Fragmented Code Injection
In the original post we briefly mentioned that malfind identified 20+ different memory segments in explorer.exe (pid 1096) that contained injected code. Why so many, you may ask? Malware like Zeus, Carberp, Cridex, Shylock and many others allocate a single segment large enough to hold everything (the code, strings, function call tables, etc). Its easy to locate, extract, and analyze.
The fact that Poison Ivy spreads itself across more than two dozen small memory segments definitely does not make it more stealthy (now there are 20+ suspicious memory regions instead of just one), but it does make reversing/analysis more challenging. Instead of dumping one memory segment, you have to dump all 20+ of them and then figure out how they fit together - like a big jigsaw puzzle. The image below shows a comparison of how a typical injection resides in process memory compared to that of Poison Ivy.
$ python vol.py -f memory.img -p 1096 malfind
Volatile Systems Volatility Framework 2.3_alpha
Process: explorer.exe Pid: 1096 Address: 0x1c70000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c70000 53 56 8b c8 8b 99 b4 08 00 00 8b 73 34 8b ca 33 SV.........s4..3
0x01c70010 db 89 19 33 db 89 59 04 33 db 89 59 08 33 db 89 ...3..Y.3..Y.3..
0x01c70020 59 0c 33 c9 ff 96 d4 01 00 00 5e 5b c3 00 00 00 Y.3.......^[....
0x01c70030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1c70000 53 PUSH EBX
0x1c70001 56 PUSH ESI
0x1c70002 8bc8 MOV ECX, EAX
0x1c70004 8b99b4080000 MOV EBX, [ECX+0x8b4]
0x1c7000a 8b7334 MOV ESI, [EBX+0x34]
0x1c7000d 8bca MOV ECX, EDX
0x1c7000f 33db XOR EBX, EBX
0x1c70011 8919 MOV [ECX], EBX
0x1c70013 33db XOR EBX, EBX
0x1c70015 895904 MOV [ECX+0x4], EBX
0x1c70018 33db XOR EBX, EBX
0x1c7001a 895908 MOV [ECX+0x8], EBX
0x1c7001d 33db XOR EBX, EBX
0x1c7001f 89590c MOV [ECX+0xc], EBX
0x1c70022 33c9 XOR ECX, ECX
0x1c70024 ff96d4010000 CALL DWORD [ESI+0x1d4]
0x1c7002a 5e POP ESI
0x1c7002b 5b POP EBX
0x1c7002c c3 RET
0x1c7002d 0000 ADD [EAX], AL
0x1c7002f 0000 ADD [EAX], AL
0x1c70031 0000 ADD [EAX], AL
0x1c70033 0000 ADD [EAX], AL
0x1c70035 0000 ADD [EAX], AL
0x1c70037 0000 ADD [EAX], AL
0x1c70039 0000 ADD [EAX], AL
0x1c7003b 0000 ADD [EAX], AL
0x1c7003d 0000 ADD [EAX], AL
0x1c7003f 00 DB 0x0
Process: explorer.exe Pid: 1096 Address: 0x1bc0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01bc0000 55 8b ec 50 b8 10 00 00 00 81 c4 04 f0 ff ff 50 U..P...........P
0x01bc0010 48 75 f6 8b 45 fc 81 c4 48 fe ff ff 53 56 57 8b Hu..E...H...SVW.
0x01bc0020 45 08 89 45 bc 8b 45 bc 8b 80 b4 08 00 00 8b f8 E..E..E.........
0x01bc0030 8b 40 34 89 45 b8 8b 45 b8 8b 80 24 03 00 00 89 .@4.E..E...$....
0x1bc0000 55 PUSH EBP
0x1bc0001 8bec MOV EBP, ESP
0x1bc0003 50 PUSH EAX
0x1bc0004 b810000000 MOV EAX, 0x10
0x1bc0009 81c404f0ffff ADD ESP, 0xfffff004
0x1bc000f 50 PUSH EAX
0x1bc0010 48 DEC EAX
0x1bc0011 75f6 JNZ 0x1bc0009
0x1bc0013 8b45fc MOV EAX, [EBP+0xfffffffc]
0x1bc0016 81c448feffff ADD ESP, 0xfffffe48
0x1bc001c 53 PUSH EBX
0x1bc001d 56 PUSH ESI
0x1bc001e 57 PUSH EDI
0x1bc001f 8b4508 MOV EAX, [EBP+0x8]
0x1bc0022 8945bc MOV [EBP+0xffffffbc], EAX
0x1bc0025 8b45bc MOV EAX, [EBP+0xffffffbc]
0x1bc0028 8b80b4080000 MOV EAX, [EAX+0x8b4]
0x1bc002e 8bf8 MOV EDI, EAX
0x1bc0030 8b4034 MOV EAX, [EAX+0x34]
0x1bc0033 8945b8 MOV [EBP+0xffffffb8], EAX
0x1bc0036 8b45b8 MOV EAX, [EBP+0xffffffb8]
0x1bc0039 8b8024030000 MOV EAX, [EAX+0x324]
0x1bc003f 89 DB 0x89
Process: explorer.exe Pid: 1096 Address: 0x19a0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x019a0000 55 8b ec 81 c4 d4 fe ff ff 56 8b 75 08 6a 00 6a U........V.u.j.j
0x019a0010 02 ff 96 b9 00 00 00 89 85 d4 fe ff ff c7 85 d8 ................
0x019a0020 fe ff ff 28 01 00 00 8d 8d d8 fe ff ff 51 ff b5 ...(.........Q..
0x019a0030 d4 fe ff ff ff 96 bd 00 00 00 eb 47 ff 75 0c 8d ...........G.u..
0x19a0000 55 PUSH EBP
0x19a0001 8bec MOV EBP, ESP
0x19a0003 81c4d4feffff ADD ESP, 0xfffffed4
0x19a0009 56 PUSH ESI
0x19a000a 8b7508 MOV ESI, [EBP+0x8]
0x19a000d 6a00 PUSH 0x0
0x19a000f 6a02 PUSH 0x2
0x19a0011 ff96b9000000 CALL DWORD [ESI+0xb9]
0x19a0017 8985d4feffff MOV [EBP+0xfffffed4], EAX
0x19a001d c785d8feffff28010000 MOV DWORD [EBP+0xfffffed8], 0x128
0x19a0027 8d8dd8feffff LEA ECX, [EBP+0xfffffed8]
0x19a002d 51 PUSH ECX
0x19a002e ffb5d4feffff PUSH DWORD [EBP+0xfffffed4]
0x19a0034 ff96bd000000 CALL DWORD [ESI+0xbd]
0x19a003a eb47 JMP 0x19a0083
0x19a003c ff750c PUSH DWORD [EBP+0xc]
0x19a003f 8d DB 0x8d
Process: explorer.exe Pid: 1096 Address: 0x1290000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01290000 55 8b ec 81 c4 30 fa ff ff 8b 75 08 8d 86 fb 03 U....0....u.....
0x01290010 00 00 50 6a 00 6a 00 ff 96 85 00 00 00 89 86 c5 ..Pj.j..........
0x01290020 08 00 00 ff 96 89 00 00 00 3d b7 00 00 00 75 04 .........=....u.
0x01290030 c9 c2 04 00 56 8d 86 6b 09 00 00 50 8d 86 45 01 ....V..k...P..E.
0x1290000 55 PUSH EBP
0x1290001 8bec MOV EBP, ESP
0x1290003 81c430faffff ADD ESP, 0xfffffa30
0x1290009 8b7508 MOV ESI, [EBP+0x8]
0x129000c 8d86fb030000 LEA EAX, [ESI+0x3fb]
0x1290012 50 PUSH EAX
0x1290013 6a00 PUSH 0x0
0x1290015 6a00 PUSH 0x0
0x1290017 ff9685000000 CALL DWORD [ESI+0x85]
0x129001d 8986c5080000 MOV [ESI+0x8c5], EAX
0x1290023 ff9689000000 CALL DWORD [ESI+0x89]
0x1290029 3db7000000 CMP EAX, 0xb7
0x129002e 7504 JNZ 0x1290034
0x1290030 c9 LEAVE
0x1290031 c20400 RET 0x4
0x1290034 56 PUSH ESI
0x1290035 8d866b090000 LEA EAX, [ESI+0x96b]
0x129003b 50 PUSH EAX
0x129003c 8d DB 0x8d
0x129003d 864501 XCHG [EBP+0x1], AL
Process: explorer.exe Pid: 1096 Address: 0x1300000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01300000 55 8b ec 81 c4 30 fa ff ff 8b 75 08 8d 86 fb 03 U....0....u.....
0x01300010 00 00 50 6a 00 6a 00 ff 96 85 00 00 00 89 86 c5 ..Pj.j..........
0x01300020 08 00 00 ff 96 89 00 00 00 3d b7 00 00 00 75 04 .........=....u.
0x01300030 c9 c2 04 00 56 8d 86 6b 09 00 00 50 8d 86 45 01 ....V..k...P..E.
0x1300000 55 PUSH EBP
0x1300001 8bec MOV EBP, ESP
0x1300003 81c430faffff ADD ESP, 0xfffffa30
0x1300009 8b7508 MOV ESI, [EBP+0x8]
0x130000c 8d86fb030000 LEA EAX, [ESI+0x3fb]
0x1300012 50 PUSH EAX
0x1300013 6a00 PUSH 0x0
0x1300015 6a00 PUSH 0x0
0x1300017 ff9685000000 CALL DWORD [ESI+0x85]
0x130001d 8986c5080000 MOV [ESI+0x8c5], EAX
0x1300023 ff9689000000 CALL DWORD [ESI+0x89]
0x1300029 3db7000000 CMP EAX, 0xb7
0x130002e 7504 JNZ 0x1300034
0x1300030 c9 LEAVE
0x1300031 c20400 RET 0x4
0x1300034 56 PUSH ESI
0x1300035 8d866b090000 LEA EAX, [ESI+0x96b]
0x130003b 50 PUSH EAX
0x130003c 8d DB 0x8d
0x130003d 864501 XCHG [EBP+0x1], AL
Process: explorer.exe Pid: 1096 Address: 0x1310000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01310000 00 11 42 ab 71 07 4a ab 71 2b 3e ab 71 27 4c ab ..B.q.J.q+>.q'L.
