Video transcript:

Hello everyone and welcome back
Today im gonna be showing you the basics of malware analysis.
We will mostly deal with static malware analysis and i will mention dynamic in the end.

First thing we have to do is get a malware – for this we can visit this github repository and download a sample. This will download a zip file with the password “infected”.

I’ve picked an Emotet sample from 2021 so you can pick that one too.

https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2021/December/sample_artifacts.zip

After extracting it we can see that we have few interesting files and to begin with the analysis i’ll jump into my Kali machine. I’ve shared this folder with the VM so i can access these files on kali by navigating to my shared folder location.
Once we are in the folder we can run the “file” with an asteriks symbol to run it on all files. We can see that some files have wrong extensions so we can change that.
If i Nano into the png file we can see that it looks like some code – in this case it seems to be powershell code so we can rename this file.
Inspecting the next file we can see its difficult to read, but looking at its beginning we can see a clear magic number SLASH file header with letters MZ – marking an executable file for windows.
Looking at the next file and going trough the empty content we can notice that we DO have some code – it looks like obfuscated javascript so we will rename it accordingly.
catting into the PCAP file we can see some random data which does seem to look like actual pcap. File command also says its PCAP so we will leave it as PCAP – just change the filename
If we look into the XLSM file it seems like a legit excel file so we’ll rename it to that for now.
Now that we have renamed the files and we know what they are we can start our analysis.

Using OLEDUMP for this situation seems to be reasonable if we have any macros inside our excel file.
But, we can see that oledump wont load it
The alternative is looking into the file with the archive manager since most office
files are basically zip files
We soon see a macro something folder and in it there is a file which uses cmd and
MSHTA to get to an IP – meaning this very likely our first C2 or a malware distribution URL.

With the C2 extracted we can look up WHOIS for this IP and report it with as much proof as we can send as
a malware distribution IP slash URL.

It is also important to additionally check the other files so make sure you do always do that.

Next we will investigate our PCAP file using wireshark
If we look at all the packets we can notice that there is too many stuff happening, so lets start with the
obvious : HTTP. We follow the tcp stream and look into the data

When i clicked follow tcp stream a window like this opened
Going trough TCP streams and inspecting communication we will eventually stumble upon our previously
seen powershell code and a list of URLs in it. It is safe to assume most of these are malicious –
we would usually check that by accessing them from a safe environment but since this is a malware from
2 years ago it is safe to assume all of them are down. If there are scripts or malicious files
on these URLs we would ping their domains them to get the IP and look up WHOIS on it, and we would also
directly look up WHOIS for the domains themselves and send emails to abuse contacts. It is also really good
practice to inform the national CERT since that might get things going faster.

By the way the file is identical to the one we have, so since we already extracted all the malicious URLs
and we already know whats going on with this file we can remove both that file and the PCAP file we just
analyzed.
But before that when looking into streams we can also see that the pcap file also downloaded an executable.
This is the same executable we have in our files.
So that just proves to always explore further.

Moving on to the next file – the JS file we can see its hard to read so im going to just copy all the content
i can find into a new file.

I’ll also make sure i seperate the javascript from the HTML since it will be way easier to analyze.

We can see multiple script tags and some obfuscated javascript as well as a weird base64 string that
when decoded actually returns random stuff. Since this seems to be nothing we can move on to analyzing
our JS file. I can google “javascript deobfuscator” and just input my javascript in it.
It seems that most of them wont accept my input so what i’ll do is i’ll just beautify the JS
using any website for beautifying and then just paste it inside my script to replace the obfuscated part with
new and deobfuscated one.

If we take another part of the javascript and put it into the deobfuscator we can notice it didnt do much.
This tells us that this part isnt really as obfuscated as it is just ugly on purpose.

Also the base64 string doesnt look like base64 – but we DO have the unescape function here taking in some
weird characters – it looks like URL encoding and if we URL decode it we will get a normal looking string.
We’ll replace that and now we can see what goes to the Eval function.
Eval is important because it does the execution.

