Malware Analysis Lecture Flashcards

Malware Fundamentals and MITRE ATT&CK Tactics

  • Definition of Malware: Software explicitly designed to conduct unauthorized actions on a target system that typically benefit an external actor while harming or compromising the primary user.

  • Capabilities and Actions of Malicious Software:

    • Reading sensitive user and system data without authorization.

    • Modifying, corrupting, or deleting local host files.

    • Encrypting file systems to deny legitimate access.

    • Transmitting captured data across network boundaries to remote infrastructure.

    • Escalating execution privileges from unprivileged local accounts to elevated administrative or root accounts.

    • Moving laterally across connected network systems to expand attack scope.

    • Illustrative Historical Case Study Context: Security incidents often originate from minor initial access vectors, such as a malicious Excel macro script, before escalating and spreading laterally across hundreds of enterprise hosts.

  • Key MITRE ATT&CK Categories Associated with Malware:

    • Persistence: Mechanisms used to maintain access across system reboots and interruptions, such as installing backdoors or persistence scripts.

    • Privilege Escalation: Techniques deployed to transition from an unprivileged user account with minimal execution rights to an administrator account, increasing read, write, and command capabilities.

    • Command and Control (C2 / C&C): Infrastructure, servers, and channels maintained by attackers to issue remote commands and communicate with infected hosts.

    • Credential Access: Techniques focused on stealing authenticators, including user passwords, authentication tokens, and security hashes.

    • Lateral Movement: Methods employed to traverse adjacent devices and servers on the internal network.

    • Exfiltration: The unauthorized collection and transmission of stolen data to remote attacker-controlled infrastructure.

    • Impact / Ransomware: Actions taken to disrupt availability or integrity, such as encrypting local host files to extort users with financial demands and threats.

Frameworks for Malware Analysis

  • Definition of Malware Analysis: The technical discipline of investigating binary files and scripts to determine their exact functionality, internal structure, and hidden operational capabilities beyond claimed or superficial behaviors.

  • Defensive Purpose of Analysis:

    • Identifies the scope, origin, and mechanism of a compromise during incident response.

    • Facilitates containment and complete eradication of malicious artifacts from enterprise networks.

    • Uncovers reusable behavioral patterns and signatures to detect related or future malware variants.

  • Static Analysis Methodology:

    • Concept: Examining binary structure, metadata, strings, or inferred code without executing the program.

    • Advantages: Completely safe, as code is not executing and cannot damage the host system; provides a fast structural overview.

    • Limitations: Fails to detect dynamic or heavily obfuscated behaviors, complex control flow logic, dynamic code loading, or encoded payloads (such as obfuscated Visual Basic scripts).

  • Dynamic Analysis Methodology:

    • Concept: Executing malware inside an isolated, safe environment (such as a Virtual Machine or specialized sandbox) while recording real-time behavior.

    • Advantages: Directly observes active runtime operations, confirming exact behavior regardless of code complexity.

    • Limitations: Requires careful containment to prevent host contamination; only captures triggered execution paths; conditional logic may remain dormant; advanced malware may detect virtualized or sandbox environments and suppress malicious actions.

  • Integrated Malware Analysis Workflow:

    • Hierarchy of Analysis: Basic techniques are performed prior to advanced techniques; static analysis is conducted prior to dynamic analysis.

    • Stage 1: Basic Static Analysis: Employs rapid, low-cost methods (extracting printable strings, inspecting file headers, computing cryptographic file hashes) to formulate initial hypotheses without execution risk.

    • Stage 2: Basic Dynamic Analysis: Executes the sample in a controlled virtual environment to test hypotheses against observable file system, process creation, and network events.

    • Stage 3: Advanced Static Analysis: Uses disassemblers and decompilers to reverse engineer instruction sets, analyze control flow, examine obfuscated functions, and extract exact trigger conditions.

    • Stage 4: Advanced Dynamic Analysis: Employs debuggers to gain instruction-level control over execution, allowing memory inspection, breakpoint placement, and reading unencrypted payloads directly prior to network transmission.

Techniques, Methods, and Tooling Matrix

  • Static Analysis Techniques:

    • Strings Extraction: Searching binary image files for human-readable ASCII or Unicode character sequences to locate embedded file paths, IP addresses, domain names, status messages, or hardcoded strings.

    • Header and Metadata Inspection: Parsing executable headers to identify target operating systems (e.g., macOS, Linux, Windows), architecture specifications (e.g., ARM, x86, x64), and imported library functions (such as network socket APIs).

    • Cryptographic Hashing: Generating unique file fingerprints using algorithms (e.g., MD5, SHA-256) to query threat intelligence databases and malicious hash lookup tables.

