Malware Analysis

Unraveling the Digital Enigma

Deciphering Digital Shadows: A Malware Analysis Odyssey

PE Structure, Static and Dynamic Analysis

INTRODUCTION

In the ever-evolving digital landscape, where the shadows conceal hidden adversaries and malware lurks beneath the surface of seemingly innocent files, we embark on an expedition into the heart of cybersecurity. Welcome to a world where digital detectives, armed with the tools of PE header analysis, static, and dynamic examination, reveal the secrets of malicious code and the art of cyber warfare.

As we explore the multifaceted realm of malware, we’ll uncover the intricacies and the potential threats that lie within. With the knowledge of PE structures and a variety of tools at our disposal, we’ll dissect, decode, and demystify the digital threats that threaten the sanctity of your digital realm. Join us on this thrilling cybersecurity adventure, as we empower you to safeguard your systems and explore the fascinating realm of malware analysis.

Are you ready to delve into the enigmatic world of cybersecurity, where each line of code tells a story, and every analysis uncovers a new layer of intrigue? Let’s get started!

Intriguing Case Study: SHA to Be Unveiled

Before we embark on our malware analysis journey, let’s introduce the star of the show, our enigmatic guest of honor: the SHA hash.

SHA-256: 39ba1d2ba93dbd13cb56718973263edbef9ea5a6a2ddee9d81b0c71805573eb6

It is more than just a cryptographic fingerprint; they represent a window into the digital enigma we’re about to dissect.

SHA, a Secure Hash Algorithm, is our guidepost as we delve into the realm of malware analysis. This unique code is our starting point, the gateway to uncovering the secrets it holds.

Setting Up The Lab :

1. Hyper — V

Before we dive into the depths of our analysis, we need to ensure that our virtual environment is tailored to the task. To replicate a real-world scenario effectively, we’ll utilize Hyper-V, a powerful tool for virtualization. This virtualization platform is our portal to a safe and controlled world where we can examine the mysterious sample without jeopardizing our host system’s integrity.

Follow the steps given below :

1. Press the Windows key, type “Turn Windows features on or off,” and open the corresponding Control Panel option.

2. In the Windows Features dialog box, scroll down and locate “Hyper-V.”

3. Check the box next to “Hyper-V” and its sub-features, such as “Hyper-V Management Tools” and “Hyper-V Platform.”

4. Click “OK” and allow Windows to install the necessary components. Your computer may need to restart.

Create a Virtual Machine in Hyper-V

In order to create a virtual machine in Hyper-V, follow the below steps:

1. Press the Windows key, type “Hyper-V Manager,” and open the corresponding app.

2. In Hyper-V Manager, click on “New” in the Actions panel on the right side.

3. The New Virtual Machine Wizard will open. Click “Next.”

4. Enter a name for your virtual machine (e.g., “Windows10”) and choose a location to store the virtual machine files. Click “Next.”

5. Configure the Generation to “Generation 2” and allocate the desired amount of memory (e.g., 4 GB). Click “Next.”

6. Choose a virtual switch option based on your network connectivity preference. Click “Next.

7. Create a virtual hard disk with the desired size (e.g., 20 GB) and choose the “Install an operating system from a bootable image file” option.

8. Browse and select the Kali Linux ISO file you downloaded. Click “Next” and then “Finish.”

9. Follow the easy steps and Now you have the virtual machine created and ready to start and install it.

10. Right-click on the newly created virtual machine in Hyper-V Manager and select “Connect.

11. In the virtual machine console, click on the “Start” button to power on the virtual machine.

Adjusting the Lab Settings:

Within this virtual realm, we must make specific adjustments to create a controlled and secure space for our analysis. This includes temporarily disabling certain security features in our Windows 10 Hyper-V environment. To do so, we’ll turn off the following two security features:

1. Virus and Threat Protection:

This essential security layer, designed to shield your system from malware, will be temporarily deactivated to allow us to analyze the sample without interference.

2. Windows Defender Firewall:

The firewall, responsible for filtering network traffic and ensuring your system’s safety, will also be paused during our analysis.

