When Anti-Virus Engines Look Like Kernel Rootkits

While analyzing real-world systems, memory analysts will often encounter anti-virus (AV) engines, EDRs, and similar products that, at first glance, look suspiciously like malware. This occurs because these security products leverage the same techniques commonly employed by malware—such as API hooking, system call hooking, and registering callbacks—in order to gain the insight they need to detect and analyze threats.

A recent journal publication by members of our team examined this issue for userland API hooks. In this blog post we will show an example of what AV kernel hooks often look like. The sample investigated in this post was sent by a friend who wanted clarification of the behavior, as it was part of a real investigation. In particular, Volatility's ssdt plugin was showing many system call table entries as being hooked, and our friend wanted to know if the hooks were malicious or benign.

System Calls Background

System calls are the common mechanism by which unprivileged code in userland (process) memory requests services through the kernel to access privileged resources, such as the hard drive to create/read/write/delete files, the network stack to send/receive packets, the monitor to display information to the user, and numerous other resources. System calls are also used to enumerate the active system state, such as the list of running processes, active network connections, loaded kernel modules, and nearly everything else that live forensic tools and endpoint agents gather for analysis. This obviously makes the system call table an attractive target for malware to tamper with, as well as a high-value location for security agents to monitor.

To check for signs of rootkits, Volatility's ssdt plugin locates each system call table present in a memory sample and then enumerates each system call table entry. For each entry, it prints either the containing module, if found, or UNKNOWN if the entry points to a memory location not associated with the kernel itself or a module contained within the kernel module list. Several common kernel rootkit methods of hiding code will trigger the classification as UNKNOWN, such as unlinking the malicious module from the module list, or allocating a RWX memory region and then using it to host code after the malicious module is unloaded (see this blog post on analyzing a detached kernel thread).

Unfortunately, the use of system call hooking by AV and EDR engines frequently triggers UNKNOWN entries in ssdt output, as security agents' attempts to "hide" on a system often leverage the same tactics used by malware.

Initial Analysis

To start the analysis, the ssdt plugin was run against the sample:

$ python vol.py -f sample.raw --profile=Win7SP1x86  ssdt > ssdt-output.txt 

Volatility Foundation Volatility Framework 2.6

$ grep -c UNKNOWN ssdt-output.txt 

45

$ grep UNKNOWN ssdt-output.txt | head -20

  Entry 0x000d: 0x886ea580 (NtAlertResumeThread) owned by UNKNOWN

  Entry 0x000e: 0x881f70b0 (NtAlertThread) owned by UNKNOWN

  Entry 0x0013: 0x886e4d88 (NtAllocateVirtualMemory) owned by UNKNOWN

  Entry 0x0016: 0x88217ca0 (NtAlpcConnectPort) owned by UNKNOWN

  Entry 0x002b: 0x886e9e80 (NtAssignProcessToJobObject) owned by UNKNOWN

  Entry 0x004a: 0x886ea390 (NtCreateMutant) owned by UNKNOWN

  Entry 0x0056: 0x886e9c48 (NtCreateSymbolicLinkObject) owned by UNKNOWN

  Entry 0x0057: 0x88438858 (NtCreateThread) owned by UNKNOWN

  Entry 0x0058: 0x886e9d00 (NtCreateThreadEx) owned by UNKNOWN

  Entry 0x0060: 0x886e9f30 (NtDebugActiveProcess) owned by UNKNOWN

  Entry 0x006f: 0x886e4910 (NtDuplicateObject) owned by UNKNOWN

  Entry 0x0083: 0x886eaba8 (NtFreeVirtualMemory) owned by UNKNOWN

  Entry 0x0091: 0x88436198 (NtImpersonateAnonymousToken) owned by UNKNOWN

  Entry 0x0093: 0x886ea4d0 (NtImpersonateThread) owned by UNKNOWN

  Entry 0x009b: 0x880d3478 (NtLoadDriver) owned by UNKNOWN

  Entry 0x00a8: 0x886eaae0 (NtMapViewOfSection) owned by UNKNOWN

  Entry 0x00b1: 0x886ea2e0 (NtOpenEvent) owned by UNKNOWN

  Entry 0x00be: 0x886e4de0 (NtOpenProcess) owned by UNKNOWN

  Entry 0x00bf: 0x886e4db8 (NtOpenProcessToken) owned by UNKNOWN

  Entry 0x00c2: 0x886ea1a8 (NtOpenSection) owned by UNKNOWN

Looking at the output, it appears that 45 entries are hooked by UNKNOWN module(s). Furthermore, the hooked functions are commonly targeted by both malware and security agents.

Classifying One Hook

To begin the process of determining if the hooks are benign or malicious, volshell was used to examine the code of a few hooks. volshell is a Volatility plugin that allows you to interactively explore a memory sample, including viewing, searching, and disassembling arbitrary addresses in any context (the kernel or a particular process).

To start, volshell was loaded and the hook for Entry 0x000d: 0x886ea580 (NtAlertResumeThread) was disassembled (numbers, dashes, and arrows added for ease of explanation):

$ python vol.py -f sample.raw --profile=Win7SP1x86  volshell

<snip>

> dis(0x886ea580)

0x886ea580 55                               PUSH EBP                               <----- [1]

0x886ea581 8bec                           MOV EBP, ESP

0x886ea583 ff750c                         PUSH DWORD [EBP+0xc]

0x886ea586 b9fca56e88                MOV ECX, 0x886ea5fc            <-----  [2]

0x886ea58b ff7508                         PUSH DWORD [EBP+0x8]

0x886ea58e 51                               PUSH ECX

0x886ea58f 8b01                            MOV EAX, [ECX]                      <-----  [3]

0x886ea591 ff5004                         CALL DWORD [EAX+0x4]        <-----  [4]

0x886ea594 83c40c                       ADD ESP, 0xc

0x886ea597 5d                               POP EBP

0x886ea598 c20800                       RET 0x8                                    <-----  [5]

0x886ea59b cc                               INT 3

0x886ea59c 0000                           ADD [EAX], AL

0x886ea59e 0000                           ADD [EAX], AL

<snip>

After reading the disassembly, several things stand out. First, there is a real function prologue with the instructions of "PUSH EBP; MOV EBP, ESP;" [1] and, shortly after, a proper function epilogue [5]. Examining the code in between, a hardcoded address is stored in ECX [2]. That address is dereferenced and stored in EAX [3]. A dereference of EAX + 4 is then used as the target address of a CALL instruction [4].