0x01310010 71 6f 67 ab 71 53 2e ab 71 e1 2e ab 71 55 53 ab qog.qS..q...qUS.
0x01310020 71 e1 9a 80 7c 74 9b 80 7c c7 06 81 7c 6b 23 80 q...|t..|...|k#.
0x01310030 7c 17 6c dd 77 42 78 dd 77 ab 7a dd 77 d7 ea dd |.l.wBx.w.z.w...
0x1310000 0011 ADD [ECX], DL
0x1310002 42 INC EDX
0x1310003 ab STOSD
0x1310004 7107 JNO 0x131000d
0x1310006 4a DEC EDX
0x1310007 ab STOSD
0x1310008 712b JNO 0x1310035
0x131000a 3eab STOSD
0x131000c 7127 JNO 0x1310035
0x131000e 4c DEC ESP
0x131000f ab STOSD
0x1310010 716f JNO 0x1310081
0x1310012 67ab STOS [ES:DI], EAX
0x1310014 7153 JNO 0x1310069
0x1310016 2eab STOSD
0x1310018 71e1 JNO 0x130fffb
0x131001a 2eab STOSD
0x131001c 7155 JNO 0x1310073
0x131001e 53 PUSH EBX
0x131001f ab STOSD
0x1310020 71e1 JNO 0x1310003
0x1310022 9a807c749b807c CALL FAR 0x7c80:0x9b747c80
0x1310029 c706817c6b23 MOV DWORD [ESI], 0x236b7c81
0x131002f 807c176cdd CMP BYTE [EDI+EDX+0x6c], 0xdd
0x1310034 7742 JA 0x1310078
0x1310036 78dd JS 0x1310015
0x1310038 77ab JA 0x130ffe5
0x131003a 7add JP 0x1310019
0x131003c 77d7 JA 0x1310015
0x131003e ea DB 0xea
0x131003f dd DB 0xdd
Process: explorer.exe Pid: 1096 Address: 0x1320000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01320000 55 8b ec 50 b8 10 00 00 00 81 c4 04 f0 ff ff 50 U..P...........P
0x01320010 48 75 f6 8b 45 fc 83 c4 b8 53 56 57 8b 75 08 33 Hu..E....SVW.u.3
0x01320020 c0 89 86 b9 08 00 00 33 c0 89 45 e4 68 4d 4b 58 .......3..E.hMKX
0x01320030 5a 8b 86 db 0a 00 00 50 8b 86 e1 00 00 00 50 ff Z......P......P.
0x1320000 55 PUSH EBP
0x1320001 8bec MOV EBP, ESP
0x1320003 50 PUSH EAX
0x1320004 b810000000 MOV EAX, 0x10
0x1320009 81c404f0ffff ADD ESP, 0xfffff004
0x132000f 50 PUSH EAX
0x1320010 48 DEC EAX
0x1320011 75f6 JNZ 0x1320009
0x1320013 8b45fc MOV EAX, [EBP+0xfffffffc]
0x1320016 83c4b8 ADD ESP, -0x48
0x1320019 53 PUSH EBX
0x132001a 56 PUSH ESI
0x132001b 57 PUSH EDI
0x132001c 8b7508 MOV ESI, [EBP+0x8]
0x132001f 33c0 XOR EAX, EAX
0x1320021 8986b9080000 MOV [ESI+0x8b9], EAX
0x1320027 33c0 XOR EAX, EAX
0x1320029 8945e4 MOV [EBP+0xffffffe4], EAX
0x132002c 684d4b585a PUSH DWORD 0x5a584b4d
0x1320031 8b86db0a0000 MOV EAX, [ESI+0xadb]
0x1320037 50 PUSH EAX
0x1320038 8b86e1000000 MOV EAX, [ESI+0xe1]
0x132003e 50 PUSH EAX
0x132003f ff DB 0xff
Process: explorer.exe Pid: 1096 Address: 0x1330000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01330000 e8 00 00 00 40 b3 0f 00 ff ff ff ff 00 00 00 00 ....@...........
0x01330010 00 00 00 00 00 00 00 00 00 00 00 00 18 b3 0f 00 ................
0x01330020 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x01330030 00 00 00 00 00 00 a2 01 00 00 00 00 01 00 00 00 ................
0x1330000 e800000040 CALL 0x41330005
0x1330005 b30f MOV BL, 0xf
0x1330007 00ff ADD BH, BH
0x1330009 ff DB 0xff
0x133000a ff DB 0xff
0x133000b ff00 INC DWORD [EAX]
0x133000d 0000 ADD [EAX], AL
0x133000f 0000 ADD [EAX], AL
0x1330011 0000 ADD [EAX], AL
0x1330013 0000 ADD [EAX], AL
0x1330015 0000 ADD [EAX], AL
0x1330017 0000 ADD [EAX], AL
0x1330019 0000 ADD [EAX], AL
0x133001b 0018 ADD [EAX], BL
0x133001d b30f MOV BL, 0xf
0x133001f 00ff ADD BH, BH
0x1330021 ff DB 0xff
0x1330022 ff DB 0xff
0x1330023 ff00 INC DWORD [EAX]
0x1330025 0000 ADD [EAX], AL
0x1330027 0000 ADD [EAX], AL
0x1330029 0000 ADD [EAX], AL
0x133002b 0000 ADD [EAX], AL
0x133002d 0000 ADD [EAX], AL
0x133002f 0000 ADD [EAX], AL
0x1330031 0000 ADD [EAX], AL
0x1330033 0000 ADD [EAX], AL
0x1330035 00a201000000 ADD [EDX+0x1], AH
0x133003b 0001 ADD [ECX], AL
0x133003d 0000 ADD [EAX], AL
0x133003f 00 DB 0x0
Process: explorer.exe Pid: 1096 Address: 0x1410000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01410000 55 8b ec 83 c4 fc 8b 75 08 68 ff 00 00 00 8d be U......u.h......
0x01410010 13 0d 00 00 57 ff 96 ad 00 00 00 e8 2e 00 00 00 ....W...........
0x01410020 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f SOFTWARE\Microso
0x01410030 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 ft\Windows\Curre
0x1410000 55 PUSH EBP
0x1410001 8bec MOV EBP, ESP
0x1410003 83c4fc ADD ESP, -0x4
0x1410006 8b7508 MOV ESI, [EBP+0x8]
0x1410009 68ff000000 PUSH DWORD 0xff
0x141000e 8dbe130d0000 LEA EDI, [ESI+0xd13]
0x1410014 57 PUSH EDI
0x1410015 ff96ad000000 CALL DWORD [ESI+0xad]
0x141001b e82e000000 CALL 0x141004e
0x1410020 53 PUSH EBX
0x1410021 4f DEC EDI
0x1410022 46 INC ESI
0x1410023 54 PUSH ESP
0x1410024 57 PUSH EDI
0x1410025 41 INC ECX
0x1410026 52 PUSH EDX
0x1410027 45 INC EBP
0x1410028 5c POP ESP
0x1410029 4d DEC EBP
0x141002a 6963726f736f66 IMUL ESP, [EBX+0x72], 0x666f736f
0x1410031 745c JZ 0x141008f
0x1410033 57 PUSH EDI
0x1410034 696e646f77735c IMUL EBP, [ESI+0x64], 0x5c73776f
0x141003b 43 INC EBX
0x141003c 7572 JNZ 0x14100b0
0x141003e 7265 JB 0x14100a5
Process: explorer.exe Pid: 1096 Address: 0x1970000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01970000 55 8b ec 8b 75 08 80 be f7 03 00 00 00 7e 07 56 U...u........~.V
0x01970010 ff 96 00 0d 00 00 80 be f8 03 00 00 01 75 30 b8 .............u0.
0x01970020 01 00 00 00 80 be f7 03 00 00 00 7e 14 8d be b1 ...........~....
0x01970030 06 00 00 57 8d be b2 05 00 00 57 ff 96 cd 00 00 ...W......W.....
0x1970000 55 PUSH EBP
0x1970001 8bec MOV EBP, ESP
0x1970003 8b7508 MOV ESI, [EBP+0x8]
0x1970006 80bef703000000 CMP BYTE [ESI+0x3f7], 0x0
0x197000d 7e07 JLE 0x1970016
0x197000f 56 PUSH ESI
0x1970010 ff96000d0000 CALL DWORD [ESI+0xd00]
0x1970016 80bef803000001 CMP BYTE [ESI+0x3f8], 0x1
0x197001d 7530 JNZ 0x197004f
0x197001f b801000000 MOV EAX, 0x1
0x1970024 80bef703000000 CMP BYTE [ESI+0x3f7], 0x0
0x197002b 7e14 JLE 0x1970041
0x197002d 8dbeb1060000 LEA EDI, [ESI+0x6b1]
0x1970033 57 PUSH EDI
0x1970034 8dbeb2050000 LEA EDI, [ESI+0x5b2]
0x197003a 57 PUSH EDI
0x197003b ff DB 0xff
0x197003c 96 XCHG ESI, EAX
0x197003d cd00 INT 0x0
0x197003f 00 DB 0x0
Process: explorer.exe Pid: 1096 Address: 0x1980000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01980000 55 8b ec 81 c4 7c f0 ff ff 8b 75 08 68 74 0f 00 U....|....u.ht..
