Wednesday, August 15, 2012

Malware Analysis Tutorial 32: Exploration of Botnet Client


Learning Goals:
  1. Practice WinDbg for Inspecting Kernel Data Structure
  2. Use Packet Sniffer to Monitor Malware Network Activities
  3. Understand Frequently Used Network Activities by Malware
  4. Expose Hidden/Unreachable Control Flow of Malware
Applicable to:
  1. Operating Systems
  2. Assembly Language
  3. Operating System Security
1. Introduction

This tutorial explores the botnet client part of Max++. We assume that you have completed tutorial 31 where our lab setting directly results from its analysis. You should have the following before the analysis, as shown in Figure 1.

Figure 1. Process Network Message

As shown in Figure 1, there is a big loop of calling zwReplyWaitReceivePortEx, which tries to wait for a message from the port. EAX represents the return code of the function, e.g., 0x0 represents OK and 0x102 represents time-out. If time-out, it calls function 0x35671D03. Otherwise, it proceeds to process the message.

Max++ first reads the 2nd word in the message, this is supposed to be an integer between 1 and 3. For case 3, it calls function 0x3567162D. for case 1, it calls function 0x3567204F. Note that all the four parameters of 0x3567204F are from the msg (5th, 7th, 8th and 10th words from the message respectively).

2. Execute Remote Command (#1).
Now let's delve into function 0x3567204F. Again, notice that this function gets executed ONLY WHEN the second word of the remote network message is 0x1. Figure 2 shows its function body.

Figure 2. Mysterious Function 0x3567204F

As shown in Figure 2, one of the input parameters of the function is ESI register (pointing to 0x00181580). This is a mysterious data structure. We suspect that it is the COM interface of the fake JScript COM object (the remote max++.x86.dll). The COM interface wraps a C++ object so that the program (Max++) can call the functions available in the DLL.

Next, the function clears memory region 0x009FFEE8, and copies the first four parameters passed in the stack to this region. Notice that these four parameters are the 5th, 7th, 8th, and 10th words in the remote message. Then it saves 0x009FFFE8 to EBP-10.

Max++ then proceeds to call some function of the remote DLL (see the second highlighted area in Figure 2). It seems to be taking out the virtual function table of the object and it invokes the function located at offset 0x18. This function takes at least 7 parameters, and they are [ESI+18], [ESI+20], 0x356782A4, 0, 1, [EBP-20], and [EBP-10]. Here [ESI+18] and [ESI+20] must be some data attributes of the COM interface object, and [EBP-20] is a pointer to collect result. From the VariantClear call (see the last highlighted area of figure 2), we can infer that [EBP-20] is a pointer to VARIANTARG. Lastly notice that [EBP-10] stores 0x009FFEE8, which contains the four words from the remote message.

Although we have no access of the remote DLL, we can infer that this part of the malware is taking some command/parameters of the remote message, and execute some functions correspondingly. It looks like a bot-net client.

3. Initilization (command #3)
We now look at case #3 (where the 2nd word of the remote message is 3). In this case,  function 0x3567162D is invoked.. To enforce the control flow into this case, we simply change the register values correspondingly. Figure 3 displays the body of function 0x3567162D.

Figure 3. Function Body of 0x3567162D

As shown in Figure 3, function 0x3567162D extracts a file from the hidden drive into a newly allocated heap area. The contents of the file seem to be some special javascript tags and HTTP request headers. The file name is read from an absolute location 0x3567806C. Unless the address is being re-written, it's always reading the same file.

Then Max++ jumps to function 0x356719E4, as shown in Figure 4. Again, it's invoking the COM interface of the remote object which is not available. As shown in Figure 4, it loads the virtual function table of the COM object multiple times and calls several functions of that COM interface.

Figure 4. Calling COM Object

4. Conclusion
Since the remote object is not available, we are not able to drill deeper into Max++. The bottomline via the analysis in this tutorial is that the maxware is able to listen to a port and receive commands from a remote server. The remote command has a fairly simple structure, the second word of the remote message decides the action to take at the max++ client side. #3 seems to be initializing service; and #1 seems to be executing some actions, where four words from the remote message serve as the parameters.