This code flow can be re-implemented in volshell through the use of its dd (display double word) and dis functions.

> dd(0x886ea5fc, 4)                   

886ea5fc  964c72b4

> dd(0x964c72b4 + 4, 4)          

964c72b8  964ba922

> dis(0x964ba922)

0x964ba922 55                               PUSH EBP

0x964ba923 8bec                           MOV EBP, ESP

0x964ba925 51                               PUSH ECX

0x964ba926 51                               PUSH ECX

0x964ba927 53                               PUSH EBX

0x964ba928 56                               PUSH ESI

0x964ba929 57                               PUSH EDI

0x964ba92a bf010000c0                MOV EDI, 0xc0000001

<snip>

The first invocation of dd is at the hardcoded address from [2] earlier. As can be seen, the address stored here is 0x964c72b4. The second dd invocation dereferences this address + 4 just as the disassembly in [4] from earlier shows. This gives a CALL target address of 0x964ba922, which the address used in the above dis call.

Looking at the instructions here, there is the beginning of a long function which appears to be the real hook implementation. To determine which, if any, module is hosting the real payload, the drivermodule plugin can be invoked with the address of the function:

$ python vol.py -f sample.raw --profile=Win7SP1x86 drivermodule -a 0x964ba922

Volatility Foundation Volatility Framework 2.6

Module                   Driver          Alt. Name    Service Key

--------------------- ------------- ------------- -----------

SYMEVENT.SYS     SymEvent   SymEvent   \Driver\SymEvent

This output shows that the function is inside of the SYMEVENT.SYS driver, which is part of the Symantec AV/Endpoint protection suite installed on the system.

Classifying All Hooks

So far, it has only been shown that 1 of the 45 hooks belongs to Symantec. To ensure that all of them belong to Symantec, the remaining 44 must be checked. Repeating the volshell steps for two more of the system calls showed the same pattern as before: a hardcoded address (different address for each hook) being dereferenced, followed by the value of the first dereference having 4 added then being dereferenced itself. The consistent result between the hooks of this sample was that the final destination was the same: 0x964ba922. With this in mind, it became clear that the process of checking each hook could be automated to see if they all ended at 0x964ba922. 

To accomplish this, awk was first used to extract just the UNKNOWN addresses from the ssdt output saved earlier:

$ grep UNKNOWN ssdt-output.txt | awk '{ print $3 }' > unknown-addresses

This placed all of the UNKNOWN addresses in the unknown-addresses file. Next, code was written inside of volshell that repeated the read hardcoded address-> dereference -> dereference+4 pattern. Note: volshell runs inside of the Python shell, so whatever you can do in Python, you can do in volshell as well.  The following shows this code in its entirety, with line numbers added to the beginning of each line.

1.    > for line in open("unknown-addresses", "r").readlines():

2.   ...:    address = int(line.strip(), 16)

3.   ...:    insts = addrspace().zread(address + 6, 5)

4.   ...:    if ord(insts[0]) != 0xb9:

5.   ...:        print "invalid instruction at %x | %x" % (address, ord(insts[0]))

6.   ...:        break

7.   ...:     

8.   ...:    first_addr = struct.unpack("<I", insts[1:])[0]

9.   ...:     

10. ...:   second_addr_str = addrspace().zread(first_addr, 4)

11. ...:   second_addr = struct.unpack("<I", second_addr_str)[0]

12. ...:     

13. ...:   function_addr_str = addrspace().zread(second_addr + 4, 4)

14. ...:   function_addr = struct.unpack("<I", function_addr_str)[0]

15. ...:     

16. ...:   if function_addr != 0x964ba922:

17. ...:        print "incorrect function_address: %x" % function_addr

18. ...:     

This code starts by looping for each line in the file, which contains one line for each UNKNOWN hook address. Next, the address is converted to an integer. On line 3, the hook address plus 6 is read for 5 bytes inside of the kernel address space. This corresponds to reading what should be the MOV ECX, <hardcoded address> instruction at [2] in the first disassembly listing. The first byte of the instruction is verified to be 0xb9, which is the MOV instruction opcode. On line 8, the remaining 4 bytes are then converted to an integer, as they are the hardcoded address in little endian. On lines 10  and 11, the hardcoded address is dereferenced and then converted to an integer. On lines 13 and 14, the dereferenced valued plus 4 is dereferenced and converted to an integer. It is then verified to be the target CALL address of 0x964ba922.

Running this loop over the sample showed that all system call hooks transferred control flow to 0x964ba922, which means that all hooks belonged to the same Symantec driver.

Closing Thoughts

Through a mix of manual reverse engineering and automated comparisons based on knowledge learned, the system call table was automatically verified as clean, and our friend was given a repeatable methodology to apply to other samples in his investigation.

If you like this type of analysis and want to challenge yourself to write plugins that automate memory forensic techniques, then consider a submission to our 2020 Volatility Plugin Contest. This year's contest is based on Volatility 3, and you can learn about the new, exciting features of Volatility 3 in our recently recorded presentation.

If you would like to stay in touch with the Volatility Team and community then consider following us on Twitter, joining our Slack Server, and subscribing to our email list.

Guest Post: Martin Korman (VolatilityBot - An Automated Malicious Code Dumper)

This is a guest post from Martin Korman, author of VolatilityBot.

Lately, I've found myself manually unpacking different versions of the same malware in order to perform static analysis with IDA and BinDiff. Therefore, I've decided to write a small system that will automate the entire process – the VolatilityBot.

How does VolatilityBot work?

1. It executes the malware on a VM.
2. It waits for a pre-defined period of time.
3. It suspends the VM.
4. It compares the snapshot to a golden image of the VM, finds new processes, injected code, loaded DLLs or Kernel Modules, dumps them from the memory and fixes the PE file in order to make static analysis easier.

