Upload File

analyzing malware evasion trend - first · 2019-03-05 · analyzing malware evasion trend first tel...

  • Home
  • Documents
  • ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader
32
ENSILO.COM BYPASSING USER-MODE HOOKS ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019

Upload: others

Post on 20-Apr-2020

8 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

ENSILO.COM

BYPASSING USER-MODE HOOKSANALYZING MALWARE EVASION TREND

FIRST Tel Aviv 2019

Page 2: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

2 // ENSILO.COM

ABOUT US

• Omri Misgav– Security Research Team Leader @ enSilo

– Reverse Engineering, OS internals

• Udi Yavo– CTO & Co-Founder @ enSilo

– Former CTO, Rafael Cyber Security Division

– Past speaker in Blackhat and RSA

• Our technical blog: BreakingMalware.com

https://www.breakingmalware.com/
Page 3: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

3 // ENSILO.COM

AGENDA

• Intro and background

• Bypass techniques analysis– Secondary DLL mapping

– Direct system call invocation

– Code splicing

• Comparison and takeaways

Page 4: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

4 // ENSILO.COM

INTRO

• Hooking is used to intercept function calls in order to alter or augment their behavior

• User-mode hooks are used in many security products and tools– AVs\NGAVs

– EDRs

– Sandboxes

– DLPs

– And more…

• Why?– Stable, simple (nevertheless, not without faults)

– Lack of Patch Protection

– Full context

• Bypasses exist for a very long time

• Last ~1.5 years there’s an increasing number of reports (malware and pentesters)

https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Captain-Hook-Pirating-AVs-To-Bypass-Exploit-Mitigations.pdf
Page 5: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

5 // ENSILO.COM

HOOKING BACKGROUND

Application

kernel32!CreateProcessA

kernel32!CreateProcessInternalA

kernel32!CreateProcessInternalW

ntdll!NtCreateUserProcess

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Kernel

User

Kernel

UserWOW64

User Application

Kernel32!ReadProcessMemory

KernelBase!ReadProcessMemory

ntdll!NtReadVirtualMemory

wow64cpu!X86SwitchTo64BitMode

wow64!Wow64SystemServiceEx

ntdll!NtReadVirtualMemory

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Page 6: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

6 // ENSILO.COM

• Control flow instructions

• Generating exceptions

function_B:0x403000: cc0x403001: 89 e50x403003: 83 ec 500x403006: …

int 3mov ebp, espsub esp, 0x50

function_A:0x401000: 550x401001: 89 e50x401003: 83 ec 400x401006: 500x401007: 8b 44 24 0c0x40100a: …

push ebpmov ebp, espsub esp, 0x40push eaxmov eax, [esp + 0xc]

HOOKING BACKGROUNDInline Hooks

hook_A:0x402000: 550x402001: 89 e50x402003: 83 ec 400x402006: e9 06 10 40 00

push ebpmov ebp, espsub esp, 0x40jmp function_A + 6

function_A:0x401000: e9 00 20 40 000x401005: 890x401006: 500x401007: 8b 44 24 0c0x40100a: …

jmp hook_Anoppush eaxmov eax, [esp + 0xc]

function_B:0x403000: 550x403001: 89 e50x403003: 83 ec 500x403006: …

push ebpmov ebp, espsub esp, 0x50

Page 7: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

7 // ENSILO.COM

BYPASS TECHNIQUES ANALYSISSecondary DLL mapping

Page 8: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

8 // ENSILO.COM

BYPASS TECHNIQUES

• ReadFile() + Reflective Loading

• FormBook, reported by FireEye

• Infostealer

• Referred to as "Lagos Island method“

• Loads ntdll.dll– Code injection and Process Hollowing

– File system and registry access

Manually Load DLL From Disk

https://www.fireeye.com/blog/threat-research/2017/10/formbook-malware-distribution-campaigns.html
Page 9: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