In the next tutorial, we will submit Max++ to various malware analysis engines and match their discovery with our manual analysis.


100 comments:

  1. Great post.I like this one.Thanks for sharing.

    ReplyDelete
  2. I enjoyed the tips you are providing on your website. Remote IT Support can make one’s help technical service. Thanks for the information……..

    ReplyDelete
  3. very Informative and comprehensive data !
    it’s takes advantages ..
    enjoyed reading it !
    Thanks for sharing...

    ReplyDelete
  4. Nice article, thanks for the information. You give me some idea's. I will bookmark for next reference.

    ก็อตซิลล่า 2015

    ReplyDelete
  5. BlueHost is definitely the best website hosting provider with plans for all of your hosting needs.

    ReplyDelete
  6. I have used AVG anti virus for a couple of years now, and I'd recommend this solution to all you.

    ReplyDelete
  7. There are certainly a lot of details like that to take into consideration. That is a great point to bring up. I offer the thoughts above as general inspiration but clearly there are questions like the one you bring up where the most important thing will be working in honest good faith. I don?t know if best practices have emerged around things like that, but I am sure that your job is clearly identified as a fair game. Both boys and girls feel the impact of just a moment?s pleasure, for the rest of their lives.
    spyhunter license key

    ReplyDelete
  8. I’ve been browsing online more than 2 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my opinion, if all web owners and bloggers made good content as you did, the internet will be a lot more useful than ever before.
    Reverse Engineering in India
    Reverse engineering design

    ReplyDelete
  9. Bisa pula pasangan berurutan kartu K-Q-J dari jenis yang berbeda. Jika kartu anda memenuhi syarat ini, maka anda memiliki masa depan yang cerah untuk melanjutkan ke tahap selanjutnya. Selain itu, jika mendapatkan kartu yang berurutan 2 sampai 10 juga merupakan awal yang baik.
    asikqq
    http://dewaqqq.club/
    http://sumoqq.today/
    interqq
    pionpoker
    bandar ceme terbaik
    betgratis
    paito warna terlengkap
    forum prediksi

    ReplyDelete
  10. Thanks for sharing, very informative blog.
    ReverseEngineering

    ReplyDelete
  11. We focus on meeting all the needs of our clients by offering them with a reliable custom essay writing service USA and legitimate paper writing services delivering it on time.

    ReplyDelete
  12. Companies offering affordable custom research papers should help students perform well by delivering papers prior to deadline. Early delivery of essay writing service nursing is very important because it results in good performance of learners.

    ReplyDelete
  13. Your search for Custom Research Paper Writing Services ends here. Welcome to the home of best essay writers who are qualified in diverse fields. Our
    Research Paper Writing Service
    is proof that we are right near you. It is easy, place your order and get original plagiarism free assignments. What’s more, we keep everything confidential.

    ReplyDelete
  14. We give the services of our expert assignment writers who are always there to resolve any type of issue regarding your final semester grade calculator

    ReplyDelete
  15. Great information you have shared here, through this post. Thanks and keep sharing such valuable updates through your side. Are you looking for Essay Writing Help? Our writers can help you round the clock. Contact our website for best grades.

    ReplyDelete
  16. It can be awful for any student who attains low grades due to low-quality Custom Research Papers. Luckily, you have a Research Papers for Sale Help online that will help you handle even the most challenging Affordable Term Papers.

    ReplyDelete
  17. Are you struggling with identifying an online Annotated Bibliography Services provider which is credible to undertake your task? Do not let tedious Custom Research Paper Services tasks sap you of energy unnecessarily, online Custom Research Paper Writing Service delivery comes with its own set of challenges.

    ReplyDelete
  18. Gunakan kesempatan emas bermain di wedeqq dan juga fifaqq. Jangan lupa untuk bergabung juga di taipanqq beserta kebanggan situs lipoqq yang dapat memberikan kemenangan yang mutlak.

    Lihat juga halaman terkait lainnya dibawah ini :
    jurusqq
    priaqq
    hokiqq
    dewaqq

    ReplyDelete
  19. Do you ardently require Essay Writing Help Writing Services from a writing firm with a distinguished track record? Are you unsure of which Custom Essay Writing Service Provider to contract for your essays? Do not let a burdensome Custom Essay Writing Services task drag you down.