All metadata is saved to a SQLite DB. Dumps are saved to a configured storage path on disk. All PE files pass a short static analysis and reports are stored as well. VolatilityBot can theoretically manage an unlimited quantity of virtual machines, depending on the performance of your host machine. 

Some core capabilities of this automation tool were designed to make it as scalable as possible and easy to work with over time:

• The Bot-Excavator's Manager can handle an unlimited number of machines at once, all depending on the performance of the researcher's equipment.
• Automatic "Golden Image" generation is provided in order to ease the process of creating all "Golden Image" data. Just create your configuration file, and execute the script.
• To simplify scalability, any database supported by SQLalchemy can be set or replaced as needed. The default Bot-Excavator's backend saves data to an SQLite database.
• Memory dumps and data from all configured post processing modules are saved to a predefined storage directory.
• Add tags to each execution of the script for quick visual reference to information you may need later.
• Add dynamic tags to post-processing modules. For example, for malware that loads a kernel mode driver, tag it with "loads_kmd".Volatility Bot-Excavator's modular structure makes it easy to add additional modules and post-processors that may be deemed necessary with time. 

Let's dive deeper into the architecture of VolatilityBot. The Bot-Excavator is made of four (4) major components:

1. The Manager. This is the core of the Bot-Excavator tool. The Manager executes the automatic extraction as well as the post-processing modules. This module also controls the associated machines' activity to streamline the workflow.

2. Machines Module. This is an abstract design of a research machine; it contains five functions: Revert, Start, Suspend, Clean-up and Get memory path. Each machine has a minimal python agent running, that listens and waits for a malware sample. When the sample is sent, it executes it by double clicking the sample, using an AutoIt script. 

The agent is really minimal in order to not affect the behavior of the malware in the machine. The agent does not perform any API hooking and does not control the machine in any form besides executing the malware. The machines are controlled and monitored by the manager component, which knows not to send more analyses to a machine if its busy or if it encountered any errors analyzing the previous sample.

3. Code Extractors. This component consists of a number of modules grouped together for the purpose of extracting all the different malicious code components from memory. These are separate for code injections, new processes, etc. This component is modular and allows researchers to write new code for other extractors they may need.

These are the existing modules for this component:

• injected_code – uses the Volatility "malfind" plugin in order to find suspect memory areas, after dumping them it tries to determine if the section contains a valid PE or valid shell code. If it found a valid PE, it fixes PE the header. Either way it will extract strings and execute YARA on the section dumped from memory.
• module_scan - Uses the Volatility "modscan" plugin to load kernel modules. It detects and dumps newly loaded kernel modules.
• create_process_dump - Uses the Volatility "procdump" and "pslist" plugins to dump new processes created by malware. Executes YARA, and extracts malware strings.
• create_process_dump_as - Uses the Volatility "procdump" plugin to dump address space. Executes YARA, and extracts malware strings.
• hooks – Extract API hooks done by malware (User-mode and Kernel-mode)

4. Post-Processing Modules. The post-processing modules kick in after the extraction is complete. They are then tasked with automated actions like fixing the PE, or availing the resulting elements to static analysis, YARA scans, strings and IP address logging etc.

This module type can help with:

• Executing the configured YARA rules on post-extraction input as defined by the researcher.
• Extracting strings from the input defined. Other modules can be layered on top in order to extract IP addresses, URLs, etc.
• Producing a report for static analysis with basic PE analysis of the input file.

Because the malware samples are executed in a virtual machine, in order to avoid VM detection, a few tricks were used:

• Registry keys cleanup (all VMware stuff I don't think there is a need to describe, as there's a lot of information on the internet regarding this issue).
• A macro that moves the mouse and executes the malware.
• Of course, no VMware tools on the machine.

Documentation and installation instructions are available here:
https://bitbucket.org/martink90/volatilitybot_public/downloads/Documentation_Nov_2015.pdf

Source code is available here: https://bitbucket.org/martink90/volatilitybot_public

My VB2015 slides are available here: https://www.virusbtn.com/pdf/conference_slides/2015/Korman-VB2015.pdf

For any questions, feel free to reach me via twitter (@MartinKorman), or open an issue in the project's Bit Bucket. 

PlugX: Memory Forensics Lifecycle with Volatility

At OSDFCon last week, we discussed a case study showing how we identified manipulated memory artifacts in an infected environment. We were then able to rapidly introduce new capabilities to Volatility that could be used proactively in other environments.

The presentation (hosted on prezi) takes you on a tour of this activity, using a series of videos. Unfortunately, there's no audio (you should have attended the conference!) but it should be fairly self explanatory what's going on. Here's a short description of what the presentation covers:

• A recent PlugX variant penetrated the target's network. It installed a service named RasTls for persistence and then hid the service from all live tools (WMI, Power Shell, services.msc, sc query, etc). 
• It injected code into a process and then erased its PE header to evade detection and make dumping the PE file out of memory a bit more complicated. 
• We identified the injected region with malfind, extracted it with Volatility, then used a hex editor and PE editor to reconstruct the PE file format. 
• We leveraged the impscan plugin to label API calls inside IDA Pro, then reverse engineered the binary to figure out how it's rootkit component was working. It was clearly targeting the double-linked list of services in usermode space of services.exe. 
• Next we wrote a new Volatility plugin to automatically detect unlinked services, by comparing the records in memory with the memory-resident registry hives. 

The second part of our talk covered the new features in Volatility 2.5 (including the unified output, community integration, and support for Windows 10, Mac El Capitan, and Linux kernels up to 4.2.3) and all of the submissions to this year's Volatility Plugin Contest.

You can find the slide deck for our talk here (pdf).

HowTo: Extract "Hidden" API-Hooking BHO DLLs

A Twitter user recently asked a question to the @volatility account: "can you please tell me how to extract SilentBanker [from memory]"? We like to encourage people to work through problems on their own, so our initial advice was short and sweet: SilentBanker is a BHO so find the DLL and extract it with dlldump. The follow up question from the Twitter user was one that likely many other people have had in the past (regarding SilentBanker or any other malware with similar characteristics), so we turned the reply into a blog post. In particular, the user could find the BHO by querying the registry, but it did not appear to be loaded in any process.