9 // ENSILO.COM

BYPASS TECHNIQUESManually Load DLL From Disk

Page 10: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

10 // ENSILO.COM

BYPASS TECHNIQUESManually Load DLL From Disk

Page 11: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

11 // ENSILO.COM

BYPASS TECHNIQUES

• CopyFile() + LoadLibrary()

• Hancitor, reported by MalwareBytes

• Downloader

• Copies kernel32.dll– Call CreateProcess as part of Process Hollowing

Clone DLL

https://blog.malwarebytes.com/threat-analysis/2018/03/hancitor-fileless-attack-with-a-copy-trick/
Page 12: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

12 // ENSILO.COM

BYPASS TECHNIQUESClone DLL

Page 13: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

13 // ENSILO.COM

BYPASS TECHNIQUESClone DLL

Page 14: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

14 // ENSILO.COM

BYPASS TECHNIQUES

• [Nt]CreateFile() + NtCreateSection(…, SEC_IMAGE, …) + ZwMapViewOfSection()

• Osiris, reported by MalwareBytes

• Banking trojan

• Remaps ntdll.dll– Process Doppelgänging\Hollowing hybrid (“Transacted Hollowing”)

Section Remapping

https://blog.malwarebytes.com/threat-analysis/2018/08/process-doppelganging-meets-process-hollowing_osiris/
Page 15: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

15 // ENSILO.COM

BYPASS TECHNIQUESSection Remapping

Page 16: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

16 // ENSILO.COM

BYPASS TECHNIQUES ANALYSISDirect system call invocation

Page 17: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

17 // ENSILO.COM

BYPASS TECHNIQUES

• Calling system calls directly

• DarkGate, reported by enSilo

• Crypto miner and stealer

• Used for Process Hollowing and writing to the registry

NTDLL Parsing

https://blog.ensilo.com/darkgate-malware
Page 18: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

18 // ENSILO.COM

BYPASS TECHNIQUESNTDLL Parsing

Page 19: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

19 // ENSILO.COM

BYPASS TECHNIQUESNTDLL Parsing

Application

kernel32!CreateProcessA

kernel32!CreateProcessInternalA

kernel32!CreateProcessInternalW

ntdll!NtCreateUserProcess

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Kernel

User

Kernel

UserWOW64

User Application

Kernel32!ReadProcessMemory

KernelBase!ReadProcessMemory

ntdll!NtReadVirtualMemory

wow64cpu!X86SwitchTo64BitMode

wow64!Wow64SystemServiceEx

ntdll!NtReadVirtualMemory

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Page 20: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

20 // ENSILO.COM

BYPASS TECHNIQUES

• Make system calls from within WOW64 emulation layer– 32-bit application on 64-bit Windows

• GlobeImposter, reported by enSilo

• Ransomware

• Used for Process Hollowing

Heaven’s Gate

https://blog.ensilo.com/globeimposter-ransomware-technical
Page 21: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

21 // ENSILO.COM

BYPASS TECHNIQUESHeaven’s Gate

Page 22: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

22 // ENSILO.COM

BYPASS TECHNIQUESHeaven’s Gate

Application

kernel32!CreateProcessA

kernel32!CreateProcessInternalA

kernel32!CreateProcessInternalW

ntdll!NtCreateUserProcess

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Kernel

User

Kernel

UserWOW64

User Application

Kernel32!ReadProcessMemory

KernelBase!ReadProcessMemory

ntdll!NtReadVirtualMemory

wow64cpu!X86SwitchTo64BitMode

wow64!Wow64SystemServiceEx

ntdll!NtReadVirtualMemory

ntoskrnl!...

ntoskrnl!NtCreateUserProcess

ntoskrnl!...

