Thank you for listening to our DEF CON Demo Labo.
I'm Shusei Tomuraga from JPSAT.
Our Demo Labo presentation today is about
MarconScan with KUKU, a tool that automatically
dumps malware configuration data.
First, let's talk about why we want to create such a tool
and its motivation.
Sandbox is a great tool for malware analysts.
However, we, the malware analysts,
cannot get what we want using the sandbox.
We want configuration data.
We need to get configuration data for static analysis.
Why do we need malware configuration data?
Many barriers of malware code are almost unchanged
and only configuration data is defined.
If the configuration data is known,
there is no need for static analysis.
Configuration data contains important information
that cannot be obtained by sandbox analysis,
such as campaign ID, encryption key,
C2 server, and so on.
Let me introduce how malware analysts
extract malware configuration.
This is very simple, so everyone should remember this.
First step, we analyze the malware
to understand how to encrypt the configuration data.
Then we understand the structure of the configuration data.
Step two, we create our tools
for extracting configuration data.
That's all, it's very simple.
For example, in the case of PlugX,
in PlugX data, PlugX main module and configuration
are encoded for original algorithm and LZNT1.
All decoded data is injected into one process and running.
PlugX custom encoding algorithm
depending on the version of it.
This custom encoding algorithm
is used to encode key log file modules
and configuration data.
Configuration structure also differs
depending on the version.
PlugX has a maximum configuration data
of 0x36A4 size.
It has such large configuration data is running.
Other example is ts-cookie.
ts-cookie is very simple,
use only RC4 for encryption.
This pattern has not changed for about five years.
The size of ts-cookie configuration data is 0x8D0,
which is the same as another normal malware.
So it is difficult to analyze a lot of malware
in the same way.
From this slide,
I will introduce a tool we created named MarukonScan.
MarukonScan is a ValTT plugin
that extracts the configuration data of known malware.
ValTT is an open source memory forensic framework
for incident response and malware analysis.
This tool search for malware in memory image
and dumps configuration data.
This is an example of MarukonScan
dumping RedRibs malware configuration.
You can see C2 server, encryption key,
mutex, and user agent.
This tool dumps different configuration data
depending on malware.
Now, MarukonScan support over 28 malware.
MarukonScan support most of the malware families
reported in any run's top 10 threat report.
So, I think you have a question here.
Why use ValTT?
It is effective to analyze the memory dump.
There are two advantages.
First, no need to unpack.
When extracting configuration data,
it is not necessary to unpack malware.
Second, no need to decode
because encoded configuration data
may be already decoded on memory.
You may be able to skip running
how to decrypt configuration data.
In addition, this tool also dumps
more than configuration data if needed.
In addition to configuration data,
it dumps decoded strings and DGA domains.
This is an example of MarukonScan
dumping web of malware configuration.
You can see RSA key, bot ID, and DGA domains.
Here is another example of MarukonScan
dumping phone book malware configuration.
You can see C2 server and decoded strings.
MarukonScan have another feature called MariaSTL scan.
MariaSTL scan function can list the strings
the following process refers.
Configuration data is usually encoded by malware.
However, most of malware writes
decoded configuration data on memory.
This function lists decoded configuration data
when possible.
The strings command may list unreferred strings,
but this tool only displays the strings
referred to in the code.
And this function can also display the heap area.
If decoded configuration data is in the heap area,
it will be displayed.
MarukonScan also support Linux-based memory image.
However, there are still few Linux malware
that can be scanned.
So it's the time.
You can use MarukonScan from command line.
Set primary name and pass to memory dump file
and OS profile of memory dump.
Here is a sample of Red Ribs Maria used by FPT10.
You can find C2 server address, campaign ID, user agent,
and so on.
So let's move on the next sample.
This sample is TS cookie, Maria used by BlackTek.
You can find the C2 server address,
and encryption key, campaign ID, and so on.
If you want to know more detail about the MarukonScan,
you can check out our wiki on GitHub.
In this wiki, you can learn how to install
and use MarukonScan.
Hello guys, I'm Tomoki Tani,
the developer of MarukonScan and MarukonScan with Google.
From here, I would like to show
how to automate the MarukonScan analysis.
MarukonScan alone cannot dump
configuration data automatically.
To automate the extraction of malware configuration,
we've developed a tool that executes MarukonScan
in Cuckoo Sandbox.
MarukonScan with Cuckoo is Cuckoo Sandbox plugin
for MarukonScan.
The plugin adds the function to extract
novel malware's configuration data from memory dump,
and then add MarukonScan report to Cuckoo Sandbox.
And how it works.
This tool uses Cuckoo's memory dump function
to extract configuration data of executed malware
from memory dumps.
Here's a video we make to give you an idea
how MarukonScan with Cuckoo works.
MarukonScan with Cuckoo integrates MarukonScan
into Cuckoo Sandbox.
It enables extracting malware configuration
in Cuckoo Sandbox.