So, how do you find the DLL in order to dump it?

Identifying the BHO DLL

Let's re-trace the user's steps and see how the task might be completed. Given the knowledge that its a BHO, you might start by getting the CLSID with printkey:

$ python vol.py -f silentbanker.vmem printkey -K 'Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects'
Volatile Systems Volatility Framework 2.3_alpha
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\software
Key name: Browser Helper Objects (S)
Last updated: 2010-08-15 18:54:02 

Subkeys:
  (S) {00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}

Then you would resolve the full path to the BHO DLL by querying the CLSID's InprocServer32 value, like this:

$ python vol.py -f silentbanker.vmem printkey -K 'Classes\CLSID\{00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000}\InprocServer32'
Volatile Systems Volatility Framework 2.3_alpha
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\software
Key name: InprocServer32 (S)
Last updated: 2010-08-15 18:54:02 

Subkeys:

Values:
REG_SZ                        : (S) C:\WINDOWS\system32\mscorews.dll
REG_SZ        ThreadingModel  : (S) Apartment

DLLs and File Object Handles

And this is where our friend got stuck. Using dlllist, it does not appear that mscorews.dll is loaded in any process:

$ python vol.py -f silentbanker.vmem dlllist | grep mscorews

Volatile Systems Volatility Framework 2.3_alpha

$ 

Furthermore, as the user noted, filescan locates a FILE_OBJECT that represents mscorews.dll, but there are 0 open handles to the object. 

$ python vol.py -f silentbanker.vmem filescan | grep mscorews

Volatile Systems Volatility Framework 2.3_alpha

Offset(P)    #Ptr   #Hnd Access Name

---------- ------ ------ ------ ----

[snip]

0x04b5b4b8      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\mscorews.dll

[snip]

First you must understand that when a process loads a DLL, a handle to the DLL is opened (creating a FILE_OBJECT), the file's contents are read and mapped into process memory, and then the file handle is closed. So if there are 0 open handles to a FILE_OBJECT, that does not indicate that the DLL was not, or is not, loaded in a process. Don't believe me? Well, kernel32.dll is loaded in *every* process - that is a fact - but both of the FILE_OBJECTs that still reside in physical memory show 0 handles:

$ python vol.py -f silentbanker.vmem filescan | grep kernel32

Volatile Systems Volatility Framework 2.3_alpha

0x0111ad28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll

0x05e39748      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll

Alright, back to the task of finding this DLL. If we're looking for a BHO, our best bet is to look Windows Explorer (explorer.exe) or Internet Explorer (IEXPLORE.EXE). Other processes don't load BHOs, so no need to look elsewhere. Also, intuition tells us that there's a good reason the malware would manifest as a BHO DLL - to inspect, alter, or log the behavior of the target process. Based on that - I immediately think API hooks.

Leveraging API Hooks as a Code Map

The apihooks plugin will not only tell you what functions are hooked, but give you disassembly of the code, which is critical for finding out where the "hidden" DLL exists. In the output below, you'll notice there are about 10 hooked APIs, all of which take an initial hop into a different segment of memory. For example the first API, kernel32!ExitProcess is redirected to 0xe50000. The second entry, user32!DispatchMessageA is redirected to 0x10e0000. At first glance this may appear like a Poison Ivy style fragmented code injection, but its not. Each of the smaller initial hops contain a small sequence of instructions to redirect execution to the main body of SilentBanker's code. 

$ python vol.py -f silentbanker.vmem -p 1884 apihooks --quick
Volatile Systems Volatility Framework 2.3_alpha
************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: kernel32.dll (0x7c800000 - 0x7c8f4000)
Function: kernel32.dll!ExitProcess at 0x7c81caa2
Hook address: 0xe50000
Hooking module: 

Disassembly(0):
0x7c81caa2 e959356384       JMP 0xe50000
0x7c81caa7 6aff             PUSH -0x1
0x7c81caa9 68b0f3e877       PUSH DWORD 0x77e8f3b0
0x7c81caae ff7508           PUSH DWORD [EBP+0x8]
0x7c81cab1 e846ffffff       CALL 0x7c81c9fc
0x7c81cab6 e9               DB 0xe9
0x7c81cab7 29cf             SUB EDI, ECX
0x7c81cab9 01               DB 0x1

Disassembly(1):
0xe50000 58               POP EAX
0xe50001 680500e600       PUSH DWORD 0xe60005
0xe50006 6800000000       PUSH DWORD 0x0
0xe5000b 680000807c       PUSH DWORD 0x7c800000
0xe50010 6828180310       PUSH DWORD 0x10031828
0xe50015 50               PUSH EAX
0xe50016 688e9b0210       PUSH DWORD 0x10029b8e
0xe5001b c3               RET
0xe5001c 0000             ADD [EAX], AL
0xe5001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: USER32.dll (0x77d40000 - 0x77dd0000)
Function: USER32.dll!DispatchMessageA at 0x77d4bcbd
Hook address: 0x10e0000
Hooking module: 

Disassembly(0):
0x77d4bcbd e93e433989       JMP 0x10e0000
0x77d4bcc2 6a01             PUSH 0x1
0x77d4bcc4 ff7508           PUSH DWORD [EBP+0x8]
0x77d4bcc7 e8fdcbffff       CALL 0x77d488c9
0x77d4bccc 5d               POP EBP
0x77d4bccd c20400           RET 0x4
0x77d4bcd0 8b4508           MOV EAX, [EBP+0x8]
0x77d4bcd3 e9               DB 0xe9
0x77d4bcd4 47               INC EDI

Disassembly(1):
0x10e0000 58               POP EAX
0x10e0001 6805000f01       PUSH DWORD 0x10f0005
0x10e0006 6800000000       PUSH DWORD 0x0
0x10e000b 680000807c       PUSH DWORD 0x7c800000
0x10e0010 6828180310       PUSH DWORD 0x10031828
0x10e0015 50               PUSH EAX
0x10e0016 68619f0210       PUSH DWORD 0x10029f61
0x10e001b c3               RET
0x10e001c 0000             ADD [EAX], AL
0x10e001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: USER32.dll (0x77d40000 - 0x77dd0000)
Function: USER32.dll!DispatchMessageW at 0x77d489d9
Hook address: 0x1100000
Hooking module: 

