Malware Analysis Techniques: Tricks for the triage of adversarial software

282 Pages·2021·14.668 MB·English

by  Dylan Barker

Malware Analysis
Techniques
Tricks for the triage of adversarial software
Dylan Barker
BIRMINGHAM—MUMBAI
Malware Analysis Techniques
Copyright © 2021 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted
in any form or by any means, without the prior written permission of the publisher, except in the case of
brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information
presented. However, the information contained in this book is sold without warranty, either express or
implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for
any damages caused or alleged to have been caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and
products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot
guarantee the accuracy of this information.
Group Product Manager: Wilson Dsouza
Publishing Product Manager: Rahul Nair
Senior Editor: Arun Nadar
Content Development Editor: Sayali Pingale
Technical Editor: Sarvesh Jaywant
Copy Editor: Safis Editing
Project Coordinator: Shagun Saini
Proofreader: Safis Editing
Indexer: Pratik Shirodkar
Production Designer: Aparna Bhagat
First published: May 2021
Production reference: 1200521
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
978-1-83921-227-7
www.packt.com
To Merandia, who has patiently listened to me babble about technical
minutiae for nearly a decade.To Emily, who pushed me forward and kept
me making progress, and to several wonderful mentors over the years: Rex
Riepe, Micah Jackson, and Eric Overby.
– Dylan Barker
Contributors
About the author
Dylan Barker is a technology professional with 10 years' experience in the information
security space, in industries ranging from K12 and telecom to financial services. He
has held many distinct roles, from security infrastructure engineering to vulnerability
management. In the past, he has spoken at BSides events and has written articles for
CrowdStrike, where he is currently employed as a senior analyst.
About the reviewer
Quinten Bowen is an information security professional with 5 years of experience in the
industry. Currently, Quinten works at one of the most respected and leading cybersecurity
organizations in the nation. Furthermore, Quinten has expertise in malware analysis,
penetration testing, threat hunting, and incident response in enterprise environments,
holding relevant certifications such as GREM, OSCP, eCPPT, and eCMAP. Additionally,
Quinten spends his off-time volunteering for the Collegiate Cyber Defense Competition
(CCDC) and mentoring where possible.
I would like to thank my wife, Jessica, for her continued support in
everything I do. You've always been supportive and I sincerely appreciate
all you do for us.
To my mother and father, Lisa and Roger, who raised me to be the man
I am today. You always said I could do anything, and so I set out to do
what I love.

Table of Contents
Preface
Section 1: Basic Techniques
1
Creating and Maintaining your Detonation Environment
Technical requirements 4 Installing the FLARE VM package 13
Setting up VirtualBox with Isolating your environment 16
Windows 10 4 Maintenance and snapshotting 19
Downloading and verifying VirtualBox 5 Summary 22
Installing Windows 10 6
2
Static Analysis – Techniques and Tooling
Technical requirements 24 Picking up the pieces 35
The basics – hashing 24 Malware serotyping 36
Hashing algorithms 24 Collecting strings 37
Obtaining file hashes 25
Challenges 40
Avoiding rediscovery of the Challenge 1 40
wheel 27 Challenge 2 40
Leveraging VirusTotal 27
Summary 40
Getting fuzzy 31 Further reading 40
ii Table of Contents
3
Dynamic Analysis – Techniques and Tooling
Technical requirements 42 Service installation 57
Detonating your malware 42 Uncovering common techniques 58
Final word on persistence 59
Monitoring for processes 43
Network IOC collection 46 Using PowerShell for triage 59
Discovering enumeration by Persistence identification 60
the enemy 49 Registry keys 60
Domain checks 50 Service installation 63
System enumeration 50 Scheduled tasks 63
Network enumeration 52 Less common persistence mechanisms 65
Case study – Dharma 53 Checking user logons 66
Discovering persistence Locating secondary stages 66
mechanisms 54 Examining NTFS (NT File System)
Run keys 54 alternate data streams 67
Scheduled tasks 56 Challenge 68
Malicious shortcuts and start up folders 56 Summary 68
4
A Word on Automated Sandboxing
Technical requirements 70 Configuring Cuckoo 94
Using HybridAnalysis 70 Network configuration 97
Cuckoo web UI 98
Using Any.Run 80
Running your first analysis in Cuckoo 100
Installing and using Cuckoo
Sandbox 87 Shortcomings of automated
analysis tools 102
Cuckoo installation – prerequisites 88
Installing VirtualBox 90 Challenge 102
Cuckoo and VMCloak 91 Summary 103
Defining our VM 92
Table of Contents iii
Section 2: Debugging and Anti-Analysis –
Going Deep
5
Advanced Static Analysis – Out of the White Noise
Technical requirements 108 Detecting packers 120
Dissecting the PE file format 108 Unpacking samples 123
The DOS header 109 Utilizing NSA's Ghidra for
PE file header 111 static analysis 123
Optional header 112
Setting up a project in Ghidra 124
Section table 115
The Import Address Table 116 Challenge 131
Summary 131
Examining packed files
Further reading 132
and packers 120
6
Advanced Dynamic Analysis – Looking at Explosions
Technical requirements 134 ApateDNS 151
Monitoring malicious processes 134
Hiding in plain sight 155
Regshot 135
Types of process injection 156
Process Explorer 139
Detecting process injection 158
Process Monitor 139
Getting away with it 149 Case study – TrickBot 160
Challenge 164
Network-based deception 150
Summary 164
FakeNet-NG 150
7
Advanced Dynamic Analysis Part 2 – Refusing to Take the
Blue Pill
Technical requirements 166 Leveraging API calls to
understand malicious
capabilities 166