0x01980010 00 56 8d bd 8c f0 ff ff 57 ff 96 a9 00 00 00 c7 .V......W.......
0x01980020 85 7c f0 ff ff 00 00 00 00 83 85 7c f0 ff ff 01 .|.........|....
0x01980030 ff b5 7c f0 ff ff e8 0d 00 00 00 65 78 70 6c 6f ..|........explo
0x1980000 55 PUSH EBP
0x1980001 8bec MOV EBP, ESP
0x1980003 81c47cf0ffff ADD ESP, 0xfffff07c
0x1980009 8b7508 MOV ESI, [EBP+0x8]
0x198000c 68740f0000 PUSH DWORD 0xf74
0x1980011 56 PUSH ESI
0x1980012 8dbd8cf0ffff LEA EDI, [EBP+0xfffff08c]
0x1980018 57 PUSH EDI
0x1980019 ff96a9000000 CALL DWORD [ESI+0xa9]
0x198001f c7857cf0ffff00000000 MOV DWORD [EBP+0xfffff07c], 0x0
0x1980029 83857cf0ffff01 ADD DWORD [EBP+0xfffff07c], 0x1
0x1980030 ffb57cf0ffff PUSH DWORD [EBP+0xfffff07c]
0x1980036 e80d000000 CALL 0x1980048
0x198003b 657870 JS 0x19800ae
0x198003e 6c INS [ES:EDI], DX
0x198003f 6f OUTS DX, [ESI]
Process: explorer.exe Pid: 1096 Address: 0x1990000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01990000 55 8b ec 83 c4 fc 57 56 8b 75 08 6a 40 68 00 30 U.....WV.u.j@h.0
0x01990010 00 00 ff 75 10 6a 00 ff 75 0c ff 96 b1 00 00 00 ...u.j..u.......
0x01990020 50 8d 7d fc 57 ff 75 10 ff 75 14 50 ff 75 0c ff P.}.W.u..u.P.u..
0x01990030 96 b5 00 00 00 58 5e 5f c9 c2 10 00 00 00 00 00 .....X^_........
0x1990000 55 PUSH EBP
0x1990001 8bec MOV EBP, ESP
0x1990003 83c4fc ADD ESP, -0x4
0x1990006 57 PUSH EDI
0x1990007 56 PUSH ESI
0x1990008 8b7508 MOV ESI, [EBP+0x8]
0x199000b 6a40 PUSH 0x40
0x199000d 6800300000 PUSH DWORD 0x3000
0x1990012 ff7510 PUSH DWORD [EBP+0x10]
0x1990015 6a00 PUSH 0x0
0x1990017 ff750c PUSH DWORD [EBP+0xc]
0x199001a ff96b1000000 CALL DWORD [ESI+0xb1]
0x1990020 50 PUSH EAX
0x1990021 8d7dfc LEA EDI, [EBP+0xfffffffc]
0x1990024 57 PUSH EDI
0x1990025 ff7510 PUSH DWORD [EBP+0x10]
0x1990028 ff7514 PUSH DWORD [EBP+0x14]
0x199002b 50 PUSH EAX
0x199002c ff750c PUSH DWORD [EBP+0xc]
0x199002f ff96b5000000 CALL DWORD [ESI+0xb5]
0x1990035 58 POP EAX
0x1990036 5e POP ESI
0x1990037 5f POP EDI
0x1990038 c9 LEAVE
0x1990039 c21000 RET 0x10
0x199003c 0000 ADD [EAX], AL
0x199003e 0000 ADD [EAX], AL
Process: explorer.exe Pid: 1096 Address: 0x19c0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x019c0000 55 8b ec 83 c4 f0 8b 75 08 8d be b1 06 00 00 68 U......u.......h
0x019c0010 ff 00 00 00 57 ff 96 ad 00 00 00 80 be af 08 00 ....W...........
0x019c0020 00 01 75 31 80 be f7 03 00 00 01 75 07 68 74 82 ..u1.......u.ht.
0x019c0030 24 fe eb 05 68 ce e7 3a 59 ff b6 bb 0a 00 00 ff $...h..:Y.......
0x19c0000 55 PUSH EBP
0x19c0001 8bec MOV EBP, ESP
0x19c0003 83c4f0 ADD ESP, -0x10
0x19c0006 8b7508 MOV ESI, [EBP+0x8]
0x19c0009 8dbeb1060000 LEA EDI, [ESI+0x6b1]
0x19c000f 68ff000000 PUSH DWORD 0xff
0x19c0014 57 PUSH EDI
0x19c0015 ff96ad000000 CALL DWORD [ESI+0xad]
0x19c001b 80beaf08000001 CMP BYTE [ESI+0x8af], 0x1
0x19c0022 7531 JNZ 0x19c0055
0x19c0024 80bef703000001 CMP BYTE [ESI+0x3f7], 0x1
0x19c002b 7507 JNZ 0x19c0034
0x19c002d 68748224fe PUSH DWORD 0xfe248274
0x19c0032 eb05 JMP 0x19c0039
0x19c0034 68cee73a59 PUSH DWORD 0x593ae7ce
0x19c0039 ffb6bb0a0000 PUSH DWORD [ESI+0xabb]
0x19c003f ff DB 0xff
Process: explorer.exe Pid: 1096 Address: 0x19b0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x019b0000 55 8b ec 81 c4 20 ef ff ff 56 53 57 52 51 c7 85 U........VSWRQ..
0x019b0010 24 ef ff ff 00 00 00 00 8b 75 08 68 74 0f 00 00 $........u.ht...
0x019b0020 56 8d bd 8c f0 ff ff 57 ff 96 a9 00 00 00 c7 87 V......W........
0x019b0030 b4 08 00 00 00 00 00 00 8d 85 30 ef ff ff 50 6a ..........0...Pj
0x19b0000 55 PUSH EBP
0x19b0001 8bec MOV EBP, ESP
0x19b0003 81c420efffff ADD ESP, 0xffffef20
0x19b0009 56 PUSH ESI
0x19b000a 53 PUSH EBX
0x19b000b 57 PUSH EDI
0x19b000c 52 PUSH EDX
0x19b000d 51 PUSH ECX
0x19b000e c78524efffff00000000 MOV DWORD [EBP+0xffffef24], 0x0
0x19b0018 8b7508 MOV ESI, [EBP+0x8]
0x19b001b 68740f0000 PUSH DWORD 0xf74
0x19b0020 56 PUSH ESI
0x19b0021 8dbd8cf0ffff LEA EDI, [EBP+0xfffff08c]
0x19b0027 57 PUSH EDI
0x19b0028 ff96a9000000 CALL DWORD [ESI+0xa9]
0x19b002e c787b408000000000000 MOV DWORD [EDI+0x8b4], 0x0
0x19b0038 8d8530efffff LEA EAX, [EBP+0xffffef30]
0x19b003e 50 PUSH EAX
0x19b003f 6a DB 0x6a
Process: explorer.exe Pid: 1096 Address: 0x19d0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x019d0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x019d0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x019d0020 00 e1 9a 80 7c 74 9b 80 7c c7 06 81 7c 6b 23 80 ....|t..|...|k#.
0x019d0030 7c 17 6c dd 77 42 78 dd 77 ab 7a dd 77 d7 ea dd |.l.wBx.w.z.w...
0x19d0000 0000 ADD [EAX], AL
0x19d0002 0000 ADD [EAX], AL
0x19d0004 0000 ADD [EAX], AL
0x19d0006 0000 ADD [EAX], AL
0x19d0008 0000 ADD [EAX], AL
0x19d000a 0000 ADD [EAX], AL
0x19d000c 0000 ADD [EAX], AL
0x19d000e 0000 ADD [EAX], AL
0x19d0010 0000 ADD [EAX], AL
0x19d0012 0000 ADD [EAX], AL
0x19d0014 0000 ADD [EAX], AL
0x19d0016 0000 ADD [EAX], AL
0x19d0018 0000 ADD [EAX], AL
0x19d001a 0000 ADD [EAX], AL
0x19d001c 0000 ADD [EAX], AL
0x19d001e 0000 ADD [EAX], AL
0x19d0020 00e1 ADD CL, AH
0x19d0022 9a807c749b807c CALL FAR 0x7c80:0x9b747c80
0x19d0029 c706817c6b23 MOV DWORD [ESI], 0x236b7c81
0x19d002f 807c176cdd CMP BYTE [EDI+EDX+0x6c], 0xdd
0x19d0034 7742 JA 0x19d0078
0x19d0036 78dd JS 0x19d0015
0x19d0038 77ab JA 0x19cffe5
0x19d003a 7add JP 0x19d0019
0x19d003c 77d7 JA 0x19d0015
0x19d003e ea DB 0xea
0x19d003f dd DB 0xdd
Process: explorer.exe Pid: 1096 Address: 0x1a20000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01a20000 00 00 00 00 00 00 00 00 00 00 c4 01 00 00 cb 01 ................
