Automated Analysis of Marginalized Malware

Noname manuscript No. (will be inserted by the editor) The Other Guys: Automated Analysis of Marginalized Malware Marcus Felipe Botacin · Paulo L´ıciode Geus · AndréRicardo Abed Grégio Received: date / Accepted: date Abstract In order to thwart dynamic analysis and by- defensive tools, users are still being infected from mali- pass protection mechanisms, malware have been using cious attachments from phishing e-mail messages, cam- several file formats and evasive techniques. While pub- paigns of malware variants are continuously arising, and licly available dynamic malware analysis systems are operating systems protection, as well as third-party se- one of the main sources of information for researchers, curity mechanisms may be subverted by simple, older security analysts and incident response professionals, techniques. they are unable to cope with all types of threats. There- An effective way to understand and work on miti- fore, it is difficult to gather information from pub- gation of malware infections is to monitor the actions lic systems about CPL, .NET/Mono, 64-bits, reboot- exhibited by suspicious samples in a dynamic anal- dependent, or malware targeting systems newer than ysis system. There are several systems proposed in Windows XP, which result in a lack of understanding the literature and available as online services to cope about how current malware behave during infections with this task. The latter are a useful resource for re- on modern operating systems. In this paper, we discuss searchers, incident response professionals and security the challenges and issues faced during the development analysts, which take advantage of the information pre- of this type of analysis system, mainly due to security sented in the reports to assess specific threats. However, features available in NT 6.x kernel versions of Windows most of the publicly available dynamic analysis systems OS. We also introduce a dynamic analysis system that are only able to run PE32 executable files on Win- addresses the aforementioned types of malware as well dows XP virtual/emulated machines1, whereas modern as present results obtained from their analyses. MS-Windows can run PE+ files (64-bits) and .NET framework-dependent samples natively. Another con- Keywords Malware analysis systems · Evasive cern of these systems is the ability to analyze samples malware · OS security · 64-bit systems · CPL malware · that require rebooting the OS to complete the infec- .Net malware tion and, therefore, exhibit important actions of their malicious behavior. The analysis of this type of malware relies on a sys- 1 Introduction tem that has to overcome some design and implementa- tion issues related to the security mechanisms present Desktop malicious programs continue to threaten users on newer versions of MS-Windows systems, which dif- on a daily basis. Despite all security mechanisms and ficult kernel-based monitoring of subsystems (Registry, file system, processes) in a way more privileged than the Marcus Botacin · Paulo L´ıciode Geus University of Campinas, Campinas-SP, Brazil malware process. In this paper, we propose a dynamic E-mail: [email protected] analysis system to monitor \marginalized" malware, E-mail: [email protected] i.e., those samples that have not been addressed by pub- AndréRicardo Abed Grégio licly available systems. Our proposed system is able to Federal University of Paraná,Curitiba-PR, Brazil E-mail: [email protected] 1 As detailed on Section 4.4 2 Marcus Felipe Botacin et al. analyze PE32 (Portable Executable 32-bits), PE+ (PE the CPlApplet function [28] and can be directly exe- 64-bit version), CPL (Control Panel) and .NET/Mono cuted by users' double-click, often leading to a back- files in Windows 7 and 8 environments, as well as to ground execution. CPL malware is a Brazilian phe- monitor reboot-activated malware and extract their be- nomenon mostly related to Internet Banking attacks, havior. The main contributions of this paper are: (i) we whose actions are recognized by antivirus vendors as provide an overview on CPL and .NET/Mono file types significant threats [21]. and discuss their role in current malware attacks; (ii) we .NET/Mono. Mono is a software platform that al- present the challenges of designing and implementing a lows the creation of cross-platform applications (http: malware dynamic analysis system using modern Win- //www:mono-project:com/) and it is an open source im- dows operating systems (7 and 8 | kernel NT 6.x); plementation of Microsoft's .NET framework. This kind (iii) we introduce a new dynamic analysis system to of sample has the same range of actions that traditional monitor both 32 and 64-bits malware samples, which PE ones, but it usually crashes on or does not work is able to analyze reboot-activated malware, as well as on .NET framework versions for Windows XP (used in samples encapsulated in other