>> For a quick demo today,
I'll be looking at the Dyre malware family.
It's a bit old but I think
it's pretty good for our purposes right here.
Here is another malware sample repository up on GitHub.
It's called theZoo,
the malware DB for database.
If you go to this URL like we'll
do here in a minute and download this binary,
be careful this is live malware.
Let's go ahead and do that and let's look over some of
these tools like captureBAT,
RegShot, and Autoruns.
I mentioned them last time where we looked at VM.
Here we have the GitHub for this particular gentleman.
If we go under the zoo on github.com/ytisf/thezoo,
we can go under malwares,
we can go under binaries
because here there is source code for
many malware families that have been leaked over
the years and we're just going to
click down here to dyre.
Then we're going to click here under
dyre.zip and then view all.
This will prompt us to download the zip file.
I'm going to go over here and drag and drop
here, stolen desktop.
I'm going to drag it and drop it
into my virtual machine here.
I'm going to do the same for another set of tools
that I'm not sure if I mentioned last
time but here I have already downloaded them.
This is the Sysinternals Suite made by Mark Russinovich,
a very smart guy, very popular and very knowledgeable,
makes a lot of great tools
and I'm going to
drag and drop that into our VM as well.
Now here is the VM the way we left it before.
We're going to install some of
these tools like captureBAT.
Before we install it,
we actually need to run
the Visual C runtime redistributable packages
and I don't know exactly which package it
relies on but I know 2005 works well.
[inaudible]
The Visual C or
C++ runtime libraries have been installed.
We'll now install captureBAT,
that needs reboot, we're going to let it do that.
It does it by installing a driver.
This does not work in Windows 7 but usually,
I always use a Windows XP machine to do my analysis.
Most malware is backwards
compatible.I'm just installing these other tools.
We've installed a number
of tools and I'm just going to go ahead and
get rid of the installers for RegShot.
[inaudible] RegShot.
I'm just going to extract
out here so it's on the desktop.
I'll get rid of that
and extract this [inaudible] into the desktop,
get rid of that and we organize this a little bit.
CaptureBAT is what we're going to be using.
I'm going to do something here
that'll make things easier for us in
the future which is I'm going to go here to
capture and see program files
captured and here's captureBAT.
I'm going to save us some time in the future by going to
here Program Files capture
and go to captureBAT right here, which is the program.
I'm going to say send to desktop,
which will create a short cut.
Go to properties.
Here's the location on the desktop
so it'll run this executable.
I don't want to run with the arguments of
dash C for capturing
deleted files and dash L for store the files,
for storing the output of capturedBAT somewhere.
I'm going to paste,
I had copied it from this tab over
here and I'm going to just say log.txt.
Now we're all ready to start executing our malware.
Right before we do this, I'd like to take
a snapshot and say,
ready to infect.
[NOISE]
>> Now, we're going to extract Dyre malware.
Now, most malware is a zip file with the password
are infected like so.
Industry-standard. Now,
we just downloaded this from the website.
Here we can see a few files.
Now, if you looked at this one,
you'll notice that it's a PDF icon
that it has a.fcr ending.
Little do most people know that that is an executable.
That it does have the same file format as
a.exe and it can be just as dangerous.
We can double-click on it and it would execute.
A good verification for this would be open up
a hex editor like 010 is my favorite and very powerful.
We can see that it does indeed have the MZ file header,
which means it's a DOS executable,
just a classic string.
Then we see down here there's
the PE executable file header,
but we'll get more into this when we
do some more stack analysis.
We're going to go ahead and execute
this OCR but first we're going to run CaptureBAT.
First, I always like to check to make
sure that it's not connected to the Internet.
I'm going to see the network adapter
is how we left it last time is
connected into our own virtual network of VMNet2.
The only other thing on VMNet2 is
our Kali Linux box that we
have suspended so no network traffic can get out.
We're going to execute CaptureBAT.
It's now capturing. There's log.txt
and now we're going to execute the Dyre sample.
We notice it deletes itself.