0x01a20010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x01a20020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x01a20030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1a20000 0000 ADD [EAX], AL
0x1a20002 0000 ADD [EAX], AL
0x1a20004 0000 ADD [EAX], AL
0x1a20006 0000 ADD [EAX], AL
0x1a20008 0000 ADD [EAX], AL
0x1a2000a c401 LES EAX, [ECX]
0x1a2000c 0000 ADD [EAX], AL
0x1a2000e cb RETF
0x1a2000f 0100 ADD [EAX], EAX
0x1a20011 0000 ADD [EAX], AL
0x1a20013 0000 ADD [EAX], AL
0x1a20015 0000 ADD [EAX], AL
0x1a20017 0000 ADD [EAX], AL
0x1a20019 0000 ADD [EAX], AL
0x1a2001b 0000 ADD [EAX], AL
0x1a2001d 0000 ADD [EAX], AL
0x1a2001f 0000 ADD [EAX], AL
0x1a20021 0000 ADD [EAX], AL
0x1a20023 0000 ADD [EAX], AL
0x1a20025 0000 ADD [EAX], AL
0x1a20027 0000 ADD [EAX], AL
0x1a20029 0000 ADD [EAX], AL
0x1a2002b 0000 ADD [EAX], AL
0x1a2002d 0000 ADD [EAX], AL
0x1a2002f 0000 ADD [EAX], AL
0x1a20031 0000 ADD [EAX], AL
0x1a20033 0000 ADD [EAX], AL
0x1a20035 0000 ADD [EAX], AL
0x1a20037 0000 ADD [EAX], AL
0x1a20039 0000 ADD [EAX], AL
0x1a2003b 0000 ADD [EAX], AL
0x1a2003d 0000 ADD [EAX], AL
0x1a2003f 00 DB 0x0
Process: explorer.exe Pid: 1096 Address: 0x1a30000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01a30000 55 8b ec 83 c4 c8 53 56 57 8b 5d 08 8b 73 08 33 U.....SVW.]..s.3
0x01a30010 c0 89 45 f0 c6 45 e3 00 80 be b8 08 00 00 00 0f ..E..E..........
0x01a30020 84 b2 00 00 00 c6 86 b8 08 00 00 00 8b 86 b4 08 ................
0x01a30030 00 00 33 d2 89 50 38 6a 01 8b 03 03 45 f0 50 8d ..3..P8j....E.P.
0x1a30000 55 PUSH EBP
0x1a30001 8bec MOV EBP, ESP
0x1a30003 83c4c8 ADD ESP, -0x38
0x1a30006 53 PUSH EBX
0x1a30007 56 PUSH ESI
0x1a30008 57 PUSH EDI
0x1a30009 8b5d08 MOV EBX, [EBP+0x8]
0x1a3000c 8b7308 MOV ESI, [EBX+0x8]
0x1a3000f 33c0 XOR EAX, EAX
0x1a30011 8945f0 MOV [EBP+0xfffffff0], EAX
0x1a30014 c645e300 MOV BYTE [EBP+0xffffffe3], 0x0
0x1a30018 80beb808000000 CMP BYTE [ESI+0x8b8], 0x0
0x1a3001f 0f84b2000000 JZ 0x1a300d7
0x1a30025 c686b808000000 MOV BYTE [ESI+0x8b8], 0x0
0x1a3002c 8b86b4080000 MOV EAX, [ESI+0x8b4]
0x1a30032 33d2 XOR EDX, EDX
0x1a30034 895038 MOV [EAX+0x38], EDX
0x1a30037 6a01 PUSH 0x1
0x1a30039 8b03 MOV EAX, [EBX]
0x1a3003b 0345f0 ADD EAX, [EBP+0xfffffff0]
0x1a3003e 50 PUSH EAX
0x1a3003f 8d DB 0x8d
Process: explorer.exe Pid: 1096 Address: 0x1c40000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c40000 55 8b ec 83 c4 cc 53 56 57 89 4d dc 89 55 e0 33 U.....SVW.M..U.3
0x01c40010 d2 8b f8 8b 87 b4 08 00 00 8b f0 8b 40 34 89 45 ............@4.E
0x01c40020 cc 8b 45 cc 8b 80 24 03 00 00 89 45 e8 8b 45 cc ..E...$....E..E.
0x01c40030 8b 40 08 05 b0 01 00 00 89 45 e4 64 ff 35 00 00 .@.......E.d.5..
0x1c40000 55 PUSH EBP
0x1c40001 8bec MOV EBP, ESP
0x1c40003 83c4cc ADD ESP, -0x34
0x1c40006 53 PUSH EBX
0x1c40007 56 PUSH ESI
0x1c40008 57 PUSH EDI
0x1c40009 894ddc MOV [EBP+0xffffffdc], ECX
0x1c4000c 8955e0 MOV [EBP+0xffffffe0], EDX
0x1c4000f 33d2 XOR EDX, EDX
0x1c40011 8bf8 MOV EDI, EAX
0x1c40013 8b87b4080000 MOV EAX, [EDI+0x8b4]
0x1c40019 8bf0 MOV ESI, EAX
0x1c4001b 8b4034 MOV EAX, [EAX+0x34]
0x1c4001e 8945cc MOV [EBP+0xffffffcc], EAX
0x1c40021 8b45cc MOV EAX, [EBP+0xffffffcc]
0x1c40024 8b8024030000 MOV EAX, [EAX+0x324]
0x1c4002a 8945e8 MOV [EBP+0xffffffe8], EAX
0x1c4002d 8b45cc MOV EAX, [EBP+0xffffffcc]
0x1c40030 8b4008 MOV EAX, [EAX+0x8]
0x1c40033 05b0010000 ADD EAX, 0x1b0
0x1c40038 8945e4 MOV [EBP+0xffffffe4], EAX
0x1c4003b 64 DB 0x64
0x1c4003c ff DB 0xff
0x1c4003d 35 DB 0x35
0x1c4003e 0000 ADD [EAX], AL
Process: explorer.exe Pid: 1096 Address: 0x1c60000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c60000 53 56 8b c8 8b 99 b4 08 00 00 8b 73 34 8b da 33 SV.........s4..3
0x01c60010 c9 ff 96 d4 01 00 00 33 c0 89 43 04 33 c0 89 43 .......3..C.3..C
0x01c60020 08 5e 5b c3 00 00 00 00 00 00 00 00 00 00 00 00 .^[.............
0x01c60030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1c60000 53 PUSH EBX
0x1c60001 56 PUSH ESI
0x1c60002 8bc8 MOV ECX, EAX
0x1c60004 8b99b4080000 MOV EBX, [ECX+0x8b4]
0x1c6000a 8b7334 MOV ESI, [EBX+0x34]
0x1c6000d 8bda MOV EBX, EDX
0x1c6000f 33c9 XOR ECX, ECX
0x1c60011 ff96d4010000 CALL DWORD [ESI+0x1d4]
0x1c60017 33c0 XOR EAX, EAX
0x1c60019 894304 MOV [EBX+0x4], EAX
0x1c6001c 33c0 XOR EAX, EAX
0x1c6001e 894308 MOV [EBX+0x8], EAX
0x1c60021 5e POP ESI
0x1c60022 5b POP EBX
0x1c60023 c3 RET
0x1c60024 0000 ADD [EAX], AL
0x1c60026 0000 ADD [EAX], AL
0x1c60028 0000 ADD [EAX], AL
0x1c6002a 0000 ADD [EAX], AL
0x1c6002c 0000 ADD [EAX], AL
0x1c6002e 0000 ADD [EAX], AL
0x1c60030 0000 ADD [EAX], AL
0x1c60032 0000 ADD [EAX], AL
0x1c60034 0000 ADD [EAX], AL
0x1c60036 0000 ADD [EAX], AL
0x1c60038 0000 ADD [EAX], AL
0x1c6003a 0000 ADD [EAX], AL
0x1c6003c 0000 ADD [EAX], AL
0x1c6003e 0000 ADD [EAX], AL
Process: explorer.exe Pid: 1096 Address: 0x1c50000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c50000 55 8b ec 83 c4 e4 53 56 57 8b 5d 10 8b 45 08 8b U.....SVW.]..E..
0x01c50010 90 b4 08 00 00 8b 72 34 8b 86 24 03 00 00 89 45 ......r4..$....E
0x01c50020 e8 8b 86 d8 01 00 00 05 e0 00 00 00 89 45 e4 64 .............E.d
0x01c50030 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0 ff .5.....E..u..E..
0x1c50000 55 PUSH EBP
0x1c50001 8bec MOV EBP, ESP
0x1c50003 83c4e4 ADD ESP, -0x1c
0x1c50006 53 PUSH EBX
0x1c50007 56 PUSH ESI
0x1c50008 57 PUSH EDI
0x1c50009 8b5d10 MOV EBX, [EBP+0x10]
0x1c5000c 8b4508 MOV EAX, [EBP+0x8]
0x1c5000f 8b90b4080000 MOV EDX, [EAX+0x8b4]
0x1c50015 8b7234 MOV ESI, [EDX+0x34]
0x1c50018 8b8624030000 MOV EAX, [ESI+0x324]
0x1c5001e 8945e8 MOV [EBP+0xffffffe8], EAX
0x1c50021 8b86d8010000 MOV EAX, [ESI+0x1d8]
0x1c50027 05e0000000 ADD EAX, 0xe0
0x1c5002c 8945e4 MOV [EBP+0xffffffe4], EAX
0x1c5002f 64ff3500000000 PUSH DWORD [FS:0x0]
0x1c50036 8f45ec POP DWORD [EBP+0xffffffec]
0x1c50039 ff75e8 PUSH DWORD [EBP+0xffffffe8]
0x1c5003c 8f45f0 POP DWORD [EBP+0xfffffff0]
0x1c5003f ff DB 0xff
Process: explorer.exe Pid: 1096 Address: 0x1cb0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01cb0000 55 8b ec 81 c4 b0 fe ff ff 53 56 57 8b fa 89 45 U........SVW...E
0x01cb0010 d8 8b 75 d8 8b 86 b4 08 00 00 8b 58 34 8b 83 24 ..u........X4..$
0x01cb0020 03 00 00 89 45 e8 8b 43 0c 05 c9 04 00 00 89 45 ....E..C.......E
0x01cb0030 e4 64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 .d.5.....E..u..E
0x1cb0000 55 PUSH EBP
0x1cb0001 8bec MOV EBP, ESP
0x1cb0003 81c4b0feffff ADD ESP, 0xfffffeb0
0x1cb0009 53 PUSH EBX
0x1cb000a 56 PUSH ESI
0x1cb000b 57 PUSH EDI
0x1cb000c 8bfa MOV EDI, EDX
0x1cb000e 8945d8 MOV [EBP+0xffffffd8], EAX
0x1cb0011 8b75d8 MOV ESI, [EBP+0xffffffd8]
0x1cb0014 8b86b4080000 MOV EAX, [ESI+0x8b4]
0x1cb001a 8b5834 MOV EBX, [EAX+0x34]
0x1cb001d 8b8324030000 MOV EAX, [EBX+0x324]
0x1cb0023 8945e8 MOV [EBP+0xffffffe8], EAX
0x1cb0026 8b430c MOV EAX, [EBX+0xc]
0x1cb0029 05c9040000 ADD EAX, 0x4c9
0x1cb002e 8945e4 MOV [EBP+0xffffffe4], EAX
0x1cb0031 64ff3500000000 PUSH DWORD [FS:0x0]
0x1cb0038 8f45ec POP DWORD [EBP+0xffffffec]
0x1cb003b ff75e8 PUSH DWORD [EBP+0xffffffe8]
0x1cb003e 8f DB 0x8f
0x1cb003f 45 INC EBP
Process: explorer.exe Pid: 1096 Address: 0x1c90000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c90000 55 8b ec 83 c4 e4 53 56 57 8b 7d 14 8b 55 08 8b U.....SVW.}..U..
