1 00:00:01,010 --> 00:00:03,890 Thank you for listening to our DEF CON Demo Labo. 2 00:00:03,890 --> 00:00:06,350 I'm Shusei Tomuraga from JPSAT. 3 00:00:06,350 --> 00:00:15,310 Our Demo Labo presentation today is about MarconScan with KUKU, a tool that automatically dumps malware configuration data. 4 00:00:17,470 --> 00:00:23,970 First, let's talk about why we want to create such a tool and its motivation. 5 00:00:24,430 --> 00:00:27,430 Sandbox is a great tool for malware analysts. 6 00:00:27,430 --> 00:00:33,130 However, we, the malware analysts, cannot get what we want using the sandbox. 7 00:00:35,680 --> 00:00:38,050 We want configuration data. 8 00:00:38,050 --> 00:00:42,270 We need to get configuration data for static analysis. 9 00:00:44,600 --> 00:00:48,030 Why do we need malware configuration data? 10 00:00:48,030 --> 00:00:55,530 Many barriers of malware code are almost unchanged and only configuration data is defined. 11 00:00:55,530 --> 00:01:00,570 If the configuration data is known, there is no need for static analysis. 12 00:01:01,130 --> 00:01:13,990 Configuration data contains important information that cannot be obtained by sandbox analysis, such as campaign ID, encryption key, C2 server, and so on. 13 00:01:16,170 --> 00:01:21,350 Let me introduce how malware analysts extract malware configuration. 14 00:01:23,090 --> 00:01:27,510 This is very simple, so everyone should remember this. 15 00:01:30,310 --> 00:01:37,770 First step, we analyze the malware to understand how to encrypt the configuration data. 16 00:01:37,770 --> 00:01:41,850 Then we understand the structure of the configuration data. 17 00:01:45,060 --> 00:01:51,880 Step two, we create our tools for extracting configuration data. 18 00:01:52,600 --> 00:01:55,000 That's all, it's very simple. 19 00:01:57,600 --> 00:02:10,240 For example, in the case of PlugX, in PlugX data, PlugX main module and configuration are encoded for original algorithm and LZNT1. 20 00:02:11,120 --> 00:02:19,080 All decoded data is injected into one process and running. 21 00:02:20,060 --> 00:02:26,000 PlugX custom encoding algorithm depending on the version of it. 22 00:02:27,140 --> 00:02:35,190 This custom encoding algorithm is used to encode key log file modules and configuration data. 23 00:02:37,700 --> 00:02:43,180 Configuration structure also differs depending on the version. 24 00:02:43,180 --> 00:02:49,390 PlugX has a maximum configuration data of 0x36A4 size. 25 00:02:50,140 --> 00:02:54,050 It has such large configuration data is running. 26 00:02:56,900 --> 00:02:59,820 Other example is ts-cookie. 27 00:02:59,820 --> 00:03:04,960 ts-cookie is very simple, use only RC4 for encryption. 28 00:03:05,080 --> 00:03:09,180 This pattern has not changed for about five years. 29 00:03:11,280 --> 00:03:20,780 The size of ts-cookie configuration data is 0x8D0, which is the same as another normal malware. 30 00:03:22,280 --> 00:03:28,100 So it is difficult to analyze a lot of malware in the same way. 31 00:03:28,100 --> 00:03:34,800 From this slide, I will introduce a tool we created named MarukonScan. 32 00:03:35,220 --> 00:03:40,760 MarukonScan is a ValTT plugin that extracts the configuration data of known malware. 33 00:03:40,760 --> 00:03:47,640 ValTT is an open source memory forensic framework for incident response and malware analysis. 34 00:03:48,040 --> 00:03:53,370 This tool search for malware in memory image and dumps configuration data. 35 00:03:54,990 --> 00:04:00,260 This is an example of MarukonScan dumping RedRibs malware configuration. 36 00:04:00,260 --> 00:04:05,620 You can see C2 server, encryption key, mutex, and user agent. 37 00:04:06,420 --> 00:04:11,980 This tool dumps different configuration data depending on malware. 38 00:04:14,940 --> 00:04:19,200 Now, MarukonScan support over 28 malware. 39 00:04:20,840 --> 00:04:27,420 MarukonScan support most of the malware families reported in any run's top 10 threat report. 40 00:04:31,040 --> 00:04:35,680 So, I think you have a question here. 41 00:04:35,680 --> 00:04:37,140 Why use ValTT? 42 00:04:40,620 --> 00:04:44,060 It is effective to analyze the memory dump. 43 00:04:44,060 --> 00:04:46,440 There are two advantages. 