The little icon for loading
and waiting, it's doing some stuff.
You might want to wait a few minutes,
but I typically wait just 10 seconds
and press control C. It exits the CaptureBAT.
Now, look at the log.
We can see here, and one of the programs I
installed was Notepad Plus Plus.
You can see here
high-level things of what the Dyre malware has done.
We can see that explorer.exe,
that's us, we executed it by double-clicking on it.
We see process execute that.
We see that that program see it made a registry key,
current users software, Microsoft Windows,
current version Explorer, shell folders, AppData.
That's pretty common just by programs executing,
so it's not that suspicious.
We see that it
then wrote a file
to see C/documents and settings,
administrator/application data/googleupdaterr.exe.
I'm going to copy that because
I think that is a good indicator of compromise.
I usually keep a little notepad open on
the side just throw that data into.
As you go down the list, you'll notice right here that
0.70 52.70 and then is then preceding 52.54,
that means these did not happen
sequentially and they were timed sequentially,
but they were not written to the file sequentially.
We're going to sort all the lines in the file so
that they are in correct time order.
Line Operations ascending,
so now they're in correct time order.
We can see that 2,
3 then 5, 4 then 0.
Down at the bottom here I'm
going to keep some little notes.
I'm going to say that is an indicator of compromise.
I would say reading here,
set all your key app data.
That's pretty common shelf holders, basis file,
and then execute set file,
process created, registry key set.
Here we can Googleupdaterr.exe,
create this registry key.
Yeah, that's pretty normal.
Let me see if it creates another registry key down here.
Current user software, Microsoft.
That is another indicator of compromise right there.
We can see it does a file write
and then we can see it does another file write down here.
This is also important when you notice it says, system,
not the Google Updater anymore that is doing this.
We see C/Program Files/capture logs/deleted files.
This is CaptureBAT catching
the file that Google Updater had deleted.
It deleted its original file.
Here, I've kept this window open, logs.
I'll make another shortcut to that.
Sum to desktop.
Doesn't matter now. We've infected
this machine. We're going to revert it.
But if we follow the logs here,
you can see it makes an opening
and this is the file but tried to delete.
Another one of those tools I installed that I
described last time was the Macpath.
Get an MD5,
copy that hash,
and then now I'm going to go find this program,
this Google Updater,
copy-paste, go that location, Google Updater.
I'm going to grab that same MD5 hash. What do you know?
It's the same. You pair them
round top of each other. They are the same.
So that means it copied
itself from whatever folder was in to this folder,
the application data folder,
and then added a registry entry
for running as soon as the current user logs in.
This is interesting because running,
whenever the current user on it
is logging in, is great,
and most computers are
single-use computers and only one user
uses the amount of time.
But this is an administrator on XP machine.
That means if it had made the same registry value
to high key local machine,
it would have executed whenever anyone logged in,
but instead it did it only for this user.
That's interesting to me
because maybe the malware auth didn't know
that or maybe our sample
was doing something very specific.
It's interesting that the same hash or a copy of itself,
we can confirm that with them because it is the same hash
because some malware will actually drop something else.
It has another executable within it,
and it will decrypt that and then drop it
somewhere on the system so the hashes don't always match.
I like to confirm
that anything that it
drops is something that we are aware of.
These right here, these are
our first indicators of compromise.
These are local host indicators of compromise.
That's important because next time we're going to look
at other indicators of
compromise such as network indicators of compromise.
Those are very important
because you can find those much more easily
across hundreds or thousands of
machines if you have a large enterprise.
Network indicators, kind of harder to
find unless you have some agent or
you have some group policy wizard
or someone who has set up some SIM,
some security events log
aggregation thing and you've
configured all your computers on
your network to send their logs or
registry configurations to that server.
I want to show you some of
the tools now because you just shouldn't
rely on one or two tools for your findings like this.
Let's go back and reset.
It is also good to run the sample
multiple times because many pieces of malware
out there will use
not just one or two names for their malware,
they'll have multiple names.
