Matthew Profile picture
Jan 16 3 tweets 4 min read
Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes.

Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate.

1/

#Malware #dnspy #analysis #RE
2/ For anyone wanting to try - The initial sample can be in the link below

Once executed (inside of a safe vm!) - You should see the installutil.exe detailed in the screenshots above.

(Make sure to use Dnspy-x86 for attaching to the process) 😄

bazaar.abuse.ch/sample/b24c75d…
3/ Sometimes you'll get lucky and the modules will be named much more suspiciously.

See below for an example of a suspected #redlinestealer loader. Which injected multiple modules into a renamed powershell.exe.

bazaar.abuse.ch/sample/7e09174…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Matthew

Matthew Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @embee_research

Jan 16
(Possible) AsyncRat loader - Interesting regex to decode the obfuscated C2.

Script was found on host with an active #AsyncRat infection.

#malware #regex #decoding
[1/6] The team at @HuntressLabs are still observing IronPython executables used to load #malware.

In these cases - IronPython (ipyw.exe) file is typically renamed to SupportTool.exe or Ctfmon.exe

Since ipyw.exe is "legitimate", the VT detection rate is very low (0/72).
[2/6] The "update.py" is where the malicious action starts.

This is usually a simple python file containing an additional obfuscated script.

Below you can see this decoded via #CyberChef.
Read 7 tweets
Jan 3
Setting up an analysis VM for reverse engineering?

Here are a few good tools (with short demos) that I recommend after running the Mandiant/FLARE script, (which installs 99% of tooling for you) 🔥

TLDR:
Garbageman, SpeakEasy, BlobRunner, Dumpulator

#Malware #RE #Analysis
2/ This is the Flare script from Mandiant. Simply running this script will install the majority of tools that you would ever need.

As a beginner RE or malware analyst, you can work comfortably using only the tools included in this script.

github.com/mandiant/flare…
3/ Over time I've picked up some other tooling that isn't installed by default by Flare.

These are relatively lesser-known tools that I have found very useful.
Read 12 tweets
Nov 14, 2022
🐲 Ghidra Tips 🐲- Malware Encryption and Hashing functions often produce byte sequences that are great for #Yara rules.

Using #Ghidra and a Text Editor - You can quickly develop Yara rules to detect common malware families.
(Demonstrated with #Qakbot)

[1/20]
#Malware #RE
[2/20]
Hashing and encryption functions make good targets for #detection as they are reasonably unique to each malware family and often contain lengthy and specific byte sequences due to the mathematical operations involved.

These characteristics make for good Yara rules 😁
[3/20] The biggest challenge is locating the functions responsible for hashing and encryption. I'll leave that for another thread, but for now...

You can typically recognize hashing/encryption through the use of bitwise operators inside a loop. (xor ^ and shift >> etc).
Read 22 tweets
Oct 18, 2022
🐲 Ghidra Tips🐲For Beginner/Intermediate analysts interested in RE.

These tips are aimed at making Ghidra more approachable and usable for beginners and intermediate analysts 😄

[1/9] 🧵

#Malware #RE #Ghidra
2/ The sample I'm using can be found here if you'd like to follow along. It is a cobalt strike DLL often found in Gootloader campaigns.

bazaar.abuse.ch/sample/a2513cc…
3/ Enable "Cursor Text Highlighting". 🖱️

This will automatically highlight areas of interest when using the Ghidra decompiler.

This is useful for quickly identifying where a value has or will be used.
Read 9 tweets
Oct 2, 2022
#Qakbot Dumpulator Script has now been added to Github! 😀

This script is capable of dumping decrypted strings from the encrypted string table used by recent Qakbot malware.

1/ (notes and details below)
#malware #qakbot #dumpulator #RE ImageImageImageImage
2/ The script *should* work on the samples that I have provided in the readme, however you may need to change some register values to get it to work on different samples.

In particular, "dp.regs.ecx" and "dp.regs.esp+0x4" may need to be changed. As these ... Image
3/ cont'd... as these values point to the encrypted string table and key, which will differ between samples. You can re-use the same dump file if you wish, as the code will likely remain the same.
Read 11 tweets
Sep 25, 2022
A quick demo of how to identify "real" exported functions from a #obfuscated #IcedID dll file.

I'll also briefly touch on some #Ghidra tips, and how to extract #shellcode using a debugger.

A moderate sized thread😃
[1/13]
[2/13] You can find the relevant files here. Special thanks to @malware_traffic.

First, download the .zip in the screenshot.👇

Then unzip and locate the "rarest.db" file in the "scabs" folder.

(Make sure to do this inside an isolated Virtual Machine)
malware-traffic-analysis.net/2022/09/23/ind…
[3/14] Drag the "rarest.db" file into Pe-Studio and navigate to the exports tab.

There are 11 exported functions here. 🧐

Most of them have junk names to throw off analysis.

One of them is "real", the rest are "decoys" which don't do anything if executed.
Read 14 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(