0x01c90010 82 b4 08 00 00 8b 40 34 8b 88 24 03 00 00 89 4d ......@4..$....M
0x01c90020 e8 8b 80 d0 01 00 00 05 88 00 00 00 89 45 e4 64 .............E.d
0x01c90030 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0 ff .5.....E..u..E..
0x1c90000 55 PUSH EBP
0x1c90001 8bec MOV EBP, ESP
0x1c90003 83c4e4 ADD ESP, -0x1c
0x1c90006 53 PUSH EBX
0x1c90007 56 PUSH ESI
0x1c90008 57 PUSH EDI
0x1c90009 8b7d14 MOV EDI, [EBP+0x14]
0x1c9000c 8b5508 MOV EDX, [EBP+0x8]
0x1c9000f 8b82b4080000 MOV EAX, [EDX+0x8b4]
0x1c90015 8b4034 MOV EAX, [EAX+0x34]
0x1c90018 8b8824030000 MOV ECX, [EAX+0x324]
0x1c9001e 894de8 MOV [EBP+0xffffffe8], ECX
0x1c90021 8b80d0010000 MOV EAX, [EAX+0x1d0]
0x1c90027 0588000000 ADD EAX, 0x88
0x1c9002c 8945e4 MOV [EBP+0xffffffe4], EAX
0x1c9002f 64ff3500000000 PUSH DWORD [FS:0x0]
0x1c90036 8f45ec POP DWORD [EBP+0xffffffec]
0x1c90039 ff75e8 PUSH DWORD [EBP+0xffffffe8]
0x1c9003c 8f45f0 POP DWORD [EBP+0xfffffff0]
0x1c9003f ff DB 0xff
Process: explorer.exe Pid: 1096 Address: 0x1c80000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01c80000 55 8b ec 51 53 56 57 8b 7d 0c 8b 55 08 8b f2 8b U..QSVW.}..U....
0x01c80010 86 b4 08 00 00 8b 40 34 8b df 83 7b 08 00 7c 56 ......@4...{..|V
0x01c80020 83 7d 14 00 7c 50 8b 4b 08 03 4d 14 89 4d fc 83 .}..|P.K..M..M..
0x01c80030 7d fc 00 7e 41 8b 4d fc 3b 4b 04 7e 1a 8b 4d fc }..~A.M.;K.~..M.
0x1c80000 55 PUSH EBP
0x1c80001 8bec MOV EBP, ESP
0x1c80003 51 PUSH ECX
0x1c80004 53 PUSH EBX
0x1c80005 56 PUSH ESI
0x1c80006 57 PUSH EDI
0x1c80007 8b7d0c MOV EDI, [EBP+0xc]
0x1c8000a 8b5508 MOV EDX, [EBP+0x8]
0x1c8000d 8bf2 MOV ESI, EDX
0x1c8000f 8b86b4080000 MOV EAX, [ESI+0x8b4]
0x1c80015 8b4034 MOV EAX, [EAX+0x34]
0x1c80018 8bdf MOV EBX, EDI
0x1c8001a 837b0800 CMP DWORD [EBX+0x8], 0x0
0x1c8001e 7c56 JL 0x1c80076
0x1c80020 837d1400 CMP DWORD [EBP+0x14], 0x0
0x1c80024 7c50 JL 0x1c80076
0x1c80026 8b4b08 MOV ECX, [EBX+0x8]
0x1c80029 034d14 ADD ECX, [EBP+0x14]
0x1c8002c 894dfc MOV [EBP+0xfffffffc], ECX
0x1c8002f 837dfc00 CMP DWORD [EBP+0xfffffffc], 0x0
0x1c80033 7e41 JLE 0x1c80076
0x1c80035 8b4dfc MOV ECX, [EBP+0xfffffffc]
0x1c80038 3b4b04 CMP ECX, [EBX+0x4]
0x1c8003b 7e1a JLE 0x1c80057
0x1c8003d 8b4dfc MOV ECX, [EBP+0xfffffffc]
Process: explorer.exe Pid: 1096 Address: 0x1ca0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01ca0000 53 56 57 55 51 89 0c 24 8b fa 8b f0 8b c6 8b 90 SVWUQ..$........
0x01ca0010 b4 08 00 00 8b 6a 34 8b df 54 57 56 ff 95 d8 01 .....j4..TWV....
0x01ca0020 00 00 89 03 8b 04 24 89 43 0c 5a 5d 5f 5e 5b c3 ......$.C.Z]_^[.
0x01ca0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1ca0000 53 PUSH EBX
0x1ca0001 56 PUSH ESI
0x1ca0002 57 PUSH EDI
0x1ca0003 55 PUSH EBP
0x1ca0004 51 PUSH ECX
0x1ca0005 890c24 MOV [ESP], ECX
0x1ca0008 8bfa MOV EDI, EDX
0x1ca000a 8bf0 MOV ESI, EAX
0x1ca000c 8bc6 MOV EAX, ESI
0x1ca000e 8b90b4080000 MOV EDX, [EAX+0x8b4]
0x1ca0014 8b6a34 MOV EBP, [EDX+0x34]
0x1ca0017 8bdf MOV EBX, EDI
0x1ca0019 54 PUSH ESP
0x1ca001a 57 PUSH EDI
0x1ca001b 56 PUSH ESI
0x1ca001c ff95d8010000 CALL DWORD [EBP+0x1d8]
0x1ca0022 8903 MOV [EBX], EAX
0x1ca0024 8b0424 MOV EAX, [ESP]
0x1ca0027 89430c MOV [EBX+0xc], EAX
0x1ca002a 5a POP EDX
0x1ca002b 5d POP EBP
0x1ca002c 5f POP EDI
0x1ca002d 5e POP ESI
0x1ca002e 5b POP EBX
0x1ca002f c3 RET
0x1ca0030 0000 ADD [EAX], AL
0x1ca0032 0000 ADD [EAX], AL
0x1ca0034 0000 ADD [EAX], AL
0x1ca0036 0000 ADD [EAX], AL
0x1ca0038 0000 ADD [EAX], AL
0x1ca003a 0000 ADD [EAX], AL
0x1ca003c 0000 ADD [EAX], AL
0x1ca003e 0000 ADD [EAX], AL
Process: explorer.exe Pid: 1096 Address: 0x1ce0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01ce0000 53 56 57 55 51 8b e9 8b fa 8b f0 8b c6 8b 90 b4 SVWUQ...........
0x01ce0010 08 00 00 8b 5a 34 55 ff 53 70 88 04 24 6a 01 8d ....Z4U.Sp..$j..
0x01ce0020 44 24 04 50 57 56 ff 93 cc 01 00 00 33 c0 8a 04 D$.PWV......3...
0x01ce0030 24 50 55 57 56 ff 93 cc 01 00 00 5a 5d 5f 5e 5b $PUWV......Z]_^[
0x1ce0000 53 PUSH EBX
0x1ce0001 56 PUSH ESI
0x1ce0002 57 PUSH EDI
0x1ce0003 55 PUSH EBP
0x1ce0004 51 PUSH ECX
0x1ce0005 8be9 MOV EBP, ECX
0x1ce0007 8bfa MOV EDI, EDX
0x1ce0009 8bf0 MOV ESI, EAX
0x1ce000b 8bc6 MOV EAX, ESI
0x1ce000d 8b90b4080000 MOV EDX, [EAX+0x8b4]
0x1ce0013 8b5a34 MOV EBX, [EDX+0x34]
0x1ce0016 55 PUSH EBP
0x1ce0017 ff5370 CALL DWORD [EBX+0x70]
0x1ce001a 880424 MOV [ESP], AL
0x1ce001d 6a01 PUSH 0x1
0x1ce001f 8d442404 LEA EAX, [ESP+0x4]
0x1ce0023 50 PUSH EAX
0x1ce0024 57 PUSH EDI
0x1ce0025 56 PUSH ESI
0x1ce0026 ff93cc010000 CALL DWORD [EBX+0x1cc]
0x1ce002c 33c0 XOR EAX, EAX
0x1ce002e 8a0424 MOV AL, [ESP]
0x1ce0031 50 PUSH EAX
0x1ce0032 55 PUSH EBP
0x1ce0033 57 PUSH EDI
0x1ce0034 56 PUSH ESI
0x1ce0035 ff93cc010000 CALL DWORD [EBX+0x1cc]
0x1ce003b 5a POP EDX
0x1ce003c 5d POP EBP
0x1ce003d 5f POP EDI
0x1ce003e 5e POP ESI
0x1ce003f 5b POP EBX
Process: explorer.exe Pid: 1096 Address: 0x1cd0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01cd0000 55 8b ec 83 c4 a4 53 56 57 89 55 dc 89 45 e0 8b U.....SVW.U..E..
