Matthew Profile picture
Sep 25, 2022 14 tweets 10 min read Read on X
A quick demo of how to identify "real" exported functions from a #obfuscated #IcedID dll file.

I'll also briefly touch on some #Ghidra tips, and how to extract #shellcode using a debugger.

A moderate sized thread😃
[1/13]
[2/13] You can find the relevant files here. Special thanks to @malware_traffic.

First, download the .zip in the screenshot.👇

Then unzip and locate the "rarest.db" file in the "scabs" folder.

(Make sure to do this inside an isolated Virtual Machine)
malware-traffic-analysis.net/2022/09/23/ind…
[3/14] Drag the "rarest.db" file into Pe-Studio and navigate to the exports tab.

There are 11 exported functions here. 🧐

Most of them have junk names to throw off analysis.

One of them is "real", the rest are "decoys" which don't do anything if executed.
[4/14] As a quick example, we can execute the 11th function using rundll32.

Using procmon, you can see the process exits almost immediately, and no new proceses are spawned.

The same will happen for all except 1 of the exported functions.
[5/14] To identify the "real" exported function, I typically use a disassembler.

For this example i'll use #Ghidra.

Open Ghidra and load your file. Then accept all the default settings.

Once Ghidra is loaded, browse to the Symbol Tree -> Exports.
[6/14] In exports (on the left), you should see the same exported function names as you saw in Pe-studio.

Pick one, then focus on the "decompile" view on the right.

(You can ignore the "listing" view in the middle of the screen for now)
[7/14] If you go through the exported functions one-by-one, you'll see that most are duds.

They just "return 0" 👀

This effectively does nothing and exits the malware.

If you encounter this, assume the function is a decoy and click on the next name available.
[8/14] Eventually, you'll find a function which contains a large amount of code.

Without using any crazy analysis skills, it's obvious that this function is different. 👀

In most cases, this is the function that contains "real" #malware code.
[9/14] Now that you have the "real" exported function, you have multiple options to continue analysis.

1⃣ Execute again with rundll32 and analyse with procmon.

2⃣ Continue delving with Ghidra.

3⃣ Use a debugger to execute from the "real" function.
[10/14] Option 1:

Return to rundll32 and execute the malware, this time using the "real" exported function.

From here you can use #procmon or #processhacker to observe further activity.

Look for process creations and file writes.
[11/14] Option 2:

Continue analysis using #Ghidra. Looking for suspicious behaviours and function calls.

In this case, you can quickly notice memory allocations using VirtualAllocEx 🌶️

⏬Below are some indicators that something suspicious is being decrypted or unpacked.
[12/14] Option 3:

Load the file into #x64dbg, then set execution to the newly found function.

Now you can set breakpoints on memory allocations (VirtualAlloc/VirtualAllocEx) and find decoded content.

I previously wrote about this concept here.
[13/14] For the purpose this thread, I've assumed that the analyst does not have access to the scripts which call rundll32 and load the dll.

Those scripts are in the "scabs" folder, you can play around with them and potentially skip the first few steps of this thread 😃
[14/14] That's it for today 🖐️

I'm hoping to write some beginner-friendly on Ghidra and Debuggers in future. So leave a comment if there's any topics you'd be interested in reading about 📘

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Matthew

Matthew Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @embee_research

May 28
Three Simple Methods For Analysing Malicious Documents

A quick overview of olevba, Microsoft Word, and Procmon for analysing malware documents and extracting embedded macro content.

[1/10] 🧵

#malware #maldocs


Image
Image
Image
Image
2/ You first need to obtain a maldoc.

For this analysis we'll be using a malicious document related to #MuddyWater. Which was initially shared in a post by @suyog41.

bazaar.abuse.ch/sample/d2809e3…
3/ Obtaining Macros With Olevba

The most simple method for maldoc analysis is to use the olevba tool provided with FlareVM.

This tool will automatically extract macro content and highlight any relevant IOC's. All in one short and simple command.

github.com/decalage2/olet…

Image
Image
Read 9 tweets
May 21
🚩Malware Analysis - Decoding a Latrodectus Loader Script

➡️Let's look at a recent Latrodectus loader that uses junk comments to confuse analysis and hide malicious code.

[1/11] 🧵
#malware #cyberchef


Image
Image
Image
Image
2/ Obtaining The Sample

The initial script can be found on Malware Bazaar with SHA256: 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9
3/ Opening the script in a text editor reveals a large number of junk comments.

In-between comments, are occasional lines of "real" code which make up the malware functionality.

Your first step is to remove the junk comments so that you can focus on the "real" code.
Image
Image
Read 11 tweets
Mar 24
Malware Deobfuscation With DnSpy and CyberChef 👨‍🍳

Let's look at some beginner tips for identifying encrypted data with DnSpy.

We'll then utilise CyberChef to recreate the decryption and obtain the address of the C2 server.

[1/12] 🧵

#malware #cyberchef
Image
Image
[2/] Finding encrypted strings

Config values are often initialised (and decrypted) early in execution. Hence the Entry Point is a great place to begin looking.

(In Dnspy, we can select a loaded file and use "Go To Entry Point")

Image
Image
Image
3/ Identifying Config Values

After locating the entry point, we can begin looking for signs of encrypted or obfuscated values.

The first method "Run" contains suspicious references to “”, as well as Arguments.IP and Arguments.Key StringDecrypt.Read
Image
Read 13 tweets
Jan 2
🔥Lumma Stealer - Manually Unpacking and Extracting C2's 🔥

Let's analyse a Lumma malware sample and manually unpack it with Dnspy and x32dbg.

We'll then leverage Ghidra and x32dbg to locate and decrypt four C2 addresses.

[1/24] 🖊️

#Malwareanalysis #Ghidra


Image
Image
Image
Image
1/ The initial sample can be found on Malware Bazaar

You can download it here if you'd like to follow along

bazaar.abuse.ch/sample/0ee580f…
2/ Checking What Were Up Against

Prior to manual analysis, we can submit the hash on @unpacme. This gives us an idea of how many "layers" of packing are present.

The initial sample is .NET based, but the payload is not. (This means we'll need both Dnspy and #Ghidra)
Image
Image
Read 25 tweets
Dec 30, 2023
How to Increase Your Engagement on Cyber-related Twitter Content ✏️

Tips and tricks learnt from writing about #malware on Twitter for 18 months😄

[1/9]
1/ Optimal Post Structure

Statement -> Explanation -> Conclusion

I've found this general flow is the easiest to create and for readers to follow. It follows the 1-2-1 structure by @Nicolascole77

If you don't yet have a post style/structure, this is a great place to start. Image
2/ Aim for Reposts Over Followers

The highest engagement posts are those that get reshared by large accounts.

You don't need a lot of followers for high engagement, as long as you can get reposted by someone who does. Image
Read 10 tweets
Dec 21, 2023
🔬Defeating Obfuscated .HTA Scripts to Obtain Cobalt Strike Shellcode 🔬

Let's look at Cyberchef, Manual Deobfuscation, Multi-stage script analysis and finally emulation to obtain a decoded C2.

[1/17]


Image
Image
Image
Image
2/ The analysis begins with obfuscated .hta script obtained from Malware Bazaar.

You can obtain the file here if you want to follow along.

bazaar.abuse.ch/sample/2c683d1…
3/ Initial Script Review.

The initial script contains multiple obfuscated strings, a partial powershell command, and a large blob of base64 text.
Image
Image
Read 17 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(