2) PE Structure Analysis: CFF Explorer, Hex Editor

3) Static analysis: PE Studio, Detect It Easy, CFF Explorer

4) Dynamic analysis: Regshot, Procmon, Process Explorer, Fakenet, Autoruns and Wireshark or Fiddler.

Step 1 : PE HEADER ANALYSIS

1. Dos Header :

Dos Header occupies first 64 bytes of the file i.e first four rows of the hex editor as seen in the below image :

Magic Bytes : 4D 5A which is MZ in ASCII

E-lfanew : 000000E8

2) DOS Stub

The DOS stub, found in the header of Windows executable files (PE files), is a small program that displays a message when an older DOS-based operating system tries to run the file. It serves as a compatibility feature but is rarely used today, as modern Windows operating systems run the PE file directly.

DOS Stub

3) Rich Header

The Rich Header is a hidden section within Windows executable files (PE files) that contains information about the development tools used to build the software. It’s primarily used for version control and debugging purposes, helping software developers and organizations keep track of software builds and identify their origin. It’s not essential for normal program execution and is often overlooked by most users.

Rich Header

4) PE Signature :

The PE Signature is a marker within Windows Portable Executable (PE) files, indicating that the file follows the PE file format. It serves as an identifier for Windows operating systems to recognize and correctly interpret the structure of the executable file, enabling it to be executed on the system

PE Signature

As we have got this PE Signature from the offset we found in the field of e_lfanew. The offset was 000000E0. Signature’s datatype is DWORD. Here we can see it as, 50 45 00 00 which is read as 00004550. The ASCII symbol for which is “PE..”.

5) PE Header :

PE Header

6) Image Optional Header :

Image Optional Header

7) Number of Sections

Sections

In Below Image, 04 00 these two bytes represents there are 00 04(four) sections present in this particular executable.

8) Time Stamp :

It is a 32-bit value, giving the time and date the PE file was compiled. You can distinguish several versions of the same file by this value, even if the “official” version number was not altered.

Date and Time Stamp

TimeStamp hexadecimal value is to be converted to Decimal Value and by using Unix Time Stamp we are able find the actual date and time when this executable was compiled.

Time Stamp Hexadecimal Value : 65 30 16 D6

Decimal Value : 1,69,76,30,590

Date and Time from www.unixtimestamp.com :

Wed Oct 18 2023 17:33:10 GMT+0530 (India Standard Time)

9) Characteristics:

This tells about the memory access rights for that section in memory denoted as flags (R, RW, RWE, etc..). These flags describe whether the section is executable, readable, writable, or some combination of these.

Characteristics Value : 01 03

1. “File is executable flag value = 0x01”: This flag indicates that the file is executable.
2. “Relocation info stripped from the file flag value = 0x03”: This flag indicates that relocation information has been stripped from the file.
3. “32 bit word machine”

Using HeX editor find the architecture and if file is Exe or dll.

After the PE signature the alphabet “L” is present in the ASCII window so it is a 32 bit file.

If after the PE signature the alphabet “d” is present in the ASCII window then it is a 64 bit file.

10) Calculation for VA ie Virtual Address :

• ImageBase: 0x00004000
• AddressOfEntryPoint: 0x00008E50

To calculate the VA of the AddressOfEntryPoint:

VA = ImageBase + RVA (Relative Virtual Address) of AddressOfEntryPoint VA = 0x00004000 + 0x00008E50 = 0x00012E50

11) Overlays : Not Present

Size of Image : 680 kb

Actual Size : 668 kb

Step 2 : STATIC ANALYSIS

Static Analysis is like taking a snapshot of a file without actually running it. It involves examining the file’s structure, code, and characteristics to understand its potential threats. It’s akin to inspecting the outside of a box before opening it to see what’s inside. Static analysis is a key tool in malware analysis, helping us identify suspicious patterns and behaviors without executing the file.

Footprints :

MD5 : d6a62a6d0298ca59fce4665c57aaf05f

SHA1 : 1a2067f73e5167929cddd7b3f51f16a674c74fbe

1. Its an .exe file but it resembles .pdf file

You can check it by checking the properties of that file.

2. File Type :

Get Siddhesh Chikhale’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To check file type, you can use CFF tool and check the characteristics of that file by following this step :

CFF Explorer-> file header -> characteristics -> file is executable

Yes we can see here, its .exe file as the tick is on the option File is executable.

