Lab 12-3

Analyze the malware extracted during the analysis of Lab 12-2, or use the file Lab12-03.exe.

Analysis:

Starting off with Basic Static Analysis by looking at the Imports of Lab12-03.exe. With this information we can start to suspect some of the functionalities of the Malware:

• The Malware may dynamically resolve and import external resources (GetProcAddress and LoadLibraryA)

• The Malware may allocate memory and use it in some fashion. (VirtualAlloc, HeapAlloc, VirtualFree, HeapFree, etc.)

• The Malware may create and write files. (WriteFile, and CreateFile)

• The Malware may retrieve the command-line string with which it was executed (GetCommandLineA)

• The Malware imports several functions that can be used to get information from the opened Windows (GetWindowTextA, FindWindowA, and ShowWindow)

• The Malware may retrieve messages from the calling thread’s message queue. (GetMessageA)

• The Malware may have hooking functionality (CallNextHookEx, SetWindowsHookExA, and UnhookWindowsHookEx)

From the last imports mentioned we can start to guess that the Malware will use the Process Replacement technique.

In terms of strings, this Malware has some interesting strings as well:

• The following strings hint at a Keylogging functionality:
  • [SHIFT], [ENTER], [BACKSPACE], [TAB], [CTRL], [DEL], and [CAPS LOCK]
• The string practicalmalwareanalysis.log is interesting. On a new analysis, correlating this information with the previous strings, we can suspect that this is the file where the Malware stores the keystrokes. However, we already know the answer to that since this file is related to Lab12-02.exe.

This pretty much covers everything in Basic Static Analysis. Since this is the same Payload as Lab12-02.exe, Basic Dynamic Analysis can be skipped since we already know what will happen and how does the Keylogging works. For more information on this part, refer to the previous Lab. ####LINK####

Thus, let’s advance to Advanced Static Analysis and Advanced Dynamic Analysis in order to see the inner workings of the Keylogger, which wasn’t covered in the last Lab.

As mentioned in the book “The principal function call used to perform remote Windows hooking is SetWindowHookEx…”. After opening the Malware in IDA, we immediately spot this API Call in the main function:

This function has the following parameters:

• idHook - Specifies the type of hook procedure to install.
• lpfn - The hook procedure.
• hMod - A handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hMod parameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.
• dwThreadId - The identifier of the thread with which the hook procedure is to be associated.

Looking at the parameters in IDA or Olly, we can see that the hook procedure to be installed is WH_KEYBOARD_LL:

The WH_KEYBOARD_LL hook enables the Malware to monitor keyboard input events about to be posted in a thread input queue. The function to be executed by the hook is at offset fn in IDA or Lab12-03.401086 in Olly:

As we can see, this function executes sub_4010C7.

Sub_4010C7 is where the Keylogging functionality resides. It starts by opening the file practicalmalwareanalysis.log:

Then, it writes the current Window title to the file:

After that, the code checks if the keystroke that is about to be logged is a “special character”. For that, the Malware uses a jumptable with several entries. This is where the Malware correctly logs special keys such as the “ENTER”, “SHIFT” or “BACKSPACE” keys:

After executing sub_4010C7, the Malware calls CallNextHookEx , in order to guarantee that the next hook procedure in the call chain gets the message and that the system continues to run properly:

After that, the hook procedure ends. The hook will keep running until GetMessageA to return zero:

This about covers everything about the Keylogger

Questions:

1) What is the purpose of this malicious payload?

The purpose of this Malware is to install a Keylogger via hook injection.

2) How does the malicious payload inject itself?

The Malicious payload is injected via an application-defined hook procedure.

3) What filesystem residue does this program create?

A file named practicalmalwareanalysis.log is created and contains the keystrokes logged during its execution.