    • Disassembly: Reconstructing assembly language instructions from raw machine bytes using reverse engineering tools.

  • Dynamic Analysis Techniques:

    • Sandbox Execution: Running binaries in isolated virtual machines while logging modified files, created child processes, registry changes, and outbound network traffic.

    • Debugging: Utilizing a debugger to execute binaries step-by-step, manipulate memory registers, alter execution paths, and inspect variables immediately prior to encryption or exfiltration.

  • Analysis Tooling Specifications:

    • Strings Utility: Standard Unix command-line utility for scanning binaries and outputting printable character sequences.

    • Ghidra: Open-source reverse engineering framework created by the United States National Security Agency (NSA). Features automated disassembling, control flow mapping, cross-referencing, and C-like pseudocode decompilation.

    • IDA Pro: Commercial, closed-source, proprietary disassembler and decompiler software widely used in malware analysis.

    • CyberChef: Web-based data manipulation workbench used for cryptographic operations, encoding, decoding, and bitwise XOR transformations.

    • Netcat: Versatile networking utility used to open local listening ports during dynamic analysis to safely capture network traffic without exposing external internet connections.

    • Cuckoo Sandbox: Open-source automated malware analysis system designed to run samples inside isolated virtual environments.

    • Trend Micro Deep Discovery Analyzer (DDA): Enterprise-grade commercial automated sandbox platform for dynamic threat analysis.

    • Endpoint and Network Detection Systems: Endpoint Detection and Response (EDR) suites (e.g., Microsoft Defender XDR, VMware Carbon Black) and Network Detection and Response (NDR) platforms leveraging behavioral analytics and machine learning models.

Practical Analysis Demonstration: Investigation of TextProc

  • Overview of Target Binary:

    • Binary Name: TextProc

    • Intended Functionality: A command-line utility designed to normalize text templates by stripping unnecessary whitespace characters and converting all text to uppercase.

    • Initial Normal Execution Test:

    • Input: A text document containing mixed casing and redundant whitespace.

    • Command Execution: TextProc processes the file and outputs status messages to the terminal console.

    • Output Verification: The output file displays fully capitalized text with all extra whitespace removed.

  • Basic Static Analysis (Strings Inspection):

    • Command Executed: strings TextProc

    • Observed Output Identification:

    • Standard status and operation messages displayed during baseline execution.

    • Embedded file path artifact: /tmp/TextProc.log.

    • HTTP POST request template string containing HTTP headers and request fields.

    • An unexplained, seemingly random sequence of printable characters.

  • Basic Dynamic Analysis (File System & Network Monitoring):

    • File System Artifact Inspection: Checking the /tmp/ directory confirms the creation of /tmp/TextProc.log at timestamp 14:21. Opening /tmp/TextProc.log reveals that TextProc silently writes the full, unformatted original input document to local storage.

    • Network Interception Test: A local listening socket is initialized using Netcat. Re-executing TextProc produces zero network traffic, confirming that network communication is conditionally controlled and was not activated during basic processing.

  • Advanced Static Analysis using Ghidra:

    • Binary Import and Auto-Analysis:

    • Loading TextProc into Ghidra displays raw sequential memory addresses and bytes.

    • Executing Ghidra Auto-Analysis parses binary metadata, determines platform architecture, and reconstructs machine instructions (e.g., MOV and CALL).

    • Cross-Referencing (XREFs) for Strings:

    • Searching Ghidra string tables locates the HTTP POST request template string.

    • Using Ghidra cross-references (XREFs) identifies where the string is used in executable code, jumping directly to a function designated as sendPost.

    • Decompilation and Pseudocode Analysis of sendPost:

    • Inspecting sendPost pseudocode reveals the construction of an HTTP POST request via string formatting functions (sprintf / sformat).

    • HTTP Request Format: Defines request target paths, HTTP version headers, host parameters, and payload boundaries following double newline sequences (\n\n).

    • Payload Data Identification: The decompiler assigns a generic payload variable name (e.g., PCVAR4), which is manually renamed to exfilData.

    • Data Origin Mapping: Pseudocode reveals a file-reading function readfile reading /tmp/TextProc.log (the local copy of the user's input document) and assigning its contents directly to exfilData.

    • Obfuscated Destination Host Decoding: The target host string is stored in encoded form and processed through an internal function named XORDecode. Applying bitwise XOR decoding with CyberChef using hex key 0x5A0x5A reveals the decoded destination domain: badserver.test.