As well as its a 32 bit.

We can check that in EXEinfoPE tool

Check whether the file is packed or unpacked, we can again use EXEinfoPE tool.

Here there is digital Certificate symbol (Red Color Badge) But the certificate is not present

Entropy :

As we know the value of entropy between near to 7 and 8 means that it is packed.

We can use Detect It Easy Tool to check.

In this we can see in section, .text and .rsrc has entropy in range near of 7 which means the they are only packed.

We can check if the file is packed or not in various tools. If the file is packed by known packer such as “UPX Packer” then we can unpack the whole file using UPX packer tool available on internet and analyze it.

Compiler : Microsoft Visual C++ 9.0

GUI/SubSystem : Console

Time Stamp : Wed Oct 18 17:33:10 2023 | UTC

This Basic Info you will get on any tool like PE Studio.

But I will prefer that use PE Studio at the last as it is very advance, it will detect everything and you will get a cherry on cake without any knowledge.

Import Address Table ( IAT )

Here have listed all the imports API which have potential of suspicious activity.

We can enlist all these API by clicking on “FLAG” column in PE Studio.

Some of them are explained as follows :

EnumResourceNamesA is an API function in Windows that is used to enumerate the names of resources within a specified module (executable or DLL). It is commonly utilized by legitimate software for tasks like extracting resource information from files.

An attacker could potentially use this API for various purposes:

1. Resource Enumeration: Attackers scan for valuable resources like code, configurations, or sensitive data in legitimate files using EnumResourceNamesA.
2. Data Extraction: The API helps attackers uncover hidden or encrypted data, including malicious code or critical details for their activities.
3. Payload Delivery: EnumResourceNamesA locates malicious payloads within legitimate files, enabling attackers to compromise systems.
4. Obfuscation: Attackers hide malicious code within larger, harmless executables using resource names and EnumResourceNamesA for access.

GetCurrentProcessId function is an API in Windows that simply retrieves the unique Process ID (PID) of the current running process. It is typically used by legitimate programs to identify themselves or to interact with other processes.

An attacker could potentially utilize this API for:

1. Process Identification: Attackers may use GetCurrentProcessId to identify the PID of their own or other running processes. This information can be valuable for coordinating malicious activities.
2. Process Injection: In some cases, attackers might employ this API to identify the current process and target it for code injection. By knowing the PID, they can inject malicious code into the identified process, potentially compromising it.
3. Anti-Analysis Techniques: Malware can use this API as part of anti-analysis techniques to detect and evade debugging or sandbox environments. If the PID matches known analysis tools, the malware might behave differently or terminate to avoid detection.

VirtualAlloc is a Windows API function used to allocate a block of memory within the virtual address space of a process.

An attacker could potentially utilize this API for:

1. Memory Allocation for Malware: Attackers use VirtualAlloc to set aside memory space for their malicious code, hiding within a legitimate process to evade detection.
2. DLL Injection: VirtualAlloc allocates memory for a malicious Dynamic Link Library (DLL) that can be injected into a legitimate process, potentially compromising the host system.
3. Heap Spray Attacks: Malicious actors employ VirtualAlloc for heap spraying, loading large data into memory with malicious intent. This can exploit software vulnerabilities or facilitate attacks like buffer overflows.
4. Memory-Based Evasion: Some malware utilizes VirtualAlloc to modify or allocate memory in ways that disrupt security tools and avoid detection, complicating threat identification and mitigation.

GetEnvironmentStrings is a Windows API function that retrieves the environment variables of a process. This information includes settings, configurations, and paths that the process uses. Attackers might exploit it to gain insight into a system’s environment or to manipulate settings to their advantage.

RaiseException is a Windows API function that allows a program to generate structured exception handling (SEH) exceptions. While it is typically used for legitimate error reporting and handling within software, it can also be misused by malicious actors to trigger exceptions as part of exploitation or to disrupt the normal execution of a program, potentially leading to security vulnerabilities.

Strings :

Some Strings were found which I think can be malicious.

these strings looks suspicious as we can see some of them are saying that there is some bug present in your application or Application making requests etc.

