Looking forward to More.
ReplyDeleteoncainven
ReplyDeleteWhat a post I've been looking for! I'm very happy to finally read this post. 토토사이트 Thank you very much. Can I refer to your post on my website? Your post touched me a lot and helped me a lot. If you have any questions, please visit my site and read what kind of posts I am posting. I am sure it will be interesting.
ReplyDeletebetflix The game has a style that is easy to play, สล็อตpg
ReplyDeleteHi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! 메이저토토사이트 Thank you very much. Can I refer to your post on my website? Your post touched me a lot and helped me a lot. If you have any questions, please visit my site and read what kind of posts I am posting. I am sure it will be interesting.
ReplyDeleteFor quite some time Gorilla INC. has been a tenable piece of the Trenton NJ people group to assist clients with their different requirements.
ReplyDeletewater filtration trenton nj
Yes i am completely concurred with this article and i simply need say this article is extremely decent and exceptionally useful article.I will make a point to be perusing your blog more. You made a decent point yet I can"t resist the urge to ponder, shouldn"t something be said about the other side? 먹튀검증업체 .
ReplyDeleteAll-State Roofing and Siding's Roofing Contractors Bayonne NJ is an excellent choice on which you could rely. We provide superior, unmatched, and genuine services.
ReplyDeleteroofing contractors bayonne nj
Wish you all the best for your new upcoming articles and kindly write on topic Ecommerce website and also on Cheap web design thanks.
ReplyDeleteThanks This blog is really informative. It helps me a lot really interested.
ReplyDeletecracked Software
Software Website
crack-softwares.com
Thanks for sharing your blogs are good and informative keep sharing such good content.
ReplyDeleteInvestment in real estate
تركيب طارد الحمام
ReplyDeleteشركة تركيب طارد الحمام
Thanks for sharing such a great and use full post this is truly a valuable blog.
ReplyDeletePay Monthly Website
I truly appreciated this blog, I am looking forward in your another content . Visit us in this website.
ReplyDeleteElectrical Supplies & Products