So it covers copying files in and out, but we've also,
we've built this OS, we've made it look real, we've made
the hardware look real right.
We now need to have some tools on it that help us analyze
what the malware's going to. And there are a ton of great
malware analysis tools out there.
But there's a set of tools that I think most people use like
Microsoft's Sysinternals Process Monitor, Process Explorer.
We talked about FakeNet, that's a commonly used tool.
And like we said in one of the earlier modules, malware authors,
they're moving away from anti‑VM detection, from VM detection to
the detection of the analysis tools.
Okay.
And so we want to do a couple things to kind of make it more difficult for the
malware authors to detect our analysis tools themselves.
Yeah,
so it can identify if it's on a weird hardware, it can identify if
it's on a weird OS. It could also identify if we're running, if
processes are running that are common tools that are being used. So
how do you hide those processes? So, honestly, the easiest way to do
this is just rename your tool.
So like Process Monitor.
It's file name is procmon.exe. So if a malware was doing a very simple check,
they were just kind of enumerating through the right process list,
they would look for things like propmon.exe. Just rename it to
something like notepad.exe. It's going to work just as fine. It's
still going to work the way that you expect it to. But then it's
going to bypass that very simple check.
Now Process Monitor, for example, does some other things.
It loves a driver in order to kind of see the data it's looking for or
that you want to see. You really can't control that. And so there are
times where you may need to move away from tools that you're familiar
with or that are more commonly used,
and use something that's less common that the malware
probably isn't going to be detecting.
So, for example,
for Process Monitor, Process Monitor is a tool that kind of monitors
what's going on in your operating system in real time. Right. There
are other tools that do the same thing.
There's a great tool called WinAPIOverride that does the exact same thing.
In fact, it kind of gives you a bit more capabilities.
But malware is less likely to look for WinAPIOverride than it is for procmon.
So if you get on the system and you're running these tools, and the malware
just kind of immediately kills itself or isn't acting the way that it should,
try using an alternative tool to see if then it runs, if it's not detecting
that. That's a really good point.
So we can change the names, or we can actually just use a different tool.
That's a lot of benefits of the community, right?
There's always like another variant or another tool that we can
use to accomplish some of the same things. Right, and there are
definitely other techniques that you can use. You can even start
using malware against itself.
Download a rootkit onto your system that you can control and hide your tools
with the rootkit. You're kind of using the attacker's techniques and tools
against themselves, but it's still a valid way to go.
What I would say,
though, if you're going to do that, kind of analyze that rootkit beforehand,
make sure it doesn't have any back doors or anything in it, if for nothing else,
just so you know that that traffic is from the rootkit that
you're using and not from the malware.
Yeah, I've actually never heard that, but it's incredibly brilliant.
That's the way to do it because that's what rootkits do, they hide. Yeah,
we're just going to use the attacker's tools against themselves.