Lets beautify another part and try to deobfuscate it – but since it doesnt work we can just leave it beautified

After pasting it in we can notice its not looking much better
but some of these things we can manuually decode, for example this specific string looks
like URL encoding or something similar
But after giving it to cyberchef’s magic we can see it still looks odd.

Ideally after this you would go to each and every variable, decode it if possible and rename it according
to the things it does – you would do the manual process of deobfuscation
But considering this video is already pretty long i’ll skip that.

also what you can do is look into names of the functions and additions to the variables
like this example right here with “Eva” – actually translating to “eval unescape” and then the string
You can do it manually like im showing it or by running that part of the javascript in your browser’s console,
but ofcourse be careful not to execute malicious code.
A lot of these strings dont seem to be base64 encoded or similar since cyberchef isnt detecting them so further
investigation is required.

We can see that similar methods are used in different parts of the code – like with the “fu” “nction” example.
All we have to do in this case is connect these together, rename the variables and everything will be a lot more
clear to us.

Okay considering the time let’s move on to our next file : malware.dll

First step we can do is look it up on virustotal and see what we can get
Also if you dont want the sample to be redistributed you can use antiscan.me
And i will also copy the file to my main machine since im logged into ANY RUN dynamic
analysis sandbox – so i can upload my file there.

After virustotal’s scans are done we can immidiately see its malware. Most antivirus tools
declare it as EMOTET type malware – and here we can read about features of the malware
its relations, connections to IP adresses and their reputation, behaviour with MITRE
signatures, more features of the malware and finally the community tab which is empty, but
usually contains comments from other analysts.

Next we can quickly look into antiscan.me and notice there isnt much difference and that
its definitely emotet malware.

After that we’ll login to ANYRUN so we can run our dynamic analysis
Simply upload the file and press Run. Press agree and wait until the timer on the right
expires.
On the right under the timer and system usage statistics we can see processes being spawned
or to be more percise names of programs and their commands, once we click on them we can get
better information as well as the full command line. You can also notice on the left we have
our connections tab where we can see two suspicious connections by our malware.
Once the timer is done we can also press the MALCONF button which will extract a list of
C2s that our malware has contacted. Luckily this malware is old so most of these are down.
But always check all of them to make sure.

Here are some other sandboxes you can also use for free:
Tria.ge
Hybridanalysis
Cuckoo sandbox

As well as some paid ones like
JoeSandbox’es premium which has shown great results in my experience
Anyrun’s premium
and more

Youu can also set up your own sandbox like FlareVM which is a customized windows machine
with a lot of tools installed for analysis. You can save the state before running malware
and then rollback after you are done

Oh yeah, another thing i wanna show you is how you can look into more information about the domains
Here we have a simple WHOIS lookup done by just entering the domain into the form
You can use other tools too – i recommend IPVoid and viewdns.info
After that you can extract the abuse contact from whois results or just google it. This is
where you can report fishy domains – and ofcourse after getting the IP behind the domain after
-for example – pinging it – you can look up WHOIS for the IP too -and do the same thing in order
to report malicious activities.

And ofcourse since we are on kali you have whois tool built into it. Just run whois and the name
of the domain or the IP and -if you want- grep the abuse contacts

Okay now the last thing i wanna show you is how we can analyze malware in GHIDRA.
Just run ghidra, run a new project in it, import the executable and double click it.
After that just analyze and wait for a moment.
Once analysis is done we can click on functions and look into some interesting functions
and what they do. If this seems too complicated, since some malware wont be as easy as this
one to read – you can just look up strings, or just navigate trough the funuctions and see if you
can get a good start in making it all readable by renaming variables and similar.

Also comming back to your own sandboxes – and similar tools for malware analysis:
a bunch of really cool tools come pre installed on FlareVM, so make sure you try it out.
Tools like EXE-INFO-PE which tells you about packing of the malware and gives you an instruction
on how to unpack it, DN-SPY used for decompiling dot net malware, and a lot more.

So that’s all for today’s video!
i hope you all had fun and that you’ve learned something new.

If you have any questions, leave them down in the comments i always reply.

Also you can check out my website for the transcript of the video & more.
If you have video ideas feel free to let me know.

Thank you so much for watching and Have a nice day.