Disassembly(0):
0x77d489d9 e922763b89       JMP 0x1100000
0x77d489de 6a00             PUSH 0x0
0x77d489e0 ff7508           PUSH DWORD [EBP+0x8]
0x77d489e3 e8e1feffff       CALL 0x77d488c9
0x77d489e8 5d               POP EBP
0x77d489e9 c20400           RET 0x4
0x77d489ec 90               NOP
0x77d489ed 90               NOP
0x77d489ee 90               NOP
0x77d489ef 90               NOP
0x77d489f0 90               NOP

Disassembly(1):
0x1100000 58               POP EAX
0x1100001 6805001101       PUSH DWORD 0x1110005
0x1100006 6800000000       PUSH DWORD 0x0
0x110000b 680000807c       PUSH DWORD 0x7c800000
0x1100010 6828180310       PUSH DWORD 0x10031828
0x1100015 50               PUSH EAX
0x1100016 68619f0210       PUSH DWORD 0x10029f61
0x110001b c3               RET
0x110001c 0000             ADD [EAX], AL
0x110001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: USER32.dll (0x77d40000 - 0x77dd0000)
Function: USER32.dll!GetClipboardData at 0x77d6fcb2
Hook address: 0x10c0000
Hooking module: 

Disassembly(0):
0x77d6fcb2 e949033589       JMP 0x10c0000
0x77d6fcb7 83ec2c           SUB ESP, 0x2c
0x77d6fcba 56               PUSH ESI
0x77d6fcbb 57               PUSH EDI
0x77d6fcbc 8d45d4           LEA EAX, [EBP+0xffffffd4]
0x77d6fcbf 50               PUSH EAX
0x77d6fcc0 ff7508           PUSH DWORD [EBP+0x8]
0x77d6fcc3 e8e8000000       CALL 0x77d6fdb0
0x77d6fcc8 8bf0             MOV ESI, EAX

Disassembly(1):
0x10c0000 58               POP EAX
0x10c0001 6805000d01       PUSH DWORD 0x10d0005
0x10c0006 6800000000       PUSH DWORD 0x0
0x10c000b 680000807c       PUSH DWORD 0x7c800000
0x10c0010 6828180310       PUSH DWORD 0x10031828
0x10c0015 50               PUSH EAX
0x10c0016 68bc9f0210       PUSH DWORD 0x10029fbc
0x10c001b c3               RET
0x10c001c 0000             ADD [EAX], AL
0x10c001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: ADVAPI32.dll (0x77dd0000 - 0x77e6b000)
Function: ADVAPI32.dll!CryptDeriveKey at 0x77dea685
Hook address: 0xeb0000
Hooking module: 

Disassembly(0):
0x77dea685 e976590c89       JMP 0xeb0000
0x77dea68a de77e8           FIDIV WORD [EDI+0xffffffe8]
0x77dea68d 88c2             MOV DL, AL
0x77dea68f fe               DB 0xfe
0x77dea690 ff33             PUSH DWORD [EBX]
0x77dea692 f6               DB 0xf6
0x77dea693 8975d8           MOV [EBP+0xffffffd8], ESI
0x77dea696 8975e4           MOV [EBP+0xffffffe4], ESI
0x77dea699 8975d0           MOV [EBP+0xffffffd0], ESI
0x77dea69c 89               DB 0x89

Disassembly(1):
0xeb0000 58               POP EAX
0xeb0001 680500ec00       PUSH DWORD 0xec0005
0xeb0006 6800000000       PUSH DWORD 0x0
0xeb000b 680000807c       PUSH DWORD 0x7c800000
0xeb0010 6828180310       PUSH DWORD 0x10031828
0xeb0015 50               PUSH EAX
0xeb0016 687fa00210       PUSH DWORD 0x1002a07f
0xeb001b c3               RET
0xeb001c 0000             ADD [EAX], AL
0xeb001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: ADVAPI32.dll (0x77dd0000 - 0x77e6b000)
Function: ADVAPI32.dll!CryptGenKey at 0x77e114b1
Hook address: 0xef0000
Hooking module: 

Disassembly(0):
0x77e114b1 e94aeb0d89       JMP 0xef0000
0x77e114b6 e177             LOOPZ 0x77e1152f
0x77e114b8 e85c54fcff       CALL 0x77dd6919
0x77e114bd 33f6             XOR ESI, ESI
0x77e114bf 8975d8           MOV [EBP+0xffffffd8], ESI
0x77e114c2 8975e4           MOV [EBP+0xffffffe4], ESI
0x77e114c5 8975dc           MOV [EBP+0xffffffdc], ESI
0x77e114c8 89               DB 0x89

Disassembly(1):
0xef0000 58               POP EAX
0xef0001 680500f000       PUSH DWORD 0xf00005
0xef0006 6800000000       PUSH DWORD 0x0
0xef000b 680000807c       PUSH DWORD 0x7c800000
0xef0010 6828180310       PUSH DWORD 0x10031828
0xef0015 50               PUSH EAX
0xef0016 6862a10210       PUSH DWORD 0x1002a162
0xef001b c3               RET
0xef001c 0000             ADD [EAX], AL
0xef001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: ADVAPI32.dll (0x77dd0000 - 0x77e6b000)
Function: ADVAPI32.dll!CryptImportKey at 0x77dea879
Hook address: 0xed0000
Hooking module: 

Disassembly(0):
0x77dea879 e982570e89       JMP 0xed0000
0x77dea87e de77e8           FIDIV WORD [EDI+0xffffffe8]
0x77dea881 94               XCHG ESP, EAX
0x77dea882 c0feff           SAR DH, 0xff
0x77dea885 33f6             XOR ESI, ESI
0x77dea887 8975d4           MOV [EBP+0xffffffd4], ESI
0x77dea88a 33db             XOR EBX, EBX
0x77dea88c 895de4           MOV [EBP+0xffffffe4], EBX
0x77dea88f 89               DB 0x89
0x77dea890 75               DB 0x75