Threat Intelligence Reports :

1. Virus Total

Malware Family :

1. Fragtor : Type of malware known for performing malicious activities without the user’s knowledge. The activities you mentioned, such as establishing remote access, capturing keyboard input, collecting system information, and other malicious actions, are characteristic of trojans.

2. Romcos : Remcos or Remote Control and Surveillance, marketed as a legitimate software by a Germany-based firm Breaking Security for remotely managing Windows systems is now widely used in multiple malicious campaigns by threat actors. Remcos is a sophisticated remote access Trojan (RAT) that can be used to fully control and monitor any Windows computer.

3. Pwsx : The Spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users

STEP 3 : DYNAMIC ANALYSIS

Dynamic Analysis is like observing how a software program behaves while it’s running. It involves monitoring its actions, interactions, and responses in real-time to understand its behavior, spot anomalies, and detect malicious activities. Dynamic analysis is a critical part of malware analysis, helping us uncover threats that may not be visible through static analysis alone.

Steps one should perform while Dynamic Analysis :

1. First Download the necessary tools like RegShot, Sysinternal Tools, HashCalculator, WireShark to capture network flow, 7zip
2. In SysInternals, you will get tools like Procmon, Procexe, Autoruns which are very important while perfoming Dynamic Analysis.
3. Before Performing Dynamic analysis, make sure you take a checkpoint of your Hyper — V.

After performing Dynamic Analysis, you can just Revert it back to the checkpoint for safety purpose.

Let’s Begin with Dynamic Analysis :

1. Extract the malware using 7zip.
2. Run all the tools mentioned above with administrative permission.
3. Take a Regshot-1 of system.
4. Execute the malware by double clicking it and wait for few minute.
5. Take a Regshot-2 of system.
6. Look for process tree in Procmon.
7. Check the Regshot output and changes it made in registries.
8. Also look for any network activity and files dropped if any.

Before Executing make sure you have open ProcExp and ProcMon and Wireshark.

ProcExplorer

Open Process Monitor :

After Applying Filter to the desired Process and it’s all operation will be listed.

Applying Filter by using Process Name

Applying Filter

ProcMon

Now Open Process Tree using ctrl+T

The Above Tree is created by the file which we executed.

The process was using Conhost.exe

Conhost.exe, short for Console Host, is a legitimate and essential Windows system process responsible for managing and hosting console-based applications. It plays a crucial role in providing a text-based console window for command-line interfaces, also known as the Windows Command Prompt or PowerShell.

Few ways an attacker might attempt to use Conhost.exe for malicious purposes:

1. Concealing Malicious Activity: An attacker might launch a console-based malicious tool or script from a Conhost.exe window in an attempt to blend in with legitimate command-line activity, making it harder for security tools to detect the malicious process.
2. Running Malware: Attackers could use Conhost.exe to run malicious scripts or payloads through the Windows Command Prompt or PowerShell. This can be a way to execute malware or initiate further malicious actions.
3. Obfuscation: Conhost.exe might be used as part of an obfuscation technique to hide malicious commands or scripts in the command-line interface, making it less obvious to an observer or security tool.
4. Exploiting Vulnerabilities: If there were a vulnerability or weakness in the Conhost.exe process itself, attackers could potentially exploit it to gain elevated privileges or execute arbitrary code on the system.

It can be the posibility that process has spawned by suspicious parent process which coul dbe indicative of process injection.

Some Network Activity was seen.

To Confirm this wireshark was used which showed clear indication about the ip.

A menge.duckdns.org :

Allows you to bind your own favorite subdomain under duckdns.org to the public IP address in use from your router, allows you to bind your own favorite subdomain under duckdns.org to the public IP address in use from your router. Might be used for dns spoofing.

On VirusTotal we found that url as malicious :

Also we can check whether its trying to connect to some ip in procExplorer

Establishing connection with ip which we found as malicious : 185.214.10.18

Also some folders were added : (check RegShot Text Output)

In that files was added named logs.dat

You can open it and check what’s inside it.

It found It contained unidentified language.

Conclusion :

By performing Static and Dynamic Analysis we can conclude that file is malware. It Established connection to command and control channel and Also collects data/Make Changes in the log file.

Hence We can say that the File is Malware.