0x01cd0010 45 e0 8b 90 b4 08 00 00 8b 5a 34 8b 83 24 03 00 E........Z4..$..
0x01cd0020 00 89 45 e8 8b 83 54 04 00 00 05 41 01 00 00 89 ..E...T....A....
0x01cd0030 45 e4 64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f E.d.5.....E..u..
0x1cd0000 55 PUSH EBP
0x1cd0001 8bec MOV EBP, ESP
0x1cd0003 83c4a4 ADD ESP, -0x5c
0x1cd0006 53 PUSH EBX
0x1cd0007 56 PUSH ESI
0x1cd0008 57 PUSH EDI
0x1cd0009 8955dc MOV [EBP+0xffffffdc], EDX
0x1cd000c 8945e0 MOV [EBP+0xffffffe0], EAX
0x1cd000f 8b45e0 MOV EAX, [EBP+0xffffffe0]
0x1cd0012 8b90b4080000 MOV EDX, [EAX+0x8b4]
0x1cd0018 8b5a34 MOV EBX, [EDX+0x34]
0x1cd001b 8b8324030000 MOV EAX, [EBX+0x324]
0x1cd0021 8945e8 MOV [EBP+0xffffffe8], EAX
0x1cd0024 8b8354040000 MOV EAX, [EBX+0x454]
0x1cd002a 0541010000 ADD EAX, 0x141
0x1cd002f 8945e4 MOV [EBP+0xffffffe4], EAX
0x1cd0032 64ff3500000000 PUSH DWORD [FS:0x0]
0x1cd0039 8f45ec POP DWORD [EBP+0xffffffec]
0x1cd003c ff75e8 PUSH DWORD [EBP+0xffffffe8]
0x1cd003f 8f DB 0x8f
Process: explorer.exe Pid: 1096 Address: 0x1cc0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01cc0000 55 8b ec 83 c4 80 53 56 57 89 4d d8 89 55 dc 89 U.....SVW.M..U..
0x01cc0010 45 e0 8b 5d 08 8b 45 e0 89 45 c0 8b 45 c0 8b 80 E..]..E..E..E...
0x01cc0020 b4 08 00 00 89 45 bc 8b 70 34 8b 86 24 03 00 00 .....E..p4..$...
0x01cc0030 89 45 e8 8b 46 58 05 6e 03 00 00 89 45 e4 64 ff .E..FX.n....E.d.
0x1cc0000 55 PUSH EBP
0x1cc0001 8bec MOV EBP, ESP
0x1cc0003 83c480 ADD ESP, -0x80
0x1cc0006 53 PUSH EBX
0x1cc0007 56 PUSH ESI
0x1cc0008 57 PUSH EDI
0x1cc0009 894dd8 MOV [EBP+0xffffffd8], ECX
0x1cc000c 8955dc MOV [EBP+0xffffffdc], EDX
0x1cc000f 8945e0 MOV [EBP+0xffffffe0], EAX
0x1cc0012 8b5d08 MOV EBX, [EBP+0x8]
0x1cc0015 8b45e0 MOV EAX, [EBP+0xffffffe0]
0x1cc0018 8945c0 MOV [EBP+0xffffffc0], EAX
0x1cc001b 8b45c0 MOV EAX, [EBP+0xffffffc0]
0x1cc001e 8b80b4080000 MOV EAX, [EAX+0x8b4]
0x1cc0024 8945bc MOV [EBP+0xffffffbc], EAX
0x1cc0027 8b7034 MOV ESI, [EAX+0x34]
0x1cc002a 8b8624030000 MOV EAX, [ESI+0x324]
0x1cc0030 8945e8 MOV [EBP+0xffffffe8], EAX
0x1cc0033 8b4658 MOV EAX, [ESI+0x58]
0x1cc0036 056e030000 ADD EAX, 0x36e
0x1cc003b 8945e4 MOV [EBP+0xffffffe4], EAX
0x1cc003e 64 DB 0x64
0x1cc003f ff DB 0xff
Process: explorer.exe Pid: 1096 Address: 0x1d00000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01d00000 55 8b ec 83 c4 d0 53 56 57 be 39 05 00 00 8b c6 U.....SVW.9.....
0x01d00010 8b 90 b4 08 00 00 8b 5a 34 8b 83 24 03 00 00 89 .......Z4..$....
0x01d00020 45 e8 8b 83 ec 03 00 00 05 cd 00 00 00 89 45 e4 E.............E.
0x01d00030 64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0 d.5.....E..u..E.
0x1d00000 55 PUSH EBP
0x1d00001 8bec MOV EBP, ESP
0x1d00003 83c4d0 ADD ESP, -0x30
0x1d00006 53 PUSH EBX
0x1d00007 56 PUSH ESI
0x1d00008 57 PUSH EDI
0x1d00009 be39050000 MOV ESI, 0x539
0x1d0000e 8bc6 MOV EAX, ESI
0x1d00010 8b90b4080000 MOV EDX, [EAX+0x8b4]
0x1d00016 8b5a34 MOV EBX, [EDX+0x34]
0x1d00019 8b8324030000 MOV EAX, [EBX+0x324]
0x1d0001f 8945e8 MOV [EBP+0xffffffe8], EAX
0x1d00022 8b83ec030000 MOV EAX, [EBX+0x3ec]
0x1d00028 05cd000000 ADD EAX, 0xcd
0x1d0002d 8945e4 MOV [EBP+0xffffffe4], EAX
0x1d00030 64ff3500000000 PUSH DWORD [FS:0x0]
0x1d00037 8f45ec POP DWORD [EBP+0xffffffec]
0x1d0003a ff75e8 PUSH DWORD [EBP+0xffffffe8]
0x1d0003d 8f45f0 POP DWORD [EBP+0xfffffff0]
Process: explorer.exe Pid: 1096 Address: 0x1cf0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01cf0000 55 8b ec 8b 55 10 8b 45 0c 8b 48 08 89 8a b8 00 U...U..E..H.....
0x01cf0010 00 00 8b 48 0c 89 8a c4 00 00 00 8b 40 10 89 82 ...H........@...
0x01cf0020 b4 00 00 00 33 c0 5d c2 10 00 8b c0 55 8b ec 83 ....3.].....U...
0x01cf0030 c4 e4 53 56 57 8b 5d 10 8b 45 08 8b 90 b4 08 00 ..SVW.]..E......
0x1cf0000 55 PUSH EBP
0x1cf0001 8bec MOV EBP, ESP
0x1cf0003 8b5510 MOV EDX, [EBP+0x10]
0x1cf0006 8b450c MOV EAX, [EBP+0xc]
0x1cf0009 8b4808 MOV ECX, [EAX+0x8]
0x1cf000c 898ab8000000 MOV [EDX+0xb8], ECX
0x1cf0012 8b480c MOV ECX, [EAX+0xc]
0x1cf0015 898ac4000000 MOV [EDX+0xc4], ECX
0x1cf001b 8b4010 MOV EAX, [EAX+0x10]
0x1cf001e 8982b4000000 MOV [EDX+0xb4], EAX
0x1cf0024 33c0 XOR EAX, EAX
0x1cf0026 5d POP EBP
0x1cf0027 c21000 RET 0x10
0x1cf002a 8bc0 MOV EAX, EAX
0x1cf002c 55 PUSH EBP
0x1cf002d 8bec MOV EBP, ESP
0x1cf002f 83c4e4 ADD ESP, -0x1c
0x1cf0032 53 PUSH EBX
0x1cf0033 56 PUSH ESI
0x1cf0034 57 PUSH EDI
0x1cf0035 8b5d10 MOV EBX, [EBP+0x10]
0x1cf0038 8b4508 MOV EAX, [EBP+0x8]
0x1cf003b 8b DB 0x8b
0x1cf003c 90 NOP
0x1cf003d b408 MOV AH, 0x8
0x1cf003f 00 DB 0x0
Process: explorer.exe Pid: 1096 Address: 0x1d10000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01d10000 55 8b ec 81 c4 d0 fe ff ff 53 56 57 89 55 e0 8b U........SVW.U..
0x01d10010 d8 8b f3 8b 86 b4 08 00 00 89 45 d8 8b 78 34 8b ..........E..x4.
0x01d10020 87 24 03 00 00 89 45 e8 8b 87 e8 03 00 00 05 13 .$....E.........
0x01d10030 01 00 00 89 45 e4 64 ff 35 00 00 00 00 8f 45 ec ....E.d.5.....E.