Disassembly(1):
0xed0000 58               POP EAX
0xed0001 680500ee00       PUSH DWORD 0xee0005
0xed0006 6800000000       PUSH DWORD 0x0
0xed000b 680000807c       PUSH DWORD 0x7c800000
0xed0010 6828180310       PUSH DWORD 0x10031828
0xed0015 50               PUSH EAX
0xed0016 68f2a00210       PUSH DWORD 0x1002a0f2
0xed001b c3               RET
0xed001c 0000             ADD [EAX], AL
0xed001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: ws2_32.dll (0x71ab0000 - 0x71ac7000)
Function: ws2_32.dll!connect at 0x71ab406a
Hook address: 0xe90000
Hooking module: 

Disassembly(0):
0x71ab406a e991bf3d8f       JMP 0xe90000
0x71ab406f 83ec18           SUB ESP, 0x18
0x71ab4072 57               PUSH EDI
0x71ab4073 8d45e8           LEA EAX, [EBP+0xffffffe8]
0x71ab4076 50               PUSH EAX
0x71ab4077 8d45ec           LEA EAX, [EBP+0xffffffec]
0x71ab407a 50               PUSH EAX
0x71ab407b ff152840ac71     CALL DWORD [0x71ac4028]
0x71ab4081 33               DB 0x33

Disassembly(1):
0xe90000 58               POP EAX
0xe90001 680500ea00       PUSH DWORD 0xea0005
0xe90006 6800000000       PUSH DWORD 0x0
0xe9000b 680000807c       PUSH DWORD 0x7c800000
0xe90010 6828180310       PUSH DWORD 0x10031828
0xe90015 50               PUSH EAX
0xe90016 6818a00210       PUSH DWORD 0x1002a018
0xe9001b c3               RET
0xe9001c 0000             ADD [EAX], AL
0xe9001e 0000             ADD [EAX], AL

************************************************************************
Hook mode: Usermode
Hook type: Inline/Trampoline
Process: 1884 (IEXPLORE.EXE)
Victim module: ws2_32.dll (0x71ab0000 - 0x71ac7000)
Function: ws2_32.dll!send at 0x71ab428a
Hook address: 0xe70000
Hooking module: 

Disassembly(0):
0x71ab428a e971bd3b8f       JMP 0xe70000
0x71ab428f 83ec10           SUB ESP, 0x10
0x71ab4292 56               PUSH ESI
0x71ab4293 57               PUSH EDI
0x71ab4294 33ff             XOR EDI, EDI
0x71ab4296 813d2840ac714894ab71 CMP DWORD [0x71ac4028], 0x71ab9448
0x71ab42a0 0f               DB 0xf
0x71ab42a1 84               DB 0x84

Disassembly(1):
0xe70000 58               POP EAX
0xe70001 680500e800       PUSH DWORD 0xe80005
0xe70006 6800000000       PUSH DWORD 0x0
0xe7000b 680000807c       PUSH DWORD 0x7c800000
0xe70010 6828180310       PUSH DWORD 0x10031828
0xe70015 50               PUSH EAX
0xe70016 68b9990210       PUSH DWORD 0x100299b9
0xe7001b c3               RET
0xe7001c 0000             ADD [EAX], AL
0xe7001e 0000             ADD [EAX], AL

Can you tell what address range to dump now? For ExitProcess, there's a PUSH DWORD 0x10029b8e followed by a RET. For DispatchMessageA, there's a PUSH DWORD 0x10029f61 followed by a RET. For other APIs, they go to 0x10029fbc, 0x1002a07f, and 0x1002a162, etc. So you can bet, regardless of the initial hop addresses, all hooked APIs end up in the range 0x1002????. 

Let's check out that address in volshell:

$ python vol.py -f silentbanker.vmem volshell
Volatile Systems Volatility Framework 2.3_alpha
(pid = Current context: process System, pid=4, ppid=0 DTB=0x319000
Welcome to volshell! 
To get help, type 'hh()'
>>> cc(pid = 1884)
Current context: process IEXPLORE.EXE, pid=1884, ppid=1724 DTB=0x6cc02a0

>>> db(0x10020000)

0x10020000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............

0x10020010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......

0x10020020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0x10020030  00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00   ................

0x10020040  0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68   ........!..L.!Th

0x10020050  69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f   is.program.canno

0x10020060  74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20   t.be.run.in.DOS.

0x10020070  6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00   mode....$.......

There's a PE header at the base address that we selected based on the API hooks output. We don't see mscorews.dll in the dlllist output or in the vadinfo mapped files, because after the DLL initially loads, it copies itself to a virtually allocated region (i.e. VirtualAlloc), then unloads. The entry in the PEB for the DLL is wiped out, as is the file mapping, but the code stays running. Typical code injection artifact that malfind will also detect appropriately: 

$ python vol.py -f silentbanker.vmem -p 1884 malfind

Volatile Systems Volatility Framework 2.3_alpha

[snip]

Process: IEXPLORE.EXE Pid: 1884 Address: 0x10020000

Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE

Flags: CommitCharge: 22, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x10020000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............

0x10020010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......

0x10020020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0x10020030  00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00   ................