executable file formats most publicly available sandboxes). We observed an in- (specifically CPL and .NET/Mono). Our work provides crease in the number of malware samples using this file richer behavioral information than other available sys- type2, but did not find specific literature about them. tems, showing how current malware samples act and PE+. Portable Executable [35] is a file format used helping in a better understanding of them. on Windows systems mainly for executable and library The remainder of this paper is organized as follows: files. There are two versions of it: PE32 and PE+, In Section 2, we provide a background on different file for 32 and 64-bits files, respectively. Analysis support types being used to deploy malware (PE+, CPL, and for PE32 is widespread, but there is a lack of specific .NET/Mono files), on new Windows internal mecha- PE+ malware analysis tools. As reported in [5], 64-bits nisms and their implications on current in-system mon- malware is an inevitable move. The more 64-bits plat- itoring tools, and we present the related works; in Sec- forms are deployed, the more it becomes attractive for tion 3, we detail the architecture of our proposed dy- malware creators. Malware developers do not need to namic analysis system and choices about its design; in move immediately from coding 32 to 64-bit malicious Section 4, we present some case studies to evaluate our programs|modern Windows are still compatible with proposed system using malware samples collected in the both (WoW64 [26] is responsible for such translation)| wild, mainly the ones marginalized by currently avail- , but if they do, researchers must be able to analyze able public analysis systems; in Section 5, we discuss those samples, since 64-bits malware is already in the the limitations of our system, and, finally, in Section 6, wild: in [5], the authors present a version of the Zeus we provide our final considerations. malware that is able to inject 32 and 64-bits versions of itself, depending on the host; Regin [18] samples also have 64-bits modules. In spite of that, there is still a 2 Background and Related Work lack of malware analysis literature for 64-bits samples' We present a brief background about file types used by analysis and execution. For instance, a reference text- malicious programs, simple techniques malware uses to book [40] covers PE Header changes and the new 64-bit prevent analysis, dynamic analysis systems, and tools calling convention but do not address changes in dy- from literature and the monitoring techniques they namic execution. Furthermore, as far as we know, there make use of. are no portable and publicly available sandboxes able to adequately handle PE+ files in the context of malware analysis3. Thomas et al. [43] discuss some differences of 2.1 File Encapsulation executing 32-bits samples on 64-bits modern operating systems (from Windows 7 forensics procedures perspec- Executable file formats that run correctly in a victim's tive), while Corregedor et al. [6] provides a first step on system may hinder the dynamic analysis, if used to analyzing a 32-bit modern Windows, which makes us encapsulate malware. We have observed a significant to consider the results on 64-bits ones. number of CPL and .NET binaries in our dataset (we collected these samples in the wild during the last few 2 We identified as .NET 0.6%, 1.1%, and 7.6% of all samples years), apart from the prevalence of PE files. Below, we from our dataset collected in 2013, 2014, and the first quarter of 2015, respectively. discuss the file types available among our samples. 3 Solutions like Sandboxie (http://www:sandboxie:com) are CPL. It is the file extension of Control Panel ap- not designed for this purpose and can be detected due to their plets, which are dynamic libraries (DLL) that export userland modules. The Other Guys 3 2.2 Dynamic Analysis Evasion and Reboot struction to the trampoline function in order to redi- rect the execution flow. Some drawbacks include it be- Malware creators use a varied set of techniques to by- ing userland-based (more prone to be bypassed) and pass sandbox-based analysis, such as virtual machine requiring the injection of the DLL in each of the to be detection and fingerprinting [16,34,12]. Different ap- monitored processes. Examples of tools employing this proaches are required to address them, such as the mon- techniques are CWsandbox [46] and Cuckoo [11]. itoring of split behavior [2] and the use of bare metal Virtual Machine Introspection. Consists of in- systems [15]. An effective evasive technique against dy- strumenting the virtual machine hypervisor to collect namic analysis system is to delay the execution of a information about the guest system. It allows for finer- sample, either by stalling it or requiring a reboot to grained analysis, since it is possible to obtain assembly complete the process of performing malicious actions.

Load more