0x1d10000 55 PUSH EBP
0x1d10001 8bec MOV EBP, ESP
0x1d10003 81c4d0feffff ADD ESP, 0xfffffed0
0x1d10009 53 PUSH EBX
0x1d1000a 56 PUSH ESI
0x1d1000b 57 PUSH EDI
0x1d1000c 8955e0 MOV [EBP+0xffffffe0], EDX
0x1d1000f 8bd8 MOV EBX, EAX
0x1d10011 8bf3 MOV ESI, EBX
0x1d10013 8b86b4080000 MOV EAX, [ESI+0x8b4]
0x1d10019 8945d8 MOV [EBP+0xffffffd8], EAX
0x1d1001c 8b7834 MOV EDI, [EAX+0x34]
0x1d1001f 8b8724030000 MOV EAX, [EDI+0x324]
0x1d10025 8945e8 MOV [EBP+0xffffffe8], EAX
0x1d10028 8b87e8030000 MOV EAX, [EDI+0x3e8]
0x1d1002e 0513010000 ADD EAX, 0x113
0x1d10033 8945e4 MOV [EBP+0xffffffe4], EAX
0x1d10036 64ff3500000000 PUSH DWORD [FS:0x0]
0x1d1003d 8f45ec POP DWORD [EBP+0xffffffec]
Process: explorer.exe Pid: 1096 Address: 0x1de0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6
0x01de0000 00 00 ac 01 08 00 ac 01 02 10 00 00 05 00 c2 01 ................
0x01de0010 01 00 ac 01 01 00 c2 01 00 00 00 00 00 00 00 00 ................
0x01de0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x01de0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1de0000 0000 ADD [EAX], AL
0x1de0002 ac LODSB
0x1de0003 0108 ADD [EAX], ECX
0x1de0005 00ac0102100000 ADD [ECX+EAX+0x1002], CH
0x1de000c 0500c20101 ADD EAX, 0x101c200
0x1de0011 00ac010100c201 ADD [ECX+EAX+0x1c20001], CH
0x1de0018 0000 ADD [EAX], AL
0x1de001a 0000 ADD [EAX], AL
0x1de001c 0000 ADD [EAX], AL
0x1de001e 0000 ADD [EAX], AL
0x1de0020 0000 ADD [EAX], AL
0x1de0022 0000 ADD [EAX], AL
0x1de0024 0000 ADD [EAX], AL
0x1de0026 0000 ADD [EAX], AL
0x1de0028 0000 ADD [EAX], AL
0x1de002a 0000 ADD [EAX], AL
0x1de002c 0000 ADD [EAX], AL
0x1de002e 0000 ADD [EAX], AL
0x1de0030 0000 ADD [EAX], AL
0x1de0032 0000 ADD [EAX], AL
0x1de0034 0000 ADD [EAX], AL
0x1de0036 0000 ADD [EAX], AL
0x1de0038 0000 ADD [EAX], AL
0x1de003a 0000 ADD [EAX], AL
0x1de003c 0000 ADD [EAX], AL
0x1de003e 0000 ADD [EAX], AL
Resolving the API Functions
If you have a good eye, you'll notice at least one injected segment that doesn't look anything like the others. Specifically, the disassembly of the segment at 0x1310000 does not make sense:
0x1310000 0011 ADD [ECX], DL
0x1310002 42 INC EDX
0x1310003 ab STOSD
0x1310004 7107 JNO 0x131000d
0x1310006 4a DEC EDX
0x1310007 ab STOSD
0x1310008 712b JNO 0x1310035Luckily, malfind provides a hex dump preview of the memory as well. What you see is this:
0x01310000 00 11 42 ab 71 07 4a ab 71 2b 3e ab 71 27 4c ab ..B.q.J.q+>.q'L.
0x01310010 71 6f 67 ab 71 53 2e ab 71 e1 2e ab 71 55 53 ab qog.qS..q...qUS.
0x01310020 71 e1 9a 80 7c 74 9b 80 7c c7 06 81 7c 6b 23 80 q...|t..|...|k#.
0x01310030 7c 17 6c dd 77 42 78 dd 77 ab 7a dd 77 d7 ea dd |.l.wBx.w.z.w...There's an obvious pattern among the data. If its not as obvious to you as it was to me when I saw it, skip the first byte (00) and format the data as 32-bit integers using volshell:
$ python vol.py -f memory.img volshell
Volatile Systems Volatility Framework 2.3_alpha
Current context: process System, pid=4, ppid=0 DTB=0x39000
Welcome to volshell! Current memory image is:
file:///Volumes/Storage/memory/memory.img
To get help, type 'hh()'
>>> cc(pid = 1096)
Current context: process explorer.exe, pid=1096, ppid=1212 DTB=0x8cc000
>>> dd(0x01310000 + 1)
01310001 71ab4211 71ab4a07 71ab3e2b 71ab4c27
01310011 71ab676f 71ab2e53 71ab2ee1 71ab5355
01310021 7c809ae1 7c809b74 7c8106c7 7c80236b
01310031 77dd6c17 77dd7842 77dd7aab 77ddead7
01310041 77de4280 77dde9e4 77de4312 77de5196
01310051 7c831ec5 7c8286d6 7c801a28 7e44f6b4
01310061 7e42c2e8 7e43216b 7c810e17 7e42b3c6
01310071 7c810c1e 7e455721 7e42d226 7c80a864See it now!? It looks like an array of memory addresses, all landing in the 7XXXXXXX range, which is typically where you find system DLLs on Windows XP (remember this is before ASLR). Even though Poison Ivy leaves no trace of a PE header and thus no IAT, you've just identified the call table used by the malware to find API functions it needs at run time. After dynamically resolving the APIs (via GetProcAddress or manually parsing a DLL's EAT), the addresses are saved into this table.
The next step is to compute the reverse of GetProcAddress - given an address, determine the name of the API function is. This will give you an idea of at least some of the malware's capabilities. Volatility is full of useful plugins from which you can "borrow" code and leverage for malware analysis. So we'll stay in volshell in the context of explorer.exe (note: after the cc command, the self.eproc variable is set to the target process's _EPROCESS object). We enumerate all DLLs in explorer with the get_load_modules() function.
>>> explorer = self.eproc
>>> all_mods = list(explorer.get_load_modules())Now we call out to the impscan plugin and use its enum_apis() function. This parses the Export Address Table (EAT) of all DLLs and returns a dictionary of API information. The keys to the dictionary are addresses within explorer.exe where the API functions start. The values are tuples of the containing DLL and function name.
>>> import volatility.plugins.malware.impscan as impscan
>>> apis = impscan.ImpScan(self._config).enum_apis(all_mods)Next we will read all the addresses in the call table starting at 0x1310001 into an array. Looking at the original dd output, the first address should be 0x71ab4211, so you can double check by printing the first element in the array:
>>> addrs = obj.Object("Array", targetType = "address", offset = 0x01310001, vm = explorer.get_process_address_space(), count = 100)
>>> hex(addrs[0])
'0x71ab4211L'Finally, we can iterate over all addresses in the array and check if the apis dictionary has a key that matches. If so, we print the dictionary's values.
>>> for addr in addrs:
... if int(addr) in apis:
... (dll, func) = apis[int(addr)]
... print hex(addr.obj_offset - 0x01310000), dll.BaseDllName, func
...
0x1 WS2_32.dll socket
0x5 WS2_32.dll connect
0x9 WS2_32.dll closesocket
0xd WS2_32.dll send
0x11 WS2_32.dll recv
0x15 WS2_32.dll ntohs
0x19 WS2_32.dll inet_addr
0x1d WS2_32.dll gethostbyname
0x21 kernel32.dll VirtualAlloc
0x25 kernel32.dll VirtualFree
0x29 kernel32.dll CreateThread
0x2d kernel32.dll CreateProcessA
0x31 ADVAPI32.dll RegCloseKey
0x35 ADVAPI32.dll RegOpenKeyExA
0x39 ADVAPI32.dll RegQueryValueExA
0x3d ADVAPI32.dll RegSetValueExA
0x41 ADVAPI32.dll RegDeleteKeyA
0x45 ADVAPI32.dll RegCreateKeyExA
0x49 ADVAPI32.dll RegQueryInfoKeyA
0x4d ADVAPI32.dll RegEnumKeyExA
0x51 kernel32.dll DeleteFileA
0x55 kernel32.dll CopyFileA
0x59 kernel32.dll CreateFileA
0x5d USER32.dll GetKeyNameTextA
0x61 USER32.dll GetActiveWindow
0x65 USER32.dll GetWindowTextA
0x69 kernel32.dll WriteFile
0x6d USER32.dll CallNextHookEx
0x71 kernel32.dll SetFilePointer
0x75 USER32.dll ToAscii
0x79 USER32.dll GetKeyboardState
0x7d kernel32.dll GetLocalTime
0x81 kernel32.dll lstrcatA
0x85 kernel32.dll CreateMutexA
0x89 ntdll.dll RtlGetLastWin32Error
0x8d kernel32.dll GetFileTime
0x91 kernel32.dll SetFileTime
0x95 kernel32.dll OpenProcess
0x99 WS2_32.dll select
0x9d kernel32.dll LoadLibraryA
0xa1 kernel32.dll CloseHandle
0xa5 kernel32.dll Sleep
0xa9 ntdll.dll RtlMoveMemory
0xad ntdll.dll RtlZeroMemory
0xb1 kernel32.dll VirtualAllocEx
0xb5 kernel32.dll WriteProcessMemory
0xb9 kernel32.dll CreateToolhelp32Snapshot
0xbd kernel32.dll Process32First
0xc1 kernel32.dll Process32Next
0xc9 kernel32.dll CreateRemoteThread
0xcd kernel32.dll lstrcmpiAAs you can see, Poison Ivy uses APIs for networking (send, recv, gethostbyname, etc), for launching external processes (CreateProcessA), and modifying and querying the registry (for persistence with the Run key). It also includes CallNextHookEx (typically used in conjunction with SetWindowsHookEx which you may remember from MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem), ToAscii, and GetKeyboardState - all likely components of the keylogger; however as we noticed in the original post, that functionality of the RAT was disabled. There are various other clues you can gain from this, such as SetFileTime (timestomping), and VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread for the code injection.
