Upload File

advanced malware analysis training session6 malware sandbox analysis

  • Home
  • Technology
  • Advanced malware analysis training session6 malware sandbox analysis
26
Malware Sandbox Analysis Monnappa KA Advanced Malware Analysis Training Series

Upload: cysinfo-cyber-security-community

Post on 09-Jan-2017

155 views

Category:

Technology


3 download

Report

TRANSCRIPT

Page 1: Advanced malware analysis training session6 malware sandbox analysis

Malware Sandbox AnalysisMonnappa KA

Advanced Malware Analysis Training Series

Page 2: Advanced malware analysis training session6 malware sandbox analysis

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working.

However in no circumstances neither the Trainer nor Cysinfo is responsible for any damage or loss caused due to use or misuse of the information presented here.

Page 3: Advanced malware analysis training session6 malware sandbox analysis

Acknowledgement

Special thanks to Null community for their extended support and co-operation.

Special thanks to ThoughtWorks for the beautiful venue.

Thanks to all the trainers who have devoted their precious time and countless hours to make it

happen.

Page 4: Advanced malware analysis training session6 malware sandbox analysis

Advanced Malware Analysis Training

This presentation is part of our Advanced Malware Analysis Training program. Currently it

is delivered only during our local meets for FREE of cost.

Page 5: Advanced malware analysis training session6 malware sandbox analysis

Who am I?Monnappa

Member, Cysinfo

Info Security Investigator @ Cisco

Reversing, Malware Analysis, Memory Forensics.

Email: [email protected]

Twitter: @monnappa22

LinkedIn: http://www.linkedin.com/pub/monnappa-ka-grem-ceh/42/45a/1b8

mailto:[email protected]
http://www.linkedin.com/pub/monnappa-ka-grem-ceh/42/45a/1b8
Page 6: Advanced malware analysis training session6 malware sandbox analysis

Sandbox Overview

Why Sandbox Analysis

Sandbox Architecture

Online Sandboxes

Custom Sandbox (Sandbox.py)

Sandbox.py working

Sandbox.py report

Demo 1&2 (Sandbox Analysis)

Content

Page 7: Advanced malware analysis training session6 malware sandbox analysis

Execute malware in a controlled/monitored environment Monitors file system, registry, process and network activity Outputs the results in multiple formats Examples of Sandboxes

◦ Cuckoo Sandbox◦ ThreatExpert◦ Anubis◦ CWSandbox

Sandbox Overview

Page 8: Advanced malware analysis training session6 malware sandbox analysis

To determine: The nature and purpose of the malware Interaction with the file system Interaction with the registry Interaction with the network To determine identifiable patterns

Why Sandbox Analysis?

Page 9: Advanced malware analysis training session6 malware sandbox analysis

Sandbox Architecture

Controller

Reports ArtifactsPCAPS

Host Machine Analysis Machine (VM)

Reports

LaunchSample

Samples

Sub

mit

Monitoring tools

Page 10: Advanced malware analysis training session6 malware sandbox analysis

Online Sandbox –ThreatExpert results

Page 11: Advanced malware analysis training session6 malware sandbox analysis

Online Sandbox –CWSandbox results

Page 12: Advanced malware analysis training session6 malware sandbox analysis

Online Sandbox –Anubis results

Page 13: Advanced malware analysis training session6 malware sandbox analysis

Automates static, dynamic and Memory analysis using open source tools

Written in python

Can be run in sandbox mode or internet mode

In sandbox mode it can simulate internet services (this is the default mode)

Allows you to set the timeout for the malware to run (default is 60 seconds)

Stores final reports, pcaps, desktop screeshot , and malicious artifacts for later analysis

Custom Sandbox – sandbox.py

Page 14: Advanced malware analysis training session6 malware sandbox analysis

Takes sample as input

Performs static analysis

Reverts VM to clean snapshot

Starts the VM

Transfers the malware to VM

Runs the monitoring tools ( to monitor process, registry, file system, network activity)

Executes the malware for the specified time

Sandbox.py (working)

Page 15: Advanced malware analysis training session6 malware sandbox analysis

Stops the monitoring tools

Suspends the VM

Acquires the memory image

Performs memory analysis using Volatility framework

Stores the results (Final reports, destkop screenshot, pcaps and malicious artifacts

for later analysis)

Sandbox.py (working contd)

Page 16: Advanced malware analysis training session6 malware sandbox analysis

Static analysis results:

File type (uses magic python module)

Cryptographic hash (md5sum – uses hashlib python module)

VirusTotal results (python script using VirusTotal’s public api)

Determines packers used by malware (uses yara-python)

Determines the capabilities of the malware like IRC, P2P etc etc (uses yara-python module)

Sandbox.py Report

Page 17: Advanced malware analysis training session6 malware sandbox analysis

Dynamic analysis results:

Determines File system activity

Determines Process activity

Determines Registry activity

Monitor Network activity

Displays DNS summary

Shows TCP conversations

Displays HTTP requests & HTTP request tree

Sandbox.py report

Page 18: Advanced malware analysis training session6 malware sandbox analysis

Memory analysis results:

uses Volatility advanced memory forensics framework

displays process, hidden process in memory

displays network connections, terminated network connections

displays listening sockets

determines api hooks, code injection and embedded executable in memory

displays DLL’s loaded by the process memory

displays services in memory

displays the registry keys (like run registry key)

