start	end	text
1010	3890	Thank you for listening to our DEF CON Demo Labo.
3890	6350	I'm Shusei Tomuraga from JPSAT.
6350	9330	Our Demo Labo presentation today is about
9330	12670	MarconScan with KUKU, a tool that automatically
12670	15310	dumps malware configuration data.
17470	21930	First, let's talk about why we want to create such a tool
21930	23970	and its motivation.
24430	27430	Sandbox is a great tool for malware analysts.
27430	29870	However, we, the malware analysts,
29870	33130	cannot get what we want using the sandbox.
35680	38050	We want configuration data.
38050	42270	We need to get configuration data for static analysis.
44600	48030	Why do we need malware configuration data?
48030	51610	Many barriers of malware code are almost unchanged
51610	55530	and only configuration data is defined.
55530	57770	If the configuration data is known,
57770	60570	there is no need for static analysis.
61130	64130	Configuration data contains important information
64130	68830	that cannot be obtained by sandbox analysis,
68830	71990	such as campaign ID, encryption key,
71990	73990	C2 server, and so on.
76170	78570	Let me introduce how malware analysts
78570	81350	extract malware configuration.
83090	87510	This is very simple, so everyone should remember this.
90310	92890	First step, we analyze the malware
92890	97770	to understand how to encrypt the configuration data.
97770	101850	Then we understand the structure of the configuration data.
105060	108580	Step two, we create our tools
108580	111880	for extracting configuration data.
112600	115000	That's all, it's very simple.
117600	121180	For example, in the case of PlugX,
121180	125200	in PlugX data, PlugX main module and configuration
125200	130240	are encoded for original algorithm and LZNT1.
131120	139080	All decoded data is injected into one process and running.
140060	143320	PlugX custom encoding algorithm
143320	146000	depending on the version of it.
147140	148840	This custom encoding algorithm
148840	152840	is used to encode key log file modules
152840	155190	and configuration data.
157700	160880	Configuration structure also differs
160880	163180	depending on the version.
163180	165820	PlugX has a maximum configuration data
165820	169390	of 0x36A4 size.
170140	174050	It has such large configuration data is running.
176900	179820	Other example is ts-cookie.
179820	181580	ts-cookie is very simple,
181580	184960	use only RC4 for encryption.
185080	189180	This pattern has not changed for about five years.
191280	197400	The size of ts-cookie configuration data is 0x8D0,
197400	200780	which is the same as another normal malware.
202280	206340	So it is difficult to analyze a lot of malware
206340	208100	in the same way.
208100	209900	From this slide,
209900	214800	I will introduce a tool we created named MarukonScan.
215220	217200	MarukonScan is a ValTT plugin
217200	220760	that extracts the configuration data of known malware.
220760	224080	ValTT is an open source memory forensic framework
224080	227640	for incident response and malware analysis.
228040	230980	This tool search for malware in memory image
230980	233370	and dumps configuration data.
234990	237340	This is an example of MarukonScan
237340	240260	dumping RedRibs malware configuration.
240260	243360	You can see C2 server, encryption key,
243360	245620	mutex, and user agent.
246420	250060	This tool dumps different configuration data
250060	251980	depending on malware.
254940	259200	Now, MarukonScan support over 28 malware.
260840	263880	MarukonScan support most of the malware families
263880	267420	reported in any run's top 10 threat report.
271040	275680	So, I think you have a question here.
275680	277140	Why use ValTT?
280620	284060	It is effective to analyze the memory dump.
284060	286440	There are two advantages.
286500	289380	First, no need to unpack.
289380	291760	When extracting configuration data,
291760	294800	it is not necessary to unpack malware.
294800	297380	Second, no need to decode
297380	300480	because encoded configuration data
300480	303990	may be already decoded on memory.
304720	306680	You may be able to skip running
306680	309170	how to decrypt configuration data.
312180	315400	In addition, this tool also dumps
315400	318560	more than configuration data if needed.
318880	321160	In addition to configuration data,
321160	325640	it dumps decoded strings and DGA domains.
327850	330240	This is an example of MarukonScan
331010	333820	dumping web of malware configuration.
333820	338370	You can see RSA key, bot ID, and DGA domains.
341000	343660	Here is another example of MarukonScan
343660	347160	dumping phone book malware configuration.
347160	352330	You can see C2 server and decoded strings.
354680	359540	MarukonScan have another feature called MariaSTL scan.
359540	362060	MariaSTL scan function can list the strings
362060	364480	the following process refers.
364820	368520	Configuration data is usually encoded by malware.
368520	370740	However, most of malware writes
370740	373800	decoded configuration data on memory.
373800	376980	This function lists decoded configuration data
376980	378180	when possible.
380100	384260	The strings command may list unreferred strings,
384260	387720	but this tool only displays the strings
387720	390200	referred to in the code.