    ReplyDelete
  20. During my early days of binarytrades i fell into a lot of online scams, trying to trade bitcoin and invest in binarytilt. Which nearly wrecked me out, making me loose up to $295k

     very confused on what to do not until my boss introduced me to an online recovery agent Mrs maryshea. A recovery expert who helped me recover all my money back from the scammers. She's also able to recover funds of any form of scam.
    You can WhatsApp her with this number +15623847738
    Or email address Mrs maryshea03@gmail. Com
    Good luck

    ReplyDelete
  21. Great, i must say and thanks for sharing this informative post.I am really impressed that there is so much information about this subject that have been uncovered and you’ve done your best, MyAssignmenthelp.co.uk is giving help to students who is stressed with their homework help and submit their assignment on time.we are already trusted by thousands of students who struggle to write their and also by those students who simply want to save their time and make life easy.
    finance dissertation Writing services
    marketing dissertation writing help
    english dissertation  UK
    Sociology Dissertation Writing
    Accounting Dissertation Help

    ReplyDelete
  22. Did you know there's a 12 word sentence you can tell your man... that will induce intense feelings of love and instinctual attractiveness to you buried within his heart?

    That's because hidden in these 12 words is a "secret signal" that triggers a man's impulse to love, treasure and look after you with all his heart...

    ===> 12 Words That Trigger A Man's Love Impulse

    This impulse is so hardwired into a man's mind that it will make him work better than ever before to to be the best lover he can be.

    Matter-of-fact, triggering this dominant impulse is so essential to getting the best possible relationship with your man that the second you send your man one of the "Secret Signals"...

    ...You'll instantly find him open his heart and mind to you in such a way he's never expressed before and he'll identify you as the only woman in the world who has ever truly interested him.

    ReplyDelete
  23. Second Innings Home is the first and only premium home & health care service in India. Second Innings Home proposed across the nation features a beautiful campus ideally located in a well-maintained gated community in the format of a Star Hotel with luxurious amenities. It’s convenient to enjoy the privacy and to be near the city and nearby facilities. And yet it retains a sense of community spirit and the warmth of a small community. best retirement homes in Hyderabad

    ReplyDelete
  24. Global Interscope is the best swimming pools designing in Hyderabad where the you can get all the facilities to improve better.

    swimming pool equipment services in hyderabad, Execution, Equipment Supplies, Services and Lifestyle Products.

    ReplyDelete
  25. hp laserjet p1102w wireless setup-printer on various gadgets on MAC, Windows & Without CD as all realize its gives you quick, simple and moderate printing.

    ReplyDelete
  26. Why MY Canon PIXMA G3200 Wireless printer stays disconnected windows and macintosh shows disconnected issues. Actually, clients may take a stab at playing out the means beneath to change the status of Canon Pixma G3200 Printer To Wifi.

    ReplyDelete
  27. Thanks for reminding me of this. Blog commenting is sure a powerful SEO tool. I sincerely hope it helps as described in your newsletter.

    Coursework help
    Online Writing Services
    coursework help online
    custom coursework writing service
    coursework writing

    ReplyDelete
  28. Our firm has established itself as the most trustworthy assignment help firm in Australia and globally. Join these thousands of students and achieve high distinction in each and every one of your college tasks. Anyone can attempt writing on your behalf, however, the question is would you pay someone to do it for you without checking their credibility? This is the main reason why most students search for assignment help australia over the internet and choose only the most proficient and trusted academic writing experts. So, if you are searching for quality melbourne assignment help you can find it right here from the local experts.

    ReplyDelete
  29. We are always available for your support regarding the HP Printer Wireless Setup Issues troubleshooting and services. Our team is one of the most certified printer support which are always available 24 x 7. For more detail visit our website our call our toll free number.

    ReplyDelete
  30. Hi Dear,
    Thanks for sharing such a useful blog. Really! This Blog is very informative for us which contains a lot of information about the Counselling For Men. I like this post. Please visit at "Argumentative essay topics for college students",Find the best argumentative essay topics for college students at Myessaydoc.com. Just order today and we will for sure solve your academic writing problems.


