Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)

Transcrição

1 UNIVERSIDADE CATÓLICA DE BRASÍLIA Pós-graduação Lato Sensu em Perícia Digital Laboratório de Perícia Digital Análise de Malware Volatility 1. Qual o sistema operacional pertence a imagem da memória? volatility-2.4.standalone.exe -f spyeye.vmem imageinfo Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86) volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp2x86 kdbgscan ************************************************** Instantiating KDBG using: Kernel AS WinXPSP2x86 ( bit) Offset (V) : 0x80545b60 Offset (P) : 0x545b60 KDBG owner tag check : True Profile suggestion (KDBGHeader): WinXPSP3x86 Version64 : 0x80545b38 (Major: 15, Minor: 2600) Service Pack (CmNtCSDVersion) : 3 Build string (NtBuildLab) : 2600.xpsp_sp3_gdr Quais processos estavam em execução no momento da captura? volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 psxview Offset(P) Name PID pslist psscan thrdproc pspcid csrss session deskthrd ExitTime x02284b80 vmtoolsd.exe 1816 True True True True True True True 0x01ebd300 VMwareTray.exe 1484 True True True True True True True 0x0236d7a0 wuauclt.exe 536 True True True True True True True 0x01f7a708 WPFFontCache_v True True True True True True True 0x01f4b020 svchost.exe 1108 True True True True True True True 0x022a0758 svchost.exe 1068 True True True True True True True 0x svchost.exe 1540 True True True True True True True 0x0214ba18 jusched.exe 1672 True True True True True True True 0x0226cda0 svchost.exe 904 True True True True True True True 0x024578b0 imapi.exe 1040 True True True True True True True 0x02406da0 svchost.exe 1232 True True True True True True True 0x024264c0 lsass.exe 716 True True True True True True True 0x wscntfy.exe 2772 True True True True True True True 0x alg.exe 2108 True True True True True True True 0x0230c5f8 vmacthlp.exe 872 True True True True True True True 0x023f2020 svchost.exe 972 True True True True True True True 0x02436a48 spoolsv.exe 1456 True True True True True True True 0x01f4c550 winlogon.exe 660 True True True True True True True 0x023e32f8 explorer.exe 1008 True True True True True True True 0x VMwareUser.exe 1588 True True True True True True True 0x01f5e020 jucheck.exe 3892 True True True True True True True 0x jqs.exe 1612 True True True True True True True 0x01ec2020 TSVNCache.exe 1252 True True True True True True True 0x0207d5f0 services.exe 704 True True True True True True True 0x022e69f8 VMUpgradeHelper 1872 True True True True True True True 0x020bd760 gmer.exe 2728 True True True True True True True

2 0x025c8830 System 4 True True True True False False False 0x02226b True True False True False False False :36:52 UTC x023fe020 smss.exe 572 True True True True False False False 0x csrss.exe 636 True True True True False True True 0x01ed9b50 wmiprvse.exe 2912 False True False False False False False 3. Qual processo parecem suspeitos? Porque? PIDs 904, 972, 1068, 1108, 1232 e 1540 todos svchost.exe. Esses processos são suspeitos pois são processos normalmente válidos e comuns em sistemas windows e portanto comumente usados para disfarçar ou injetar malwares. Além desses, os processos, WPFFontCache_v0, wmiprvse.exe, gmer.exe wscntfy.exe e alg.exe. São processos que não são comuns e possuem PID alto (acima de 2000). 4. Qual processo pertence ao malware analisado? Processo 1068 apresenta duas conexões ativas nas portas 1039 e volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 connscan Offset(P) Local Address Remote Address Pid x01eacc : : x01fd : : Pesquisando por obtemos também as seguintes informações:

3 5. Qual resultado da análise do processo no VirusTotal.com? volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 malfind -D spyeye 6. Aonde ele foi armazenado? Com o comando filescan e algumas expressões regulares podemos chegar na relação de executáveis registrados em memória. É possível observar nas linhas em negrito que só as entradas do arquivo sdra64.exe possuem ausência de permissões de acesso para compartilhamento 1. Isso pode indicar que o arquivo foi incluído no diretório de forma diferente dos demais. volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 filescan > spyeye_filescan.txt type spyeye_filescan.txt FindStr ".exe" 0x ebb2a8 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\assembly\NativeImages_v _32\aspnet_merge\3734b3b37f5c6cdd8b8d64c508dd9d79\asp net_merge.ni.exe 0x f R--r-d \Device\HarddiskVolume1\Program Files\Common Files\Java\Java Update\jucheck.exe 0x f6f8a8 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\assembly\NativeImages_v _32\Microsoft.Workflow.#\6a8da5dd61b1fcfed27f84047a3e 2bad\Microsoft.Workflow.Compiler.ni.exe 0x f R--rwd \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmacthlp.exe 0x fc6e R--rwd \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareUser.exe 0x fcf R--rwd \Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v \mscorsvw.exe 0x fdc R--r-d \Device\HarddiskVolume1\Program Files\Java\jre6\bin\javaw.exe 0x fe9d R--rwd \Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v \mscorsvw.exe 0x ceb8 1 0 R--r-d \Device\HarddiskVolume1\\ 0x R--r-d \Device\HarddiskVolume1\WINDOWS\assembly\NativeImages_v _32\MSBuild\aa e5e9826db7a7bd0adb9b2b\MSBuild. ni.exe 0x d R--rwd \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x df8 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe 0x b7c8 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe 0x b9cf8 1 0 R--r-d \Device\HarddiskVolume1\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\devenv.exe.config 0x c12f0 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\ntkrnlpa.exe 0x e4f R--r-d \Device\HarddiskVolume1\Program Files\7-Zip\7zG.exe 0x f R--r-d \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe

4 0x e R--r-d \Device\HarddiskVolume1\WINDOWS\system32\services.exe 0x R--r-d \Device\HarddiskVolume1\WINDOWS\assembly\NativeImages_v _32\aspnet_merge\908c65a049f5a25c60b75b72e009d1ac\asp net_merge.ni.exe 0x R--r-d \Device\HarddiskVolume1\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\Publicize.exe 0x c R--r-d \Device\HarddiskVolume1\WINDOWS\system32\notepad.exe 0x R--r-d \Device\HarddiskVolume1\Program Files\Java\jre6\bin\javaw.exe 0x a R--rw- \Device\HarddiskVolume1\Program Files\IDA\idaq.exe 0x d8 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\smss.exe 0x f R--r-d \Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\a977c34cdd ee23e5ac8259e12.exe 0x cec R--r-d \Device\HarddiskVolume1\WINDOWS\assembly\NativeImages_v _32\Microsoft.Workflow.#\6a8da5dd61b1fcfed27f84047a3e 2bad\Microsoft.Workflow.Compiler.ni.exe 0x db1c8 1 0 R--r-d \Device\HarddiskVolume1\Program Files\TortoiseSVN\bin\TSVNCache.exe 0x dbeb8 1 0 R--rwd \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\vmtoolsd.exe 0x f86a8 1 0 R--r-d \Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v \WPF\WPFFontCache_v0400.exe 0x W-rwd \Device\HarddiskVolume1\\config.bin 0x a R--rwd \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe 0x b2b0 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 0x c8 1 0 R--r-d \Device\HarddiskVolume1\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\mspdbsrv.exe 0x R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuauclt.exe 0x R--rwd \Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\spyeye\spyeye\cs.exe 0x b R--r-d \Device\HarddiskVolume1\WINDOWS\system32\smss.exe 0x f8 1 0 R--rw- \Device\HarddiskVolume1\WINDOWS\explorer.exe 0x f R--r-d \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe 0x d R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imapi.exe 0x c8 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\alg.exe 0x a0 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\services.exe 0x a R--r-d \Device\HarddiskVolume1\WINDOWS\Microsoft.NET\Framework\v \MSBuild.exe 0x ac R--rwd \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x af R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe 0x c6b8 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\a977c34cdd ee23e5ac8259e12.exe 0x dcf0 1 0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe 0x f0 1 0 R--r-d \Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\gmer.exe 0x aeb8 1 0 R--rwd \Device\HarddiskVolume1\Program Files\Common Files\Java\Java Update\jusched.exe 0x a1b R--r-d \Device\HarddiskVolume1\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_ _xww_97359ba5\Microsoft.Workflow.Compiler.exe 0x aa R--rwd \Device\HarddiskVolume1\Program Files\Java\jre6\bin\jqs.exe 0x ab4a8 1 0 R--rwd \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe 0x b81a8 1 0 R--rw- \Device\HarddiskVolume1\Documents and Settings\Administrator\Desktop\gmer.exe 0x R--r-d \Device\HarddiskVolume1\Program Files\7-Zip\7zG.exe 0x f0 1 0 R--rw- \Device\HarddiskVolume1\Program Files\VMware\VMware Tools\VMwareTray.exe 0x f R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe 7. Existem conexões de rede? volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 connscan Offset(P) Local Address Remote Address Pid x01eacc : : x01fd : : Quais informações podem ser úteis via strings (ASCII)? strings spyeye.vmem FindStr "spyeye" C:\Documents and Settings\Administrator\Desktop\spyeye spyeye.zipv.zip spyeye/symantecviralportaldownloadreport.txtut spyeye/ut spyeye/2b8a408b56eaf3ce0198c9d1d8a75ec0ut spyeye/97c73a29ab07f04458f5e8834f8db1baut spyeye/a977c34cdd ee23e5ac8259e12ut spyeye/cf.binut spyeye/config.bin.ziput spyeye/config.datut