390200	394180	And this function can also display the heap area.
394260	398840	If decoded configuration data is in the heap area,
398840	400420	it will be displayed.
402620	406700	MarukonScan also support Linux-based memory image.
406700	409500	However, there are still few Linux malware
409500	411520	that can be scanned.
413920	416020	So it's the time.
424320	428340	You can use MarukonScan from command line.
428340	431860	Set primary name and pass to memory dump file
431860	435380	and OS profile of memory dump.
442270	447070	Here is a sample of Red Ribs Maria used by FPT10.
447070	454190	You can find C2 server address, campaign ID, user agent,
455010	456390	and so on.
465720	468920	So let's move on the next sample.
468920	473430	This sample is TS cookie, Maria used by BlackTek.
479960	482870	You can find the C2 server address,
487150	493390	and encryption key, campaign ID, and so on.
507650	511570	If you want to know more detail about the MarukonScan,
511570	514530	you can check out our wiki on GitHub.
514530	517510	In this wiki, you can learn how to install
517510	519740	and use MarukonScan.
525150	527140	Hello guys, I'm Tomoki Tani,
527140	530620	the developer of MarukonScan and MarukonScan with Google.
530620	532360	From here, I would like to show
532360	535380	how to automate the MarukonScan analysis.
535940	537960	MarukonScan alone cannot dump
537960	540260	configuration data automatically.
540260	543780	To automate the extraction of malware configuration,
543780	547240	we've developed a tool that executes MarukonScan
547240	549120	in Cuckoo Sandbox.
551920	554940	MarukonScan with Cuckoo is Cuckoo Sandbox plugin
554940	556980	for MarukonScan.
556980	560000	The plugin adds the function to extract
560000	563440	novel malware's configuration data from memory dump,
563440	567980	and then add MarukonScan report to Cuckoo Sandbox.
570470	572570	And how it works.
572610	576030	This tool uses Cuckoo's memory dump function
576030	579390	to extract configuration data of executed malware
579390	580690	from memory dumps.
584500	587620	Here's a video we make to give you an idea
587620	590400	how MarukonScan with Cuckoo works.
602600	605520	MarukonScan with Cuckoo integrates MarukonScan
605520	607500	into Cuckoo Sandbox.
607640	610500	It enables extracting malware configuration
610500	612380	in Cuckoo Sandbox.
614240	617180	And let's see how MarukonScan with Cuckoo works.
621660	625300	All you need to do is upload malware to Cuckoo.
627140	630120	Cuckoo sends the malware into the virtual machine
632500	635480	and executes it on the host.
638720	640340	Cuckoo acquires the memory dump
640340	643320	and send it to MarukonScan.
645300	647600	MarukonScan analyzes the memory dump
647600	650820	and extracts the malware's configuration data.
651840	653860	Finally, the malware's configuration
653860	656080	will be reported to Cuckoo.
662470	666570	This UI shows the Cuckoo's report of MarukonScan.
666590	668770	In here, you can find the same result
668770	672150	as we saw in the MarukonScan CLI interface.
673030	677070	This case shows the report of Red Leaves,
677070	679650	the malware used by APT10.
679790	682730	You can find the C2 address, campaign ID,
682730	684830	and traffic encryption key.
684970	689330	Of course, this report is saved into the database.
689330	693650	You could search and do some statistic analysis with it.
696500	699420	However, we have to overcome some obstacles
699420	702520	in order to make a better auto-analysis system.
702740	705740	I think most of malware reversers have struggled
705740	707780	with the anti-analysis techniques
708540	711200	implemented by the malware author.
711560	714540	This is same for auto-analysis system.
715080	718380	For example, Earthsniff, used to attack Japan,
718380	721100	has many kinds of anti-analysis functions.
721100	723800	If you have experience to analyze it,
723800	726740	you have seen this pop-up.
730340	732440	As you know, there are several types
732440	734280	of anti-analysis techniques,
734280	737040	and it is not easy to bypass all of them.
737600	741960	Checking language systems, system running time,
741960	744140	total size of physical memory,
744140	746700	is generally used for these techniques.
747120	750780	Also, checking virtualization is well-known techniques.
750780	754200	In these techniques, malware calls CPU ID instruction
754600	757540	and checks the specific return value,
757540	762660	or checks registry keys, which hypervisor set up.
763600	766240	And some malware checks the process names,
766240	770260	like Wireshark, or ODDebug, or ProcMon.
770520	772860	So, how can we bypass them?
772860	777400	Do we need to use physical Windows host for sandbox?
780090	782090	The answer is no.
782090	785030	Let's bypass them by configuring our virtual machine.
785030	789210	It's much more easier than preparing a physical machine.
792370	794690	Okay, let's check some samples.