    Visit Here - https://myessaydoc.com/argumentative-essay-topics/ Thanks

    ReplyDelete
  31. Free download of IObit Uninstaller Pro Crack IObit Uninstaller Pro 2020 full version Key Key Download is integrated in the current uninstallation generation and helps you easily remove unnecessary programs even if Windows fails to upload or remove programs. With the exception of the disposal of unwanted programs, remnants are easily scanned and removed. The most attractive element is that a recovered photo is created before every uninstall. With the brand-new module for uninstalling toolbars, IObit Uninstaller Pro Crack Loader Download allows you to thoroughly dispose of unwanted toolbars.

    ReplyDelete
  32. Thank you for such a wonderful article. Now A day technology is updating day by day, most of the people didn’t know How to Configure Bluetooth Printing for Windows 10, Not to worry about this problem. Their are very simple and few steps to resolve it. For more detail visit our Official website.

    ReplyDelete
  33. CrazyForStudy provides assignment service at affordable cost in a wide range of subject areas for all grade levels, we are already trusted by thousands of students who struggle to write their academic papers and also by those students who simply want Waste Management Assignment Help to save their time and make life easy.

    ReplyDelete
  34. Hey, I am Mark. Great Post for Beginner to understand. I finally found great post here. Thanks for information.keep sharing more articles. For More details Visit: HP Printer Offline Issues or you may connect to us by dialing our toll free number.
    Fix HP Envy 5540 Printer Offline Issues

    ReplyDelete
  35. Thank you very much for this great post. Valorant Phoenix Jacket

    ReplyDelete
  36. This was an extremely wonderful post. Thanks for providing this info.
    jungkook yellow jacket

    ReplyDelete
  37. Before you register the printer and make your client account, you have to interface your printer to the system with the goal that it very well may be utilized from a PC. Follow theinstructions in the "Start Here" arrangement manual for play out your printer's underlying arrangement and system arrangement & printer installation

    ReplyDelete
  38. Our the purpose is to share the reviews about the latest Jackets,Coats and Vests also share the related Movies,Gaming, Casual,Faux Leather and Leather materials available Pretty Poisons Jacket

    ReplyDelete
  39. The written piece is exclusive as it contains information which is unique to its own. If you ever need assistance with similar assignments, you can explore academic services offered by livewebtutors.com. Seek Assignment Help and be the topper in your class.

    ReplyDelete
  40. Therefore, Freemake YouTube Downloader supports video clips in 4K and HD quality. Also, with Freemake Video Converter, you can easily remove unwanted video parts. After that, from desktop video files or rip DVD. Also, the process is fast. Remember to convert your video file to save the changes. However, read the instructions for more details.protoCrack
    BitTorrent Pro Crack is one of the main tools of Peer 2 Peer Networks. Torrent is a network for exchanging files between several computers using particular software. By using search engines that have these files on their target computers, you can get the file you want and get it with software like BitTorrent etc.seCrack

    AnyTrans Full Version Crack will break sync limits and build roads between all your devices. Now you can transfer your data and files via iOS devices, Android mobiles, PC / Mac, and cloud storage. Free, flexible and unlimited.thisCrack

    ReplyDelete
  41. Hey guys its Oliver Warren and i am currently working on many mac and software projects... so as everyone is sharing their blogs so, why should i not?

    Adobe zii 5.2.6 CC Crack

    ReplyDelete
  42. Parallels Desktop Crack is actually one of the best VM software programs. In it, Mac OS X computers with very capable specifications. It is a secure system that enables drivers to quickly create digital devices and makes it easy to activate the Windows operating system on a Mac computer system. Parallels Desktop for Mac is the simplest and most powerful application to run Windows on a Mac without having to restart it.downloded fro this site Crack

    If you accidentally deleted a number of dangerous papers from your PC, don't worry, Recuva is for you. The consumer edge of the expert key consists of plain and simple windows. It allows you to search for the exact content on your PC. avira antivirus crack.downloaded from this site Crack