44 00:04:46,500 --> 00:04:49,380 First, no need to unpack. 45 00:04:49,380 --> 00:04:54,800 When extracting configuration data, it is not necessary to unpack malware. 46 00:04:54,800 --> 00:05:03,990 Second, no need to decode because encoded configuration data may be already decoded on memory. 47 00:05:04,720 --> 00:05:09,170 You may be able to skip running how to decrypt configuration data. 48 00:05:12,180 --> 00:05:18,560 In addition, this tool also dumps more than configuration data if needed. 49 00:05:18,880 --> 00:05:25,640 In addition to configuration data, it dumps decoded strings and DGA domains. 50 00:05:27,850 --> 00:05:33,820 This is an example of MarukonScan dumping web of malware configuration. 51 00:05:33,820 --> 00:05:38,370 You can see RSA key, bot ID, and DGA domains. 52 00:05:41,000 --> 00:05:47,160 Here is another example of MarukonScan dumping phone book malware configuration. 53 00:05:47,160 --> 00:05:52,330 You can see C2 server and decoded strings. 54 00:05:54,680 --> 00:05:59,540 MarukonScan have another feature called MariaSTL scan. 55 00:05:59,540 --> 00:06:04,480 MariaSTL scan function can list the strings the following process refers. 56 00:06:04,820 --> 00:06:08,520 Configuration data is usually encoded by malware. 57 00:06:08,520 --> 00:06:13,800 However, most of malware writes decoded configuration data on memory. 58 00:06:13,800 --> 00:06:18,180 This function lists decoded configuration data when possible. 59 00:06:20,100 --> 00:06:30,200 The strings command may list unreferred strings, but this tool only displays the strings referred to in the code. 60 00:06:30,200 --> 00:06:34,180 And this function can also display the heap area. 61 00:06:34,260 --> 00:06:40,420 If decoded configuration data is in the heap area, it will be displayed. 62 00:06:42,620 --> 00:06:46,700 MarukonScan also support Linux-based memory image. 63 00:06:46,700 --> 00:06:51,520 However, there are still few Linux malware that can be scanned. 64 00:06:53,920 --> 00:06:56,020 So it's the time. 65 00:07:04,320 --> 00:07:08,340 You can use MarukonScan from command line. 66 00:07:08,340 --> 00:07:15,380 Set primary name and pass to memory dump file and OS profile of memory dump. 67 00:07:22,270 --> 00:07:27,070 Here is a sample of Red Ribs Maria used by FPT10. 68 00:07:27,070 --> 00:07:36,390 You can find C2 server address, campaign ID, user agent, and so on. 69 00:07:45,720 --> 00:07:48,920 So let's move on the next sample. 70 00:07:48,920 --> 00:07:53,430 This sample is TS cookie, Maria used by BlackTek. 71 00:07:59,960 --> 00:08:02,870 You can find the C2 server address, 72 00:08:07,150 --> 00:08:13,390 and encryption key, campaign ID, and so on. 73 00:08:27,650 --> 00:08:34,530 If you want to know more detail about the MarukonScan, you can check out our wiki on GitHub. 74 00:08:34,530 --> 00:08:39,740 In this wiki, you can learn how to install and use MarukonScan. 75 00:08:45,150 --> 00:08:50,620 Hello guys, I'm Tomoki Tani, the developer of MarukonScan and MarukonScan with Google. 76 00:08:50,620 --> 00:08:55,380 From here, I would like to show how to automate the MarukonScan analysis. 77 00:08:55,940 --> 00:09:00,260 MarukonScan alone cannot dump configuration data automatically. 78 00:09:00,260 --> 00:09:09,120 To automate the extraction of malware configuration, we've developed a tool that executes MarukonScan in Cuckoo Sandbox. 79 00:09:11,920 --> 00:09:16,980 MarukonScan with Cuckoo is Cuckoo Sandbox plugin for MarukonScan. 80 00:09:16,980 --> 00:09:27,980 The plugin adds the function to extract novel malware's configuration data from memory dump, and then add MarukonScan report to Cuckoo Sandbox. 81 00:09:30,470 --> 00:09:32,570 And how it works. 82 00:09:32,610 --> 00:09:40,690 This tool uses Cuckoo's memory dump function to extract configuration data of executed malware from memory dumps. 83 00:09:44,500 --> 00:09:50,400 Here's a video we make to give you an idea how MarukonScan with Cuckoo works. 84 00:10:02,600 --> 00:10:07,500 MarukonScan with Cuckoo integrates MarukonScan into Cuckoo Sandbox. 85 00:10:07,640 --> 00:10:12,380 It enables extracting malware configuration in Cuckoo Sandbox. 