Page 23: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

23 // ENSILO.COM

BYPASS TECHNIQUES ANALYSISCode splicing

Page 24: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

24 // ENSILO.COM

BYPASS TECHNIQUES

• Rebuild function stubs elsewhere

• Commonly used by packers

• CodeFork’s Gamarue, reported by Radware

• Downloader for bots, spamming, miners…

• Copies the first instruction of library functions it uses

Code Splicing (a.k.a. Byte Stealing)

https://security.radware.com/malware/codefork-malware/
Page 25: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

25 // ENSILO.COM

BYPASS TECHNIQUESCode Splicing (a.k.a. Byte Stealing)

Page 26: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

26 // ENSILO.COM

BYPASS TECHNIQUESCode Splicing (a.k.a. Byte Stealing)

Page 27: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

27 // ENSILO.COM

BYPASS TECHNIQUESComparison

Technique Runtime Indicators Forensic Artifacts Drawbacks

Manually Load DLL From Disk

Callstacks missing relevant DLLs

Floating PE copy in memorySignificantly different from the

norm

Clone DLLCallstacks with unexpected

DLLsIdentical PEs in memory

Changes to file system

Lower level\dependencies can be hooked

Section Remapping Multiple mappings of same PE Multiple mappings of same PE Can’t be used for complex code

NTDLL Parsing Callstacks missing ntdll.dll Limited functionality

Heaven’s GateCallstacks missing WOW64

system DLLsLimited functionality

Code SplicingInternal\lower level\dependencies

can be hooked

Page 28: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

28 // ENSILO.COM

BYPASS TECHNIQUES

• Used by all sorts of malware families

• Sophisticated actors, though not necessarily APTs

• Usually to mask the initial steps and establishing foothold

• None of the techniques are actually new

• Some techniques are not as commonly used in the wild– Unhook Flashbang\ReflectiveDLLRefresher: detectible and reversible

– Bring Your Own Indexes (BYOI): version dependent

Summary

https://breakdev.org/defeating-antivirus-real-time-protection-from-the-inside/
https://github.com/CylanceVulnResearch/ReflectiveDLLRefresher
https://secrary.com/Random/BypassUserHooks/
Page 29: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

29 // ENSILO.COM

ANALYSIS AND DETECTION TACTICS

• Events regarding system DLLs can be used as indicators– Copy, multiple read\load operations

• Check the callstacks

• Place hooks\breakpoints at non-trivial locations

• Randomize as much as you can

• Hook many different layers (“mine” the path)

• Correlate user-mode and kernel-mode data

• Use information provided by the OS (ETW)

Page 30: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

30 // ENSILO.COM

CLOSING REMARKS

• These are only a handful of examples

• Trivial to implement, simple to use (most have source code available)

• Hardly any recent innovations, yet still very effective

• MITRE ATT&CK doesn’t reference hook bypassing as defense evasion

• Using user-mode hooks for security is not enough

https://attack.mitre.org/
Page 31: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

31 // ENSILO.COM

QUESTIONS?

[email protected] in/udiyavo @UdiYavo

[email protected]

www.breakingmalware.com

in/omri-misgav

Page 32: ANALYZING MALWARE EVASION TREND - FIRST · 2019-03-05 · ANALYZING MALWARE EVASION TREND FIRST Tel Aviv 2019. 2 // ENSILO.COM ABOUT US •Omri Misgav –Security Research Team Leader

THANK YOU

[email protected] in/udiyavo @UdiYavo

[email protected]

www.breakingmalware.com

in/omri-misgav


Analyzing and Detecting Emerging Internet of Things ...alasmary/docs/JIOT2925929.pdf · 1 Analyzing and Detecting Emerging Internet of Things Malware: A Graph-based Approach Hisham

PIN-point control for analyzing malware - RECON.CXPIN-point control for analyzing malware!!!! Jason Jones REcon 2014 1. Me Sr Sec Research Analyst @ Arbor ... NOT an in-depth intro

Hacking the Hacking Team - SANS€¢Hacking Operations & Forensics •Reverse engineering & Malware analysis •Cryptography & Evasion •Machine learning, big data analytics and visualization

Analyzing Malware Detection Efficiency with Multiple Anti-Malware Programs

Let your CSIRT do malware analysis, Recruit-CSIRT has … · Let your CSIRT do malware analysis, ... Self-introduction ... Advantages -「Capable of analyzing huge malware 」 •