Extracting the DLL

At the end of the day, you can now effortlessly extract the hidden DLL from Internet Explorer with the dlldump plugin:

$ mkdir sb

$ python vol.py -f silentbanker.vmem -p 1884 dlldump --base 0x10020000 -D sb/

Volatile Systems Volatility Framework 2.3_alpha

Process(V) Name                 Module Base Module Name          Result

---------- -------------------- ----------- -------------------- ------

0x80f1b020 IEXPLORE.EXE         0x010020000 UNKNOWN              OK: module.1884.107e020.10020000.dll

As a sanity check: 

$ strings sb/module.1884.107e020.10020000.dll

[snip

iexplore.exe

explorer.exe

Content-Type: application/octet-stream

Content-Transfer-Encoding: binary

Content-Disposition: form-data; name="%s"; filename="C:\%s"

Content-Type: application/x-www-form-urlencoded

http://%s

%d%d.exe

/acct/logout.asp

dotscfg.xml

fosinfo.xml

/acct/confirm.asp

&BAction=Confirm

USD_PER_OUNCE

&USD_PER_OUNCE=

PAYER_ACCOUNT

&PAYER_ACCOUNT=

PAYMENT_METAL_ID

&PAYMENT_METAL_ID=

Currency_Symbol

&Currency_Symbol=

Memo

&Memo=

WORTH_OF

&WORTH_OF=

PAY_IN

Amount

Payee_Account

/acct/verify.asp

BAction=Preview

past=&

&WORTH_OF=Gold&Memo=&

9999

&PAY_IN=

&Amount=

Payee_Account=

" VALUE: "

" PASS: "

" LOG: "

POP3 User Name

HTTPMail Password2

HTTPMail User Name

Software\Microsoft\Internet Account Manager\Accounts

Conclusion

Your takeaways for this short how-to is that 1) just because the FILE_OBJECT handle count is zero does not mean a file isn't loaded in a process 2) sometimes a DLL will quickly create a copy of itself and then unload, leaving no trace in the PEB 3) you can use indirect methods to locate hidden DLLs, such as API hook trampoline addresses and injected code artifacts. 

Slides and Video of Analyzing Malware in Memory Webinar

I recently presented a Hacker Academy Deep Dive webinar on 'Analyzing Malware in Memory'. The purpose of this presentation was to show how in-depth malware analysis can performed on memory captures. It went through a number of malware samples, both in userland and the kernel, and showed how to detect and analyze them with Volatility. The replay page has a link to the video and slides of the presentation.

If you like what you saw in the presentation, you may consider one of our training courses, taught directly by the Volatility developers (2013 opportunities to be announced soon).

If you have any questions, please comment on the blog post or you can find me on Twitter (@attrc).

What do Upclicker, Poison Ivy, Cuckoo, and Volatility Have in Common?

Earlier this month, FireEye researchers Abhishek Singh and Yasir Khalid introduced Trojan Upclicker - malware that detects automated sandboxes by hooking mouse movements. If these user interactions never occur, the malware stays dormant, but as soon as someone clicks the left mouse button, it wakes up, injects code into explorer, and proceeds with infection. I recently developed a Volatility plugin for Detecting Hooks in the Windows GUI Subsystem that are installed the same way as Upclicker (SetWindowsHookEx), so I was interested to take it for a test drive. This quickly led to the realization that the malware behind Upclicker's packing is the popular Poison Ivy RAT.  Additionally, Cuckoo Sandbox 0.5 was just released, with an option to acquire full memory dumps that are compatible with Volatility's VirtualBoxCoreDump Address Space. In this blog, we'll report our experiences with that new functionality and how the open-source Cuckoo can be modified in a way that forces Upclicker to execute.

Detecting User Interactions

As described by Singh and Khalid, Upclicker used SetWindowsHookEx to install a hook into the windows messaging subsystem. The hook ID was WH_MOUSE_LL (low level mouse operation) and it filtered for wParam WM_LBUTTONUP (left button up). The malware could also have checked for other input event such as the right mouse button, key strokes; or used the GetLastInputInfo API to determine the number of ticks since the last user interaction of either type. This has been known to work with detecting some sandboxes, but not all. The trick is estimating how many ticks indicate a normal user's "idle" time compared to a sandbox environment. If the delta in tick count exceeds several hours, it may very well be a sandbox system, but then again, if the sandbox developer clicked buttons or pressed keys immediately before taking a snapshot, each time the VM is reverted, it resets the last input tick count to the original value (making it seem like a user was just there).

Anyway, a while back I created a simple test program that checked idle time and I uploaded it to various public sandboxes. It needed a way to convey the value back to me though, which it accomplished by just creating a file named according to the number of idle ticks. The sandbox analysis results would identify the name of the newly created file and that's what I looked at for gathering the info. Unfortunately, this was years ago and I've since lost the data, but the code is below if you want to re-test it and I do remember that several sandboxes reported idle times over a week.

#include <Windows.h>
#include <stdio.h>

int main (int argc, char ** argv)
{
HANDLE hFile;
CHAR szName[MAX_PATH] = {0};
LASTINPUTINFO lii;

lii.cbSize = sizeof(lii);
GetLastInputInfo(&lii);

sprintf(szName, "%d.txt", GetTickCount() - lii.dwTime);

if ((hFile = CreateFileA(szName, 
                    GENERIC_WRITE, 0, NULL, 
                    CREATE_ALWAYS, 0, NULL)) != INVALID_HANDLE_VALUE) { 
CloseHandle(hFile);
}
}

Enabling Memory Dumps in Cuckoo Sandbox

To enable memory dumps, edit the conf/cuckoo.conf file and set the memory_dumps field to "on" as shown below:

# Enable creation of memory dump of the analysis machine before shutting
# down. Even if turned off, this functionality can also be enabled at
# submission. Currently available for: VirtualBox and libvirt modules (KVM).
memory_dump = on

As mentioned in the comment, you can leave memory dumps disabled by default and just enable them for a specific submission...but IMO the more memory dumps, the better ;-)

In the case of VirtualBox, the memory dumps are acquired with the dumpguestcore command and are output in the ELF64 core dump format. Volatility parses these files natively starting with 2.3 alpha. Here's the meta-data of the core dump, using the new vboxinfo plugin:

$ ./vol.py -f ~/cuckoo/storage/analyses/10/memory.dmp vboxinfo
Volatile Systems Volatility Framework 2.3_alpha
Magic: 0xc01ac0de
Format: 0x10000
VirtualBox 4.2.4 (revision 81684)
CPUs: 1

File Offset Memory Offset Size      
----------- ------------- ----------
0x0000006f0 0x00000000000 0x10000000
0x0100006f0 0x000e0000000 0x02000000
0x0120006f0 0x000f0080000 0x00080000
0x0120806f0 0x000f0400000 0x00400000
0x0124806f0 0x000f0800000 0x00004000
0x0124846f0 0x000ffff0000 0x00010000

Upclicker's First Run

The first time we ran Upclicker in Cuckoo, the results were as expected - no one was there to click the mouse's left button during analysis. Thus there were no dropped files, no mutexes, no modified or created registry values, and it only recorded two API calls from the single Upclicker process:

SetWindowsHookExA is the last API called, because that's when it enters the "waiting" state. As you can see, the HookIdentifier is 14 (0xE) for WH_MOUSE_LL. The ModuleAddress (PE containing the hook procedure) is located at 0x400000. This is a typical ImageBase for the process' executable. The ProcedureAddress (hook function) is at RVA 0x10b0 from the containing PE and the ThreadId was 0 indicating the hook should be applied to all threads in the desktop.