    Capture One is advanced digital image processing software that provides an all-in-one solution for capturing, editing, adjusting and organizing your photos. Capture One is professional image editing software with raw functionality. It offers an easy-to-use workflow, extensive editing tools, and high-quality results. The program features basic and advanced photographic adjustments, film grain, repair layers, keystone correction, color correction, black and white conversion, lens tools, sharpening tools, noise reduction, smudge removal, and HDR tools.downloaded from this site Crack

    ReplyDelete
  43. Great, I personally like this blog. Visit Ogen Infosystem for creative website designing services and PPC services at affordable prices in Delhi.
    Best Website Designing Company in India

    ReplyDelete

  44. It is a powerful video downloader and is available on free video sharing sites like Facebook, Daily Motion, Echo, and over 100 movie sharing sites,
    In addition to downloading videos from their original formats,
    Allavsoft converts downloaded videos into popular video formats such as MP4, AVI, WMV, MOV, MPG-1, MPG-2, VOB, ASF, RMVB etc.
    Free Download link for Allavsoft Video Downloader Converter Crack is given below:
    https://softserialskey.com/allavsoft-video-downloader-converter-crack/

    ReplyDelete
  45. It can be awful for any student who attains low grades due to low-quality Custom Research Papers. Luckily, you have a Research Papers for Sale Help online that will help you handle even the most challenging Affordable Term Papers.

    ReplyDelete
  46. HP Envy 4500 Error oxc4eb827f is the aftereffect of degenerate vault in the framework. Find support from specialists to eliminate oxc4eb827f mistake from HP Envy 4500.

    ReplyDelete
  47. Our the purpose is to share the reviews about the latest Jackets,Coats and Vests also share the related Movies,Gaming, Casual,Faux Leather and Leather materials available Tell Me Why Tyler Jacket

    ReplyDelete
  48. It's a really great and useful piece of information. Thanks, and please keep up the rewarding work. Usmle Step 1

    ReplyDelete
  49. Thanks for your article. It was interesting and informative.
    Here I also want to suggest your reader who usually travels one place to another they must visit Airlines Gethuman that offer best deals to book your seat on Delta Airlines Reservations. So do hurry and avail the best deals and get rid of to check different websites for offers.
    Delta Airline Reservations
    Southwest Airlines Flights

    ReplyDelete
  50. Awesome and interesting article. Great things you've always shared with us. Thanks.
    macgo mac blu ray player pro crack

    ReplyDelete
  51. 123.hp.com/setup - Complete Hp Printer setup, Driver Software installation, 123 hp com wireless setup & Troubleshooting 123hpcom Printer.

    ReplyDelete
  52. 123.hp.com configuration of HP printers. We offer resources released by 2019 such as drivers, software & the 123.hp.com/install Printer setup manual.

    ReplyDelete


  53. Very nice blog and articles. I am really very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post. Also Visit my website.https://www.oddylabs.com/

    ReplyDelete
  54. E commerce website design :An web designer creating E commerce website design will start their work with you by holding a consultation to discover your goals for your website and the needs of your branding. Reflekt Visual Pvt Ltd is great for ecommerce website designers.Use our online store templates, or custom design your own theme.

    ReplyDelete
  55. E commerce website design :An web designer creating E commerce website design will start their work with you by holding a consultation to discover your goals for your website and the needs of your branding. Reflekt Visual Pvt Ltd is great for ecommerce website designers.Use our online store templates, or custom design your own theme.

    ReplyDelete
  56. Website Development and Digital Marketing: Digital marketing and web development need to work together. In simple terms, digital marketing is marketing that makes use of electronic devices. This includes computers, tablets, smartphones, cell-phones, digital billboards, games' consoles, and apps to engage consumers. Reflekt Visual Pvt Ltd Understand the use of Website Development and Digital marketing and provide it successfully.
    For more information visit us Website Development and Digital Marketing

    ReplyDelete
  57. Microsoft Office 2016 Crack is the latest version of Microsoft Office that follows Microsoft Office 2013. The Microsoft Office 2016 Product Key is the key that you can use to work with Office 2016 Professional Plus. If you use Office 365, you can easily upgrade to Office 2016 with MS Office 2016 Product Key.
    TemplateToaster Crack is web-based design and design software for Windows-based CMS that allows you to create beautiful websites and templates in minutes. TemplateToaster's intuitive user interface allows you to design your ideas and design themes and templates for a variety of popular content management systems (CMS) such as WordPress, Joomla and Drupal, including business platforms such as Magento, OpenCart, Prestashop and VirtueMart.
    AutoCAD Crack is a modern design program suitable for complex 3D models based on existing products. In fact, this program is available to civil engineers, architects, developers, and other design institutions to carry out their daily activities. It offers a wide range of tools and devices that need to renew and facilitate your activities.