    • Trigger Condition Determination in main:

    • Following cross-references from sendPost back to main reveals that sendPost is enclosed inside a conditional block:       if (PCVAR2≠NULL) { sendPost(); }\text{if (PCVAR2} \neq \text{NULL) \{ sendPost(); \}}

    • Tracing PCVAR2 assignment shows that TextProc executes a C substring search function strstr on the original user input, searching specifically for the string "CONFIDENTIAL" in uppercase.

    • Execution Rule: If the user input document contains the string "CONFIDENTIAL", strstr returns a non-null pointer, setting PCVAR2 to a non-null state and executing sendPost() to exfiltrate the file.

  • Hypothesis Testing and Empirical Validation:

    • Targeted Dynamic Test: An input file containing the uppercase key string "CONFIDENTIAL" is passed into TextProc.

    • Observed Result: Netcat captures the outbound HTTP POST request containing all HTTP headers, the decoded remote target host badserver.test, and the user's unformatted input file as the payload.

    • Casing Requirement Check: Passing an input file containing the lowercase string "confidential" does not produce network traffic, proving that TextProc performs exact case-sensitive matching without normalizing text casing prior to evaluating the conditional trigger.

Enterprise Threat Detection and Operational Security

  • Endpoint Detection and Response (EDR):

    • Architecture: Agent software operating on endpoint hosts to continuously monitor process creation, file modifications, memory state, and parent-child process relationships.

    • Enterprise Benefits:

    • Facilitates remote incident response and forensic collection without requiring physical retrieval of infected endpoints.

    • Correlates host events into central Extended Detection and Response (XDR) dashboards (e.g., Microsoft Defender XDR).

    • Enables proactive threat hunting by querying endpoint telemetry for suspicious behavioral indicators (such as unauthorized PowerShell execution).

  • Network Detection and Response (NDR):

    • Architecture: Network monitoring technology that analyzes internal and perimeter traffic using machine learning models and behavioral analytics to detect anomalous communications rather than relying strictly on static signatures.

  • Operational Security (OpSec) Rules for Incident Responders:

    • Public Multi-Scanner Restrictions: Analysts must never upload suspicious or custom targeted files recovered during an enterprise investigation to public multi-scanner sites such as VirusTotal.

    • Threat Actor Intelligence Risks: Red teams and malicious threat actors continuously monitor VirusTotal submissions; uploading a custom targeted sample signals to adversaries that their intrusion has been discovered.

    • Approved Investigation Tools: Enterprise investigations must utilize private business accounts, internal VirusTotal corporate APIs, or isolated local sandboxes (such as Trend Micro Deep Discovery Analyzer).

Technical Questions and Discussion

  • Mechanism of Substring Pointer Operations in C:

    • Question: How does the standard C substring function operate when evaluating string checks?

    • Answer: The standard C library function strstr searches for a specified substring within a target string. If a match is found, it returns a memory pointer to the beginning of the substring within the target buffer; if no match is found, it returns NULL. In the analyzed malware, checking whether this pointer is non-null (PCVAR2≠NULL\text{PCVAR2} \neq \text{NULL}) serves as the binary trigger condition for executing the data exfiltration function.

  • Compiler Optimization Effects on Decompilation:

    • Question: How do aggressive compiler optimizations affect reverse engineering tools like Ghidra?

    • Answer: Compilers perform aggressive optimizations—such as function inlining, instruction reordering, and dead code elimination—that obscure high-level structural constructs. This increases the difficulty for disassemblers and decompilers to infer clean source code. In complex scenarios, reverse engineers must perform manual instruction analysis or adjust compilation flags when analyzing custom binaries.

  • Evading Static Analysis via Obfuscated Strings:

    • Question: How do malware authors neutralize basic static analysis techniques?

    • Answer: Modern malware developers frequently omit static printable strings from binary images by encrypting string tables, stripping symbol headers, or constructing strings dynamically in memory at runtime. These techniques neutralize standard command-line tools like strings, forcing analysts to utilize disassemblers, dynamic debugging, or runtime memory dumps to extract hidden strings.

  • Exploitation Risks in Serialized Document Formats:

    • Question: Why are document formats such as Microsoft Excel spreadsheets and Adobe PDFs frequent attack vectors, and why is analyzing them complex?

    • Answer: Document formats often support rich internal scripting engines—such as Visual Basic for Applications (VBA) macros in Excel spreadsheets or embedded JavaScript and stream objects in PDF files. These features provide Turing-complete execution environments that attackers exploit to bypass host controls. Because parsing these complex, serialized specifications is difficult, enterprise security teams rely on automated sandboxes (such as Trend Micro Deep Discovery Analyzer) to detonate documents safely and analyze post-execution behavior.