86 00:10:14,240 --> 00:10:17,180 And let's see how MarukonScan with Cuckoo works. 87 00:10:21,660 --> 00:10:25,300 All you need to do is upload malware to Cuckoo. 88 00:10:27,140 --> 00:10:35,480 Cuckoo sends the malware into the virtual machine and executes it on the host. 89 00:10:38,720 --> 00:10:43,320 Cuckoo acquires the memory dump and send it to MarukonScan. 90 00:10:45,300 --> 00:10:50,820 MarukonScan analyzes the memory dump and extracts the malware's configuration data. 91 00:10:51,840 --> 00:10:56,080 Finally, the malware's configuration will be reported to Cuckoo. 92 00:11:02,470 --> 00:11:06,570 This UI shows the Cuckoo's report of MarukonScan. 93 00:11:06,590 --> 00:11:12,150 In here, you can find the same result as we saw in the MarukonScan CLI interface. 94 00:11:13,030 --> 00:11:19,650 This case shows the report of Red Leaves, the malware used by APT10. 95 00:11:19,790 --> 00:11:24,830 You can find the C2 address, campaign ID, and traffic encryption key. 96 00:11:24,970 --> 00:11:29,330 Of course, this report is saved into the database. 97 00:11:29,330 --> 00:11:33,650 You could search and do some statistic analysis with it. 98 00:11:36,500 --> 00:11:42,520 However, we have to overcome some obstacles in order to make a better auto-analysis system. 99 00:11:42,740 --> 00:11:51,200 I think most of malware reversers have struggled with the anti-analysis techniques implemented by the malware author. 100 00:11:51,560 --> 00:11:54,540 This is same for auto-analysis system. 101 00:11:55,080 --> 00:12:01,100 For example, Earthsniff, used to attack Japan, has many kinds of anti-analysis functions. 102 00:12:01,100 --> 00:12:06,740 If you have experience to analyze it, you have seen this pop-up. 103 00:12:10,340 --> 00:12:17,040 As you know, there are several types of anti-analysis techniques, and it is not easy to bypass all of them. 104 00:12:17,600 --> 00:12:26,700 Checking language systems, system running time, total size of physical memory, is generally used for these techniques. 105 00:12:27,120 --> 00:12:30,780 Also, checking virtualization is well-known techniques. 106 00:12:30,780 --> 00:12:42,660 In these techniques, malware calls CPU ID instruction and checks the specific return value, or checks registry keys, which hypervisor set up. 107 00:12:43,600 --> 00:12:50,260 And some malware checks the process names, like Wireshark, or ODDebug, or ProcMon. 108 00:12:50,520 --> 00:12:52,860 So, how can we bypass them? 109 00:12:52,860 --> 00:12:57,400 Do we need to use physical Windows host for sandbox? 110 00:13:00,090 --> 00:13:02,090 The answer is no. 111 00:13:02,090 --> 00:13:05,030 Let's bypass them by configuring our virtual machine. 112 00:13:05,030 --> 00:13:09,210 It's much more easier than preparing a physical machine. 113 00:13:12,370 --> 00:13:14,690 Okay, let's check some samples. 114 00:13:14,810 --> 00:13:20,430 This control flow graph shows an anti-analysis function embedded in EarthNift backer. 115 00:13:20,670 --> 00:13:24,190 Here, you can find four anti-analysis techniques. 116 00:13:24,330 --> 00:13:30,290 It checks CPU brand name, SCSI device name, boot time, and debugger. 117 00:13:30,870 --> 00:13:36,770 Let's check some of these anti-analysis techniques and how to bypass them. 118 00:13:38,870 --> 00:13:41,070 CPU brand name detection. 119 00:13:41,690 --> 00:13:50,490 Malware calls the CPU ID instruction with specified value on EAX register and get the CPU brand name as a return value. 120 00:13:50,890 --> 00:13:57,870 In this case, it is checking if Xeon is included in the CPU brand name. 121 00:13:58,090 --> 00:14:03,870 In many cases, sandbox is running on the server and the server uses Xeon processor. 122 00:14:06,320 --> 00:14:11,940 It is calling CPU instruction direct and it is not easy to hook this call. 123 00:14:12,040 --> 00:14:14,260 So how can we bypass it? 124 00:14:14,400 --> 00:14:18,040 The answer is modify the virtual machine configuration. 125 00:14:20,260 --> 00:14:23,160 Here is a sample virtual machine configuration. 126 00:14:23,280 --> 00:14:27,120 In this slide, it is showing the sample configuration of VMware. 127 00:14:27,980 --> 00:14:33,860 It is not well known, but VMware allows you to modify the CPU ID response. 