Share this page!

Matthew Profile picture
Twitter logo
Jan 3 • 12 tweets • 4 min read
Setting up an analysis VM for reverse engineering?

Here are a few good tools (with short demos) that I recommend after running the Mandiant/FLARE script, (which installs 99% of tooling for you) 🔥

TLDR:
Garbageman, SpeakEasy, BlobRunner, Dumpulator

#Malware #RE #Analysis
2/ This is the Flare script from Mandiant. Simply running this script will install the majority of tools that you would ever need.

As a beginner RE or malware analyst, you can work comfortably using only the tools included in this script.

github.com/mandiant/flare…
3/ Over time I've picked up some other tooling that isn't installed by default by Flare.

These are relatively lesser-known tools that I have found very useful.
4/ TLDR: In no particular order.

Garbageman, SpeakEasy, BlobRunner, Dumpulator,
5/ Garbageman - A tool that executes .NET malware and automatically analyzes values allocated in memory.

This can be used to find strings, ioc's and hidden payloads in heavily obfuscated files.

labs.withsecure.com/tools/garbagem…
github.com/WithSecureLabs…
6/ SpeakEasy - An emulation tool that I use to "run" shellcode.

This tool runs code inside an emulator, and prints any executed api's (with arguments).

This is great for quickly identifying functionality in shellcode (even if API hashing is used).
github.com/mandiant/speak…
6.1/ I've previously demonstrated Speakeasy when emulating the shellcode detailed in my API hashing blog.

(About 2/3 into the blog)

huntress.com/blog/hackers-n…
7/ Blobrunner - A small program that loads shellcode and allows you to analyse using a debugger.

This is useful when you want to manually debug, execute or inspect shellcode files. Particularly more advanced files that don't play nice with Speakeasy.

github.com/OALabs/BlobRun…
7.1/ I've demonstratedd Blobrunner in the same blog mentioned prior.

A bit over 2/3 into the blog, I used blobrunner to execute a piece of modified shellcode and confirm that it was working as intended.

huntress.com/blog/hackers-n…
8/ Dumpulator - A useful library for emulating specific functions from pe files.

This can be extremely useful for creating decoders and config extractors.

github.com/mrexodia/dumpu…
8.1/ An example of a Dumpulator script can be found in my previous post about decrypting Qakbot Strings.
9/There are a few other well-known tools that I manually install as the latest versions are not always included in Flare.

Eg, Ghidra, CyberChef, Process Hacker, Pe-Studio, Pe-Bear, Process Hacker.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Matthew

Matthew Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @embee_research

Matthew Profile picture
Nov 14, 2022
🐲 Ghidra Tips 🐲- Malware Encryption and Hashing functions often produce byte sequences that are great for #Yara rules.

Using #Ghidra and a Text Editor - You can quickly develop Yara rules to detect common malware families.
(Demonstrated with #Qakbot)

[1/20]
#Malware #RE
[2/20]
Hashing and encryption functions make good targets for #detection as they are reasonably unique to each malware family and often contain lengthy and specific byte sequences due to the mathematical operations involved.

These characteristics make for good Yara rules 😁
[3/20] The biggest challenge is locating the functions responsible for hashing and encryption. I'll leave that for another thread, but for now...

You can typically recognize hashing/encryption through the use of bitwise operators inside a loop. (xor ^ and shift >> etc).
Read 22 tweets
Matthew Profile picture
Oct 18, 2022
🐲 Ghidra Tips🐲For Beginner/Intermediate analysts interested in RE.

These tips are aimed at making Ghidra more approachable and usable for beginners and intermediate analysts 😄

[1/9] 🧵

#Malware #RE #Ghidra
2/ The sample I'm using can be found here if you'd like to follow along. It is a cobalt strike DLL often found in Gootloader campaigns.

bazaar.abuse.ch/sample/a2513cc…
3/ Enable "Cursor Text Highlighting". 🖱️

This will automatically highlight areas of interest when using the Ghidra decompiler.

This is useful for quickly identifying where a value has or will be used.
Read 9 tweets
Matthew Profile picture
Sep 25, 2022
A quick demo of how to identify "real" exported functions from a #obfuscated #IcedID dll file.

I'll also briefly touch on some #Ghidra tips, and how to extract #shellcode using a debugger.

A moderate sized thread😃
[1/13]
[2/13] You can find the relevant files here. Special thanks to @malware_traffic.

First, download the .zip in the screenshot.👇

Then unzip and locate the "rarest.db" file in the "scabs" folder.

(Make sure to do this inside an isolated Virtual Machine)
malware-traffic-analysis.net/2022/09/23/ind…
[3/14] Drag the "rarest.db" file into Pe-Studio and navigate to the exports tab.

There are 11 exported functions here. 🧐

Most of them have junk names to throw off analysis.

One of them is "real", the rest are "decoys" which don't do anything if executed.
Read 14 tweets
Matthew Profile picture
Sep 11, 2022
Reverse Engineering a #CobaltStrike #malware sample and extracting C2's using three different methods.

We'll touch on #cyberchef, #x64dbg and Speakeasy from fireeye to perform manual analysis and emulation of #shellcode.

A (big) thread ⬇️⬇️
[1/23]
[2/23]
To follow along, download the sample from the link below. Then transfer the .zip into a safe VM environment.

My VM is a mostly default Flare VM with SpeakEasy installed on top.
bazaar.abuse.ch/sample/08ec3f1…
[3/23] Once unzipped (pw:infected), load the file into pe-studio for quick analysis. There isn't a lot interesting here, but take note that the file a 64-bit .dll with 4 exported functions.
Read 23 tweets
Matthew Profile picture
Jul 19, 2022
#ChromeLoader #malware persists via obfuscated content stored in the registry. Here's how to decode it using #Cyberchef.
1/ ImageImageImage
2/ First, locate a scheduled task containing content that you suspect to be chromeloader malware. Decode the first stage using "From Base64" and "Remove Null Bytes". This will give you the first stage loader in its #decoded form. Image
3/ Next, check the location of the next stage in the registry. This should be near the beginning of the code. Image
Read 11 tweets
Matthew Profile picture
Jul 17, 2022
If you utilise API hashing in your #malware or offensive security tooling. Try rotating your API hashes. This can have a significant impact on #detection rates and improve your chances of remaining undetected by AV/EDR. See below for an example with a Bind Shell vs #Virustotal.
Since API hashing can be confusing, most attackers won't rotate their hashes with each iteration of malware. Those same hashes can be a reliable detection mechanism if you can recognize them in code.
Luckily finding these hashes isn't too difficult, just look for random hex values prior to a "call rbp".
If you're unsure whether the value is an API hash, just google it and see if you get any hits. Most of the time, identification can be a simple google search away.
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Send Email!

:(