Embedded Strings and Unconditional CALLs
The offsets we printed to the left of the API names are relative to the call table base (0x1310000). These are the values you would see being used in disassembles of the code. For example, CALL DWORD PTR [EDI + 91] would be a call to SetFileTime. And this is one way you can proceed with reverse engineering the RAT's functionality even though its split across 20+ memory segments in explorer.exe and there is no PE header or IAT. Let's apply this knowledge to one of the memory segments that contains executable instructions:
>>> dis(0x1300000) 0x1300000 55 PUSH EBP 0x1300001 8bec MOV EBP, ESP 0x1300003 81c430faffff ADD ESP, 0xfffffa30 0x1300009 8b7508 MOV ESI, [EBP+0x8] 0x130000c 8d86fb030000 LEA EAX, [ESI+0x3fb] 0x1300012 50 PUSH EAX 0x1300013 6a00 PUSH 0x0 0x1300015 6a00 PUSH 0x0 0x1300017 ff9685000000 CALL DWORD [ESI+0x85] ; CreateMutexA 0x130001d 8986c5080000 MOV [ESI+0x8c5], EAX 0x1300023 ff9689000000 CALL DWORD [ESI+0x89] ; GetLastError 0x1300029 3db7000000 CMP EAX, 0xb7 ; ERROR_ALREADY_EXISTS 0x130002e 7504 JNZ 0x1300034 0x1300030 c9 LEAVE 0x1300031 c20400 RET 0x4 0x1300034 56 PUSH ESI 0x1300035 8d866b090000 LEA EAX, [ESI+0x96b] 0x130003b 50 PUSH EAX 0x130003c 8d8645010000 LEA EAX, [ESI+0x145] 0x1300042 50 PUSH EAX 0x1300043 ff96fd000000 CALL DWORD [ESI+0xfd] 0x1300049 e807000000 CALL 0x13000550x130004e 7773 JA 0x13000c3 0x1300050 325f33 XOR BL, [EDI+0x33] 0x1300053 3200 XOR AL, [EAX]0x1300055 58 POP EAX 0x1300056 50 PUSH EAX 0x1300057 ff969d000000 CALL DWORD [ESI+0x9d] ; LoadLibraryA 0x130005d 8986c30a0000 MOV [ESI+0xac3], EAX
Now that we've applied labels to the calls, the purpose of the function in this memory segment is easily understood. It is the function that creates the mutex and then returns if the mutex already existed or not; otherwise it goes on to load the ws2_32 (winsock2) library. Here's what you know based on the above disassembly:
- The function takes one argument (EBP+0x8). This is moved into ESI which is the register referenced when making the API calls (CALL DWORD [ESI+0x85]). Thus the argument is a pointer to the base address of the memory region that contains the API call table (0x1310000).
- When CreateMutexA is called, the third parameter (mutex name) is pushed on the stack from EAX, but before that it came from [ESI+0x3fb]. Now we know the offset of the mutex name inside the memory region.
- The return value of CreateMutexA (a HANDLE to the created or opened mutex) is placed into [ESI+0x8c5].
- It calls GetLastError and if that reports ERROR_ALREADY_EXISTS, the function returns. Otherwise it jumps to 0x1300034. See below for what happens next.
>>> db(0x130004e) 0x0130004e77 73 32 5f 33 32 0058 50 ff 96 9d 00 00 00 89ws2_32.XP....... 0x0130005e 86 c3 0a 00 00 e8 3a 00 00 00 e1 60 b4 8e 01 00 ......:....`....
The trick of "hiding" strings by embedding them between executable instructions is not new. Greg Hoglund discussed it in his "Detecting APT Attackers In Memory" post (and obviously Poison Ivy has been doing it for years). In the post, Poison Ivy wasn't identified by name, the term "APT" was dropped about 12 times, and you can tell based on similarities in the code that it was definitely Poison Ivy.
Reverse Engineering the Code
If Hex-Rays Decompiler worked on code fragments in physical memory, that would be awesome...but it doesn't. So we are left with the task of manually reversing code if we want to understand how it looks at a higher level language. The example function we displayed above, with partial structures, can be seen below:
typedef struct _PIVY_CALLS {
/* offset 0x000 */ unsigned char zero; // 00
/* offset 0x001 */ VOID * p_socket;
/* offset 0x005 */ VOID * p_connect;
/* offset 0x009 */ VOID * p_closesocket;
.....
/* offset 0x089 */ VOID * p_CreateMutexA;
/* offset 0x09d */ VOID * p_LoadLibraryA;
} PIVY_CALLS, *PPIVY_CALLS;
// this is the structure at 0x1310000
typedef struct _PIVY_STRUCT {
/* offset 0x008 */ PIVY_CALLS PivyCalls;
/* offset 0x3fb */ CHAR szMutex[unknown_size];
/* offset 0x8c5 */ HANDLE hMutex;
/* offset 0xac3 */ HMODULE hLibWinsock;
} PIVY_STRUCT, *PPIVY_STRUCT;
VOID Sub_1300000 (PPIVY_STRUCT PivyStruct) // EBP+0x8
{
PivyStruct->hMutex = PivyStruct->PivyCalls.p_CreateMutexA(
NULL,
FALSE,
PivyStruct->szMutex);
if (GetLastError() == ERROR_ALREADY_EXISTS)
return;
PivyStruct->hLibWinsock = PivyStruct->PivyCalls.p_LoadLibraryA("ws2_32");
......
}Not bad for a start, right? The Poison Ivy functions are spread across multiple memory segments, strings are interspersed with code, and the API call table is in yet another segment. But its still possible to reverse engineer and figure out what each function does when you put the pieces together.
Automating the Solution
To help automate the task of labeling API calls throughout the different memory segments, pulling out the embedded strings, and things of that nature, we built a new Volatility plugin called pivydasm. We use the distorm3 stream disassembler, just like many other existing plugins. However, we had to handle some special cases. Instead of doing a simple linear scan through the code blocks (since there are anti-disassembling tricks), we had to use additional checks to make sure the results were correct.
Basic usage:
$ python vol.py -f memory.img pivydasm --pid=1096 --output=html --output-file=report.html
Here's a brief description of how the plugin works:
- It scans for injected code segments, just like malfind
- It distinguishes between PoisonIvy's functions blocks and the API call table
- It does an initial linear pass with distorm3 on all functions, applying labels to imported function calls and collecting called addresses that exist within other code fragments.
- It does a second pass with the disassembler making sure to start at all addresses that other instructions called. It discards instructions that don't match up, effectively identifying the anti-disassembling tricks and eliminating them from the final disassembly view
The plugin can render output as text (to the terminal) or HTML. I prefer to use the HTML report for this particular plugin, because it uses colors similar to IDA Pro and makes things "feel" more familiar. Here's an example - click to enlarge:
- The instruction at address 0x0129000c references the mutex name ")!VoqA.I4" using a LEA EAX, [ESI + 0x3fb]. It is passed to CreateMutexA, which itself is accessed as CALL DWORD [ESI + 0x85]. Code which used to just be meaningless offsets and registers now makes perfect sense.
- The instruction at address 0x01290043 calls [ESI + 0xfd] which Andreas Schuster named "func_Key_expansion" in this original set of Poison Ivy plugins for Volatility. This would seem to be accurate since the parameters passed to the function include the RAT's secret password "tigers" and a pointer to the Camellia key schedule.
- The initial pass through the data with a linear scan identified the bytes at 0x0129004e (77 73) as JA 0x12900c3. That does not make sense since there is no comparison before the JA. Thus three instructions are shown in a strike-out font, they're labeled as ANTI-DISASM, and the bytes for those "fake" instructions are interpreted as a string "ws2_32" and displayed in a comment.
In the next screen shot, you can see where the command and control communications take place. The func_Send_Receive function is just a wrapper around the ws2_32.send and ws2_32.recv calls. Notice the Cemellia key schedule is referenced before calling the encryption and decryption routines:
In the next screen shot, you can see the registry Run key we noticed in the original forensic analysis. This string is also embedded between executable code blocks. After referencing the string, it calls RegOpenKeyExA, RegSetValueExA, and RegCloseKey.
The final screen shot shows the few functions involved in code injection to other processes. From top to bottom, you see a CALL DWORD [ESI + 0xd1] which goes to 0x01990000 (the function in the middle). At that location, the well-known combination of VirtualAllocEx and WriteProcessMemory allocates memory and transfers data to the remote process. Then CreateRemoteThread is called to execute code at offset 0x0197000 (func_Extra). The function you see in the bottom that calls CreateToolhelp32Snapshot, Process32First, and lstrcmpiA is how the malware finds a process by name (i.e. it maps "explorer.exe" to its process ID).
Visualizing Relationships
Since Volatility can render data in various formats, we added a Graphviz .dot style rendering function to the pivydasm plugin. It can be called like this:
$ python vol.py -f memory.img pivydasm --pid=1096 --output=dot --output-file=graph.dot
You can click (or download) and enlarge the image below. It basically shows the relationship among injected code fragments and how they call each other. To lend some context to the graph, all labels displayed in the HTML disassembly were ported to the graph nodes.
Conclusion
Volatility is more than just a memory forensics framework. Its a malware analysis tool with unparalleled visibility and power. In this post, we took an hour or so and produced a plugin that can do more than certain products that vendors sell for $10,000+. It reconstructs code fragments that the PoisonIvy RAT disperses into more than two dozen small allocations throughout process memory, puts them in context, and allows you to attribute the artifacts we saw in the original forensic analysis to exact code instructions that produced them. Code or it didn't happen? Oh, it definitely happened!
No comments:
Post a Comment