794810	796850	This control flow graph shows
796850	800430	an anti-analysis function embedded in EarthNift backer.
800670	804190	Here, you can find four anti-analysis techniques.
804330	806630	It checks CPU brand name,
806630	810290	SCSI device name, boot time, and debugger.
810870	813930	Let's check some of these anti-analysis techniques
813930	816770	and how to bypass them.
818870	821070	CPU brand name detection.
821690	824030	Malware calls the CPU ID instruction
824030	826530	with specified value on EAX register
827290	830490	and get the CPU brand name as a return value.
830890	834450	In this case, it is checking if Xeon
834450	837870	is included in the CPU brand name.
838090	841170	In many cases, sandbox is running on the server
841670	843870	and the server uses Xeon processor.
846320	849100	It is calling CPU instruction direct
849100	851940	and it is not easy to hook this call.
852040	854260	So how can we bypass it?
854400	858040	The answer is modify the virtual machine configuration.
860260	863160	Here is a sample virtual machine configuration.
863280	864680	In this slide, it is showing
864680	867120	the sample configuration of VMware.
867980	869660	It is not well known,
869660	873860	but VMware allows you to modify the CPU ID response.
874780	878080	Also, VirtualBox allows you to modify it.
882200	884620	After setting this configuration,
884620	887280	you can find that the OS is showing
887280	889100	the different CPU brand name.
890800	892420	With this technique,
892420	895060	you can bypass most of the anti-analysis techniques
895060	897900	using CPU ID instruction.
901850	905330	Let's check another anti-analysis techniques.
905470	908650	In here, Malware is calling Windows API
908650	910470	to check the device name.
911170	916590	If device name includes VBox or VMware,
916590	919090	Malware will kill itself.
919750	923170	It is possible to bypass with Hooks API,
923170	926830	but it is more easy to modify the virtual machine settings.
930530	932990	Here is a sample configuration.
933210	936170	As you can see, you could also change the device name
936170	939950	just writing few lines into the configuration file.
940210	942410	You could do the same things for MAC address
942410	947210	or CD drive name or BIOS setting, et cetera, et cetera.
951240	955820	Here is our recommended setting for anti-anti-analysis.
956080	959580	First, do not install VMware tools
959580	962300	or VirtualBox guest additions.
962680	964680	These tools modify so many settings
964680	968360	and it makes it easy to detect the sandbox environment.
968840	972100	Second is use local language operating system
972100	973860	for virtual machine.
974160	978020	Some malware is specified for regions,
978020	980680	and if you want to analyze these malware,
980680	982980	use local languages always.
983700	987460	Third is modify the virtual machine configuration.
987460	991440	Especially, we recommend to modify CPU ID response,
991440	994620	device name, and NIC setting.
995440	999020	In most case, we are able to bypass anti-analysis techniques
999020	1000680	with these settings.
1003390	1006520	Okay, let's move on to the demonstration
1006520	1008900	of Malcom scan with Cuckoo.
1018920	1022480	Okay, here is the web GUI of Cuckoo.
1022540	1028020	All things you need to do is submit malware and do analysis.
1035730	1041350	Each analysis takes two to three minutes per sample.
1044390	1047150	Okay, let's check the report.
1050960	1054940	You could find the report in VM memory dump menu.
1057710	1062170	And click Malcom scan tab, and the result will display.
1063010	1065870	Here is showing some sample reports.
1065870	1068870	This is Himari, the variant of Red Leaves.
1073940	1079020	And this is ts-cookie, the malware used by Blacktech.
1085040	1089220	And Ersniff, as known as DreamBot,
1089420	1092480	a very numerous banking Trojan.
1095580	1098360	And yes, that's all for the demonstration.
1102360	1104180	If you want to know more detail
1104180	1106280	about the Malcom scan with Cuckoo,
1106280	1109480	you can check it out our wiki on GitHub.
1109580	1112140	In this wiki, you can learn how to install
1112140	1114860	and how to use Malcom scan with Cuckoo.
1114860	1118580	And if you want to know more detail about anti-analysis,
1118580	1119700	we have written some articles
1119700	1123180	and some sample configuration on this wiki.
1126480	1129380	And now, we are developing Malcom scan
1129380	1133280	which supports Bolt ET3.
1133280	1137360	We have released the beta version on our GitHub repository.
1137760	1142420	You could find this code in the Bolt ET3 branch.
1142740	1146320	We will finish the conversion as soon as possible.
1146940	1150200	In Bolt ET3, you don't need to set the memory profile
1150200	1153660	and also has a better support to Windows 10.
1153660	1158900	So we recommend you to use Bolt ET3 rather than Bolt ET2.
1160820	1162360	Okay, that's all.
1162360	1163920	And thank you for watching.
1163920	1166320	And any feedback is welcome.
1166440	1167420	Thank you.