Good afternoon my dear smiling cats and hats 🐈🎩
Happy Halloween to u.👻

I was going to do a heavy tor post, but in honor of the holiday like many wanted I decided to do a post about dynamic virus analysis .🦠

Let me remind you, dynamic virus analysis is when we analyze a triggered virus, static analysis is when we analyze a virus which is not triggered directly, without triggering it. Hybrid analysis is a mix of dynamic and static analysis.

Usually if we already have a malicious file and the first act is a static analysis-decrypt detects a malicious program and analyzes its work, next is a dynamic analysis - runs the malware and analyzes its work in running form. By the way how to alternate depends on the situation 🙃

Dynamic malware analysis, includes many tasks, such as: Monitoring network activity: processes, file system, registry keys, etc. .

We would also like to start by mentioning how malware escapes analysis. There are different ways to hide from analysis: with malicious dll queries, shell codes, encryption of the virus code itself, polymorphism - the virus code should not be constant, it should be constant and change with every new infection. It is often "jumping around in the assembly code" for example:

start_code :
    push plimorf ; write the return address
    inc di ; garbage
    ret ; jmp next
    xor dx,dx ; 
    dec bp ; 
    retf
plimorf: 
 *more code*    

Metamorphism is creating different copies of the virus, rearrangements of pieces of code, inserting between the meaningful pieces of code garbage instructions which do almost nothing, for example adding unnecessary bytes and different caches in the registers in the assembler, or cleverer register tricks like using the null descriptor from the GDT:
sgdt [esp-6]
mov r, [esp-4]
mov r, [r].

Now let's talk about the analysis itself in more detail:
Dynamic analysis itself is often held in programs for network analysis, one of them is probably the most popular and my favorite is wireshark. But there are also others: PeStudio, ProcMon, Autoruns, FakeNet-NG, Ghidra.

I would like to give an example of such a virus analysis.
This action is performed on windows. Let's say we have Vasya. He uploads a key logger virus file (which will send the data to his server) to a site and waits until someone else downloads it. For simplicity, the structure of the virus is simple enough and the virus downloads the logger data in a simple txt file without encrypting it, etc.

Masha works at "Pumpkin" 🎃 (it's Halloween night) she downloads Vasya's virus.
The virus collects data, but at one point she notices suspicious activity, and the virus is detected.
Other specialists do static analysis, then they give us the data we need for dynamic analysis.
We start Vasin's virus and we look what happened.

Immediately after we run it we go to Wirehark and see the post requests from our pc http.request.method=="POST".
We see a suspicious post request to xxx_virus.net, we look at the request data and there the key.txt is sent . Looking into this file and we see the log of our keys .
It is also possible to look at our processes (in programs like PeStudio) and to find our keylogger functions, and to find the host with the help of salic analysis.
In fact we have understood how the virus works.

In practice it is much more difficult and this example simplifies the virus analysis.⚙️

For more detailed examples you can take a look at the archive with articles there is a lot of interesting things.
There's also articles about metomorphism and polymorphism✨🎯 

I can find a particular virus (you can offer me interesting viruses in the comments 🔥, turn it over and write it as a post for you)

That's all for now. Thank you for reading❤️
And remember no one will eat the turtle Kwazy, and it still sings a harrowing song about being eaten☠️🐢
#network #forensics #virus #revers #malware #windows