5 spyeye/cs.exeut spyeye/cs.idbut spyeye/edc7c152759ba0482bd39db0ea2c4319ut spyeye/intro-spyeye.pdfut spyeye/se_unpacked.ex_ut strings spyeye.vmem FindStr "cleansweep" _cleansweep \Device\HarddiskVolume1\\ \ \\ 9. Existem informações sobre persistência? Se feito pelo registro, em qual chave? volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 printkey -K "Software\Microsoft\Windows\CurrentVersion\Run" Legend: (S) = Stable (V) = Volatile Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT Key name: Run (S) Last updated: :36:52 UTC+0000 Subkeys: Values: REG_SZ : (S) C:\\ 10. Procure ou escreva uma regra para o plugin yarascan que otimize algum dos passos de identificação do malware. rule spyeye : banker { meta: author = "Jean-Philippe Teissier description = "SpyEye X.Y memory" date = " " version = "1.0" filetype = "memory" strings: $spyeye = "SpyEye" $a = "%BOTNAME%" $b = "globplugins" $c = "data_inject" $d = "data_before" $e = "data_after" $f = "data_end" $g = "bot_version" $h = "bot_guid" $i = "TakeBotGuid" $j = "TakeGateToCollector" $k = "[ERROR] : Omfg! Process is still active? Lets kill that mazafaka!" $l = "[ERROR] : Update is not successfull for some reason"

6 $m = "[ERROR] : dwerr == %u" $n = "GRABBED DATA" } condition: $spyeye or (any of ($a,$b,$c,$d,$e,$f,$g,$h,$i,$j,$k,$l,$m,$n)) volatility-2.4.standalone.exe -f spyeye.vmem --profile=winxpsp3x86 yarascan -y spyeye2.yar Rule: spyeye Owner: Process svchost.exe Pid x0036fea0 62 6f 74 5f f 6e bot_version... 0x0036feb x0036fec x0036fed x0036fee x0036fef x0036ff bc a c a `L.. 0x0036ff10 80 ec x0036ff af 01 0a x0036ff d m.e.s.p.a.c. 0x0036ff f 00 e...s...p.r.o. 0x0036ff v.i.d.e.r...s... 0x0036ff U.s.e.r...s... 0x0036ff c 00 6f c L.o.c.a.l.e... 0x0036ff e s...t.r.a.n.s. 0x0036ff f 00 6e a.c.t.i.o.n.i.d.