Memory Forensics: Collecting & Analyzing Malware Artifacts from … · 2016. 10. 23. · Memory Forensics: Collecting and Analyzing Malware Artifacts from RAM . Volatility Modules

Malware Analysis Machine Learning Approach - DeepSec · Malware Analysis Machine Learning Approach ... malware activities Memory Analysis the act of analyzing a dumped memory image

A Survey On Automated Dynamic Malware Analysis Evasion and ... · Evasion Detection - Discussion Multi-system execution is a common solution for evasion detection Offline algorithms

Analyzing Sophisticated Android Malware with CodeInspect · Analyzing Sophisticated Android Malware with CodeInspect Siegfried Rasthofer. SOFTWAREENGINEERING ... A new Binary Analysis

Advance and Emerging Malware Evasion Techniques/media/imda/files/industry...Source: M-Trends Report Data Exfiltration 111011101101 Lateral Spread Exploit an application or OS vulnerability

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do

ì Software Reverse Engineering...Life as a Malware Analyst ìAt a minimum, they want to obfuscate their malware to avoid automated detection ìAnd they really don’t like you analyzing

Machine Learning for Analyzing Malware

Malware Evasion: Why It Works

Memory Forensics: Collecting & Analyzing Malware Artifacts ...issa-dc.org/presentations/03152011_eroraha_memory_forensics.pdfRegistry hivescan hivelist printkey hivedump hashdump lsadump

Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Shouhuai Xu CS @ UTSA Ravi Sandhu ICS @ UTSA Jose A. Morales SEI @ CMU

SPAM: Signal Processing for Analyzing Malware - … · SPAM: Signal Processing for Analyzing Malware Lakshmanan Nataraj, Student Member, IEEE, B.S. Manjunath, Fellow, IEEE C YBER

Sistema de Ofuscacion de Malware Para El Evasion de NIDS

Defeating Evasive Malware (VMRay Whitepaper) - Malware … · 2020-03-10 · the presence of a virtual machine or hypervisor. • Evasion by using time, event or environment based

Analyzing MSOffice Malware With OfficeMalScanner

How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

RHMD: Evasion-Resilient Hardware Malware Detectorsnael/pubs/micro17-rhmd.pdf · 2017-09-01 · RHMD: Evasion-Resilient Hardware Malware Detectors MICRO-50, October 14–18, 2017,

Analyzing Recent Evolutions in Malware Loaders

Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face … · 2018-02-26 · Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software November

“I Know Kung-Fu!”: Analyzing Mobile Malware - HITBconference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Alex Kirk... · “I Know Kung-Fu!”: Analyzing Mobile Malware ... Russian

Transparent System Introspection in Support of Analyzing ...web.eecs.umich.edu › ~weimerw › students › kleach-proposal-slides.p… · Support of Analyzing Stealthy Malware Kevin

Creating, obfuscating and analyzing malware JavaScript

Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in

SURVIVAL,EVASION, RESISTANCEAND ESCAPE …rageuniversity.com/PRISONESCAPE/EVASION OUTSIDE PRISON/SERE.Manual.pdfSURVIVAL,EVASION, RESISTANCEAND ESCAPE ... Use evasion movement techniques

Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs

COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED … · COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED BY MALWARE ... •State of the Art malware analysis systems use

Analyzing and Exploiting Network Behaviors of Malware

Advancing Your Anti-Phishing Program - gartner.com · techniques to exploit vulnerabilities in the reader software itself. As malware sandbox evasion techniques improve, the use of

Analyzing Malware in Memory - index-of.co.uk/index-of.co.uk/Malware/THA-Deep-Dive-Analyzing-Malware... · 2017-06-13 · –Network connections, memory allocations, ... Volatility

Advanced Zero Day Protection with APT Blocker · Modern malware uses Advanced techniques such as encrypted communication channels, kernel-‐level rootkits, and sophisticated evasion