And let's see how MarukonScan with Cuckoo works.
All you need to do is upload malware to Cuckoo.
Cuckoo sends the malware into the virtual machine
and executes it on the host.
Cuckoo acquires the memory dump
and send it to MarukonScan.
MarukonScan analyzes the memory dump
and extracts the malware's configuration data.
Finally, the malware's configuration
will be reported to Cuckoo.
This UI shows the Cuckoo's report of MarukonScan.
In here, you can find the same result
as we saw in the MarukonScan CLI interface.
This case shows the report of Red Leaves,
the malware used by APT10.
You can find the C2 address, campaign ID,
and traffic encryption key.
Of course, this report is saved into the database.
You could search and do some statistic analysis with it.
However, we have to overcome some obstacles
in order to make a better auto-analysis system.
I think most of malware reversers have struggled
with the anti-analysis techniques
implemented by the malware author.
This is same for auto-analysis system.
For example, Earthsniff, used to attack Japan,
has many kinds of anti-analysis functions.
If you have experience to analyze it,
you have seen this pop-up.
As you know, there are several types
of anti-analysis techniques,
and it is not easy to bypass all of them.
Checking language systems, system running time,
total size of physical memory,
is generally used for these techniques.
Also, checking virtualization is well-known techniques.
In these techniques, malware calls CPU ID instruction
and checks the specific return value,
or checks registry keys, which hypervisor set up.
And some malware checks the process names,
like Wireshark, or ODDebug, or ProcMon.
So, how can we bypass them?
Do we need to use physical Windows host for sandbox?
The answer is no.
Let's bypass them by configuring our virtual machine.
It's much more easier than preparing a physical machine.
Okay, let's check some samples.
This control flow graph shows
an anti-analysis function embedded in EarthNift backer.
Here, you can find four anti-analysis techniques.
It checks CPU brand name,
SCSI device name, boot time, and debugger.
Let's check some of these anti-analysis techniques
and how to bypass them.
CPU brand name detection.
Malware calls the CPU ID instruction
with specified value on EAX register
and get the CPU brand name as a return value.
In this case, it is checking if Xeon
is included in the CPU brand name.
In many cases, sandbox is running on the server
and the server uses Xeon processor.
It is calling CPU instruction direct
and it is not easy to hook this call.
So how can we bypass it?
The answer is modify the virtual machine configuration.
Here is a sample virtual machine configuration.
In this slide, it is showing
the sample configuration of VMware.
It is not well known,
but VMware allows you to modify the CPU ID response.
Also, VirtualBox allows you to modify it.
After setting this configuration,
you can find that the OS is showing
the different CPU brand name.
With this technique,
you can bypass most of the anti-analysis techniques
using CPU ID instruction.
Let's check another anti-analysis techniques.
In here, Malware is calling Windows API
to check the device name.
If device name includes VBox or VMware,
Malware will kill itself.
It is possible to bypass with Hooks API,
but it is more easy to modify the virtual machine settings.
Here is a sample configuration.
As you can see, you could also change the device name
just writing few lines into the configuration file.
You could do the same things for MAC address
or CD drive name or BIOS setting, et cetera, et cetera.
Here is our recommended setting for anti-anti-analysis.
First, do not install VMware tools
or VirtualBox guest additions.
These tools modify so many settings
and it makes it easy to detect the sandbox environment.
Second is use local language operating system
for virtual machine.
Some malware is specified for regions,
and if you want to analyze these malware,
use local languages always.
Third is modify the virtual machine configuration.
Especially, we recommend to modify CPU ID response,
device name, and NIC setting.
In most case, we are able to bypass anti-analysis techniques
with these settings.
Okay, let's move on to the demonstration
of Malcom scan with Cuckoo.
Okay, here is the web GUI of Cuckoo.
All things you need to do is submit malware and do analysis.
Each analysis takes two to three minutes per sample.
Okay, let's check the report.
You could find the report in VM memory dump menu.
And click Malcom scan tab, and the result will display.
Here is showing some sample reports.
This is Himari, the variant of Red Leaves.
And this is ts-cookie, the malware used by Blacktech.
And Ersniff, as known as DreamBot,
a very numerous banking Trojan.
And yes, that's all for the demonstration.
If you want to know more detail
about the Malcom scan with Cuckoo,
you can check it out our wiki on GitHub.
In this wiki, you can learn how to install
and how to use Malcom scan with Cuckoo.
And if you want to know more detail about anti-analysis,
we have written some articles
and some sample configuration on this wiki.
And now, we are developing Malcom scan
which supports Bolt ET3.
We have released the beta version on our GitHub repository.
You could find this code in the Bolt ET3 branch.
We will finish the conversion as soon as possible.
In Bolt ET3, you don't need to set the memory profile
and also has a better support to Windows 10.
So we recommend you to use Bolt ET3 rather than Bolt ET2.
Okay, that's all.
And thank you for watching.
And any feedback is welcome.
Thank you.