Sometimes they'll name the dropped or copied
malware windows.exe or win32.exe,
or sas.exe or whatever.
They'll switch between them
randomly or depending on the time of
day or whatever the malware author has made.
But we should also use
other tools to confirm what we just saw.
Another good one is Regshot and it
does what you would imagine.
We're going to launch it.
[inaudible] is not really
important unless you're doing international stuff.
We go in standard infected password. Typed it wrong.
>> [NOISE] A good thing to note,
zip files don't encrypt the file names.
If you send something with a file name
of the Internet and you think it's password protected,
the file name is not password protected.
In fact, the CRC values,
the correction codes inside
the zip files aren't encrypted either,
only the content is.
You can positively identify something
inside of a zip file by its CRC values.
Someone could have identified this as a bunch
of dire samples inside it,
just by the CRC codes.
CRCs aren't as good as legit hashes like MD5,
SHA-1, or SHA-256,
but they can be used to confirm things.
We have our second tool, Regshot.
It does what you would think, we can
take a snapshot of the registry,
and then we can take
another snapshot of the registry
after we've executed our sample.
Let's go to sample.
Shot, now we're ready to explore sample,
check the network settings just to be sure.
Now, we're executing the same sample at
the lethal file. Wait a few seconds.
Now, second shot, compare.
Now we see some stuff like user assist.
We see stuff like MUI cache.
These things are normal for just an executable.
Any executable will produce noise on
a system and you
will realize as you're doing this,
malware analysis is just a subset of software analysis.
Aiding on these tools for all things, like an installer.
If you want to see exactly what changes in
a PSM program is making to your registry.
You can use these tools to figure that out
or what files it's leaking or whatever else.
Here we see that same value
in the register that we saw before.
There is a world update
for high key current user software,
Microsoft Windows, current version run.
The file is there, it will execute.
You see here two volumes,
modified cryptography, random number generator seed.
These things change very frequently and if you
just ran your Regshot for awhile and then stopped it,
having not done anything,
you will see a bunch of these values have been modified.
It's just the natural way that
Windows is executing or the natural way it does things.
We can also scan directories and see
what files have changed within
those and that can be useful too.
But for now, we're just going to
reset and use a different tool.
We probably didn't have to reset
but I like to be scientific about things.
We're going to use a system
journals tool called autorun,
it's fantastic. There's two autoruns.
One that again we're going to see which is Command Line,
which is great if you just want
to do a lot of automated stuff.
You can write a quick script to
execute this and then execute the malware,
and then execute this again.
Basically what it will give
you in the command-line format instead of
this nice graphical format is all these locations
where programs were used to execute as soon as
it boots or a soon as the user logs onto the computer.
It breaks it up into
some pretty well organized categories.
Over on the left, the people tab
is where we see everything.
But we can break that out and say,
this is where a user logged in.
What runs Microsoft Outlook Express
and our software program,
Address Book 6, this is pretty normal.
This is a fresh install.
VMware Tools, we knew about that.
We can go through all of these and really pick up
apart what's running on our system.
Here we have a bunch of
things that are made by Microsoft,
and that's pretty common.
A good option is to hide Microsoft entries.
Anything that's been signed by Microsoft,
we can just automatically discount this like based
on this and that's the stuff as we can trust them.
Girls, we have a lot worse problems.
We can probably trust
VMware and we trust all these other things.
We trust these drivers because we know this is
a fresh install of the OS.
Here we're going to
[NOISE] extract iron password infected.
Execute the same malware and see if it pops up here.
These colors will indicate different levels of trust.
Like green that doesn't trust so much.
Let's refresh this.
There is our Google update.
See it didn't trust it very well.
It has what we call low integrity.
We can see the time it was added, 1983.
I don't think so. It was
timestamped is what we would say.
Whereas some of these other ones have
more legitimate looking times.
Like those, those are wrong.
Here, we can jump to entry.
We can see where it is.
If we wanted to disable this malware,
we can simply delete this key
and then restart the machine
and it would not boot up again.
That's the way of disabling this malware.