Sandbox.py report

Page 19: Advanced malware analysis training session6 malware sandbox analysis

DEMO 1, 2 & 3(SANDBOX ANALYSIS)

Page 20: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – Help optionThe below screenshot shows the sandbox.py help option

Page 21: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – InputThe below screenshot shows the sandbox.py taking sample as input to run it for 30 seconds

Page 22: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – Static AnalysisThe below screenshot shows the static analysis results after executing the sample

Page 23: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – Dynamic AnalysisThe below screenshot shows the dynamic analysis results after executing the sample

Page 24: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – Network ActivityThe below screenshot shows the network activity after executing the sample

Page 25: Advanced malware analysis training session6 malware sandbox analysis

Sandbox.py – Memory AnalysisThe below screenshot shows the memory analysis results after executing the sample

Page 26: Advanced malware analysis training session6 malware sandbox analysis

Thank You !


Detecting Evasive Malware in Sandbox

FireEye Wins Global Advanced Malware Sandbox … Global Advanced Malware Sandbox Market ... security solutions that guide customers from ... the 2016 Advanced Malware Sandbox Market

Técnicas para el desarrollo de malware funcionamiento de los antivirus y sandbox

Think Outside the Sandbox Cisco AMP (Advanced Malware ... · Think Outside the Sandbox Cisco AMP (Advanced Malware Protection) Cisco Connect 2015 Today’s advanced malware is not

Advanced Malware Sandbox Market Analysis - FireEye · K083-74 1 K083-74 September 2016 Advanced Malware Sandbox Market Analysis “Must Have” Security Technology Reaches Mass Adoption

Forcepoint Advanced Malware Detection Appliance 3 · Forcepoint Advanced Malware Detection Appliance has an extensive ecosystem leveraging ... SANDBOX ThINK behavioral analysis is

Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

Norman SandBox Analyzerdownload01.norman.no/product_sheets/eng/SandBox_analyzer.pdf · Norman SandBox Analyzer Analyzing malware can be a cumbersome and time consuming ... internet

COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED … · COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED BY MALWARE ... •State of the Art malware analysis systems use

NSC-JST workshop · Fighting Malware & Botnets – Introduction ... Automated dynamic malware Behavior Analysis ... summary based on Cuckoo Sandbox

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Hack&Beers Cadiz Análisis de Malware Cuckoo Sandbox

Cuckoo Sandbox: Automated malware analysis

Duping the machine: malware strategies, post Sandbox detection · Duping the machine: malware strategies, post Sandbox detection VB2014. 2 ... ￮IP address of Sandbox machine appears

Sandbox: Análisis dinámico de malware - UNAM- · PDF fileSandbox para el análisis dinámico de malware Implementado en Cuckoo sandbox Análisis del tráfico de red Archivos que

Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis

Inside the Matrix,How to Build Transparent Sandbox for Malware Analysis

Malware Analysis without Sandbox - ETDA · July 4, 2017 MCAFEE CONFIDENTIAL 1 McAfee CONFIDENTIAL Malware Analysis without Sandbox Nishant Ranjan | Regional Solutions Architect -

Automating Linux Malware Analysis Using Limon sandbox · Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A [email protected] A number of devices are running Linux

Detectionofdebuggeraware malware - Aalborg Universitetprojekter.aau.dk/projekter/files/213622016/master.pdf · Detectionofdebuggeraware malware Project Report ... and a Cuckoo Sandbox

FireEye Wins Global Advanced Malware Sandbox Market

HERE - Cuckoo Sandbox - Automated Malware Analysis€¢Creator of Cuckoo Sandbox •Founder of Malwr.com HERE •Mark “rep” Schloesser @repmovsb •Security Researcher at Rapid7

Automated Malware Analysis Report for ... - Joe Sandbox

Deep Malware Analysis - Joe Sandbox Sandbox Desktop Feature... · Sample: b19411d.js Startdate: 29/03/2016 Architecture: WINDOWS Score: 100 ... Sandbox Desktop Deep Malware Analysis

Think Outside the Sandbox Cisco AMP (Advanced Malware ... · PDF fileCisco AMP (Advanced Malware Protection) ... Think Outside the Sandbox Cisco AMP (Advanced Malware Protection)

PUBLIC - nebelwelt.netnebelwelt.net/publications/teaching/19-412-SoSe/slides/CTI.pdf · • Sandbox Malware analysis • Debugger Malware analysis • Static RE with IDA pro EPFL

VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

Cuckoo Sandbox - University of Delawarecavazos/cisc850-spring2017/...CISC 850 : Cyber Analytics Cuckoo Sandbox • Automated malware analysis system. • Uses virtualization and supports

STEALTH SANDBOX ANALYSIS OF MALWARE

Tasty Malware Analysis with T.A.C.O. - FIRST · Tasty Malware Analysis with T.A.C.O. ... Malware Analysis Challenges ... • DLL Side-loading 9. Cuckoo Sandbox • Popular open-source

Malware Sandbox Analysis

Your Personal, Portable, Malware Analysis … Personal, Portable, Malware Analysis Sandbox Brian ... Services\HTran\DisplayName = Proxy ... Services\HTran\Description = HUC Socks5

Frost & Sullivan Advanced Malware Sandbox Market Analysis

Installing and Using Cuckoo Malware Analysis Sandbox

Linux Malware Analysis using Limon Sandbox