    ReplyDelete
  58. PDF Eraser Pro Crack is a PDF removal application that erases text, images, logos, and all unnecessary objects from PDF files. Users can use the program to delete the original content from a PDF file and then add text and images. In addition, this PDF file removal tool includes a built-in PDF page break that allows users to delete unwanted PDF pages.
    AnyTrans Crack The transition from iOS to Android shouldn't be tedious or time consuming. But AnyTrans makes it easy for you. With one click, you can seamlessly transfer all important content from iPhone, iTunes and iCloud to your new Android phone.
    SysTools Outlook.com Backup Crack Tool - Never lose touch with the Systools Outlook.com email backup application. It's by far a cloud-to-near backup solution that downloads a copy of Outlook.live.com's email, calendar, contacts, and tasks to the nearby hard drive / computer. Never lose a file again with Outlook.com SysTools email backup utility.

    ReplyDelete
  59. Hi if you want to buy your dream home without any brokeage then contact to our team and get exculsive offer.
    Book Now why you are waiting for.
    for more detail visit:- Book Luxury Home in Noida

    ReplyDelete
  60. Great Article
    Cyber Security Projects


    Networking Security Projects

    JavaScript Training in Chennai

    JavaScript Training in Chennai

    The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

    ReplyDelete
  61. Does your printer out of nowhere quit working and show "hp printer in error state how to fix? At that point, read this article and follow the strategies beneath.

    ReplyDelete
  62. Always go for the experienced NRI lawyers in Chandigarh from the professional team of NRI legal advisors in India. They are able to provide you the best NRI legal services for the best solution to your NRI legal issue.

    ReplyDelete
  63. https://keystool.com/vysor-fully-crack-is-here/
    Vysor Pro Crack allows you to view and also control the android of your computer. You can use this app and it helps you to play the games and play video also control the android system.

    ReplyDelete
  64. https://crackedmod.com/smart-game-booster-crack/
    Smart Game Booster Crack is a useful tool that uses to optimize any of the systems to run the games. Therefore, the tool uses to get ready and make any heavy graphics also this tool used to install it and make the system run in a few clicks.

    ReplyDelete
  65. https://crackedsoftpc.com/wondershare-pdfelement-pro-crack-with-license-key/
    Wondershare PDFelement Crack the first idea which catches the interest of Wondershare PDF Editor is its interface, which will be quite similar to this ribbon port of Microsoft term 2021.

    ReplyDelete
  66. https://whitecracked.com/corel-painter-crack-serial-number/
    Corel Painter 2021 Crack is a computer program for raster graphics editing, picture making, and picture editing. Its developer is “Corel Corporation”, the Canadian software company.

    ReplyDelete
  67. https://keysmod.com/aster-v7-crack/
    ASTER V7 Crack is the best tool that helps to make use of the PC and help to get the user a the time. Moreover, this tool simply uses to get and make the turn in your device. In addition, you can use to set this out and help to make the system.

    ReplyDelete
  68. https://cracklabel.com/adobe-premiere-pro-cc-crack/
    Adobe Premiere Pro CC Crack is the best tool that is designed by the Adobe team. The always system use to release the new version of 0ct 18. Therefore this tool uses to get the recent type of release and make mention I the system.

    ReplyDelete
  69. https://crackingkey.com/icloud-remover-crack-free-download/
    ICloud Remover Crack can be really a rather nice and famous tool which may help move your iPhone info. iCloud accounts and safe and sound in lack. Therefore, to excite Discover my iPhone feature on your own iPhone.

    ReplyDelete
  70. There are numerous explanations for ordinance printer not printing blunders, without knowing the reasons you can't be resolve group Canon Printer Not Printing Color issue.

    ReplyDelete