128 00:14:34,780 --> 00:14:38,080 Also, VirtualBox allows you to modify it. 129 00:14:42,200 --> 00:14:49,100 After setting this configuration, you can find that the OS is showing the different CPU brand name. 130 00:14:50,800 --> 00:14:57,900 With this technique, you can bypass most of the anti-analysis techniques using CPU ID instruction. 131 00:15:01,850 --> 00:15:05,330 Let's check another anti-analysis techniques. 132 00:15:05,470 --> 00:15:10,470 In here, Malware is calling Windows API to check the device name. 133 00:15:11,170 --> 00:15:19,090 If device name includes VBox or VMware, Malware will kill itself. 134 00:15:19,750 --> 00:15:26,830 It is possible to bypass with Hooks API, but it is more easy to modify the virtual machine settings. 135 00:15:30,530 --> 00:15:32,990 Here is a sample configuration. 136 00:15:33,210 --> 00:15:39,950 As you can see, you could also change the device name just writing few lines into the configuration file. 137 00:15:40,210 --> 00:15:47,210 You could do the same things for MAC address or CD drive name or BIOS setting, et cetera, et cetera. 138 00:15:51,240 --> 00:15:55,820 Here is our recommended setting for anti-anti-analysis. 139 00:15:56,080 --> 00:16:02,300 First, do not install VMware tools or VirtualBox guest additions. 140 00:16:02,680 --> 00:16:08,360 These tools modify so many settings and it makes it easy to detect the sandbox environment. 141 00:16:08,840 --> 00:16:13,860 Second is use local language operating system for virtual machine. 142 00:16:14,160 --> 00:16:22,980 Some malware is specified for regions, and if you want to analyze these malware, use local languages always. 143 00:16:23,700 --> 00:16:27,460 Third is modify the virtual machine configuration. 144 00:16:27,460 --> 00:16:34,620 Especially, we recommend to modify CPU ID response, device name, and NIC setting. 145 00:16:35,440 --> 00:16:40,680 In most case, we are able to bypass anti-analysis techniques with these settings. 146 00:16:43,390 --> 00:16:48,900 Okay, let's move on to the demonstration of Malcom scan with Cuckoo. 147 00:16:58,920 --> 00:17:02,480 Okay, here is the web GUI of Cuckoo. 148 00:17:02,540 --> 00:17:08,020 All things you need to do is submit malware and do analysis. 149 00:17:15,730 --> 00:17:21,350 Each analysis takes two to three minutes per sample. 150 00:17:24,390 --> 00:17:27,150 Okay, let's check the report. 151 00:17:30,960 --> 00:17:34,940 You could find the report in VM memory dump menu. 152 00:17:37,710 --> 00:17:42,170 And click Malcom scan tab, and the result will display. 153 00:17:43,010 --> 00:17:45,870 Here is showing some sample reports. 154 00:17:45,870 --> 00:17:48,870 This is Himari, the variant of Red Leaves. 155 00:17:53,940 --> 00:17:59,020 And this is ts-cookie, the malware used by Blacktech. 156 00:18:05,040 --> 00:18:12,480 And Ersniff, as known as DreamBot, a very numerous banking Trojan. 157 00:18:15,580 --> 00:18:18,360 And yes, that's all for the demonstration. 158 00:18:22,360 --> 00:18:29,480 If you want to know more detail about the Malcom scan with Cuckoo, you can check it out our wiki on GitHub. 159 00:18:29,580 --> 00:18:34,860 In this wiki, you can learn how to install and how to use Malcom scan with Cuckoo. 160 00:18:34,860 --> 00:18:43,180 And if you want to know more detail about anti-analysis, we have written some articles and some sample configuration on this wiki. 161 00:18:46,480 --> 00:18:53,280 And now, we are developing Malcom scan which supports Bolt ET3. 162 00:18:53,280 --> 00:18:57,360 We have released the beta version on our GitHub repository. 163 00:18:57,760 --> 00:19:02,420 You could find this code in the Bolt ET3 branch. 164 00:19:02,740 --> 00:19:06,320 We will finish the conversion as soon as possible. 165 00:19:06,940 --> 00:19:13,660 In Bolt ET3, you don't need to set the memory profile and also has a better support to Windows 10. 166 00:19:13,660 --> 00:19:18,900 So we recommend you to use Bolt ET3 rather than Bolt ET2. 167 00:19:20,820 --> 00:19:22,360 Okay, that's all. 168 00:19:22,360 --> 00:19:23,920 And thank you for watching. 169 00:19:23,920 --> 00:19:26,320 And any feedback is welcome. 170 00:19:26,440 --> 00:19:27,420 Thank you.