Should you need to validate the API monitor logs, or just analyze the artifacts from a forensic perspective, all of the information should be available in the full memory dump that Cuckoo acquired. To do this, we'll use the messagehooks Volatility plugin:

$ ./vol.py -f ~/cuckoo/storage/analyses/6/memory.dmp messagehooks --output=block
Volatile Systems Volatility Framework 2.3_alpha
Offset(V)  : 0xbc64d220
Session    : 0
Desktop    : WinSta0\Default
Thread     : <any>
Filter     : WH_MOUSE_LL
Flags      : HF_ANSI, HF_GLOBAL
Procedure  : 0x10b0
ihmod      : 1
Module     : C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d

Offset(V)  : 0xbc64d220
Session    : 0
Desktop    : WinSta0\Default
Thread     : 892 (python.exe 1032)
Filter     : WH_MOUSE_LL
Flags      : HF_ANSI, HF_GLOBAL
Procedure  : 0x10b0
ihmod      : 1
Module     : C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d

Offset(V)  : 0xbc64d220
Session    : 0
Desktop    : WinSta0\Default
Thread     : 1968 (explorer.exe 1632)
Filter     : WH_MOUSE_LL
Flags      : HF_ANSI, HF_GLOBAL
Procedure  : 0x10b0
ihmod      : 1
Module     : C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d

Offset(V)  : 0xbc64d220
Session    : 0
Desktop    : WinSta0\Default
Thread     : 956 (explorer.exe 1632)
Filter     : WH_MOUSE_LL
Flags      : HF_ANSI, HF_GLOBAL
Procedure  : 0x10b0
ihmod      : 1
Module     : C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d

[snip]

There you see the proof of Upclicker's hooks as extracted from physical memory. They are HF_GLOBAL hooks (the result of ThreadId = 0) and they filter WH_MOUSE_LL. The hook procedure is at RVA 0x10b0 of the module which is located on disk at C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d. This is the binary submitted to Cuckoo - which the sandbox extracts to a temporary directory before executing.

Patching Cuckoo Sandbox

Cuckoo 0.5 is the first version of the framework that I've downloaded and installed. And its been out less than 12 hours, so admittedly I haven't explored much of the code. I did manage to find the analyzer/windows/modules/packages/exe.py file which contains the package for handling executable PEs submitted to the sandbox. I modified the Exe class's start() method such that it sleeps a few seconds after executing the Upclicker process (to allow the SetWindowsHookExA API to finish), then it uses mouse_event to send a MOUSEEVENTF_LEFTUP signal (the left mouse button is up). This should trigger the malware's trap for user interactions and force it to follow through and infect the system.

p = Process()
if not p.execute(path=path, args=args, suspended=suspended):
    raise CuckooPackageError("Unable to execute initial process, analysis aborted")

ret = None

if not free and suspended:
    p.inject()
    p.resume()
    ret = p.pid

## just a proof-of-concept, do not actually place 
## code here 
import ctypes, time

time.sleep(5)
ctypes.windll.USER32.mouse_event(4, # MOUSEEVENTF_LEFTUP
                                 0, # X 
                                 0, # Y
                                 0, # no flags
                                 None) # no extra info 

return ret

As mentioned in the comment, the Exe package's start() method is undoubtedly the wrong place to put code like this, unless you want it to send a mouse event for all your submissions. But, until I've spent more time getting familiar with the source layout, it'll have to do ;-)

For another example of patching Cuckoo, see Alberto Ortega's Hardening Cuckoo Sandbox against VM aware malware.

Upclicker's Second Run

The second time we ran Upclicker in Cuckoo, the results were much different. First, you can see the signatures detected a new Windows executable was created (dropped) by the malware:

The behavior analysis shows the created file(s). First the submitted sample itself (in the temp directory), then the dropped file named MCPUPlayer.exe which is attached to the system32 directory as an alternate data stream. You also can see the names of the new mutex and registry keys. 

The API monitor logs were also expanded to include explorer.exe this time, since Upclicker was allowed to inject code into explorer.

Here's a look at Upclicker actually performing the injection:

Now looking at explorer.exe's API calls, you can see it creates an Internet Explorer instance and then injects more code into the IE process.

Hopping from one process to another with code injection isn't anything new. Zeus did it way back in 2006 (and probably was not the first). Next, we'll explore how that appears in memory.

Unpclicker Drops Poison Ivy

Curiosity killed the cat, or curiosity connected the dots - I can't remember what the real saying is. Using Volatility on the memory dump of the infected VM, you can see IEXPLORE.EXE is pid 1740.

$ ./vol.py -f ~/cuckoo/storage/analyses/10/memory.dmp pslist
Volatile Systems Volatility Framework 2.3_alpha
Offset(V)  Name              PID   PPID   Thds     Hnds  Start                               
---------- -------------- ------ ------ ------ -------- ---------------------- 
0x819cc9c8 System              4      0     54      263                                           
0x817d54a8 smss.exe          536      4      3       19  2012-12-20 03:33:17                      
0x817a1020 csrss.exe         584    536     11      349  2012-12-20 03:33:18                      
0x81799020 winlogon.exe      616    536     18      509  2012-12-20 03:33:19                      
0x8176f020 services.exe      660    616     15      242  2012-12-20 03:33:19                      
[snip]                    
0x81617058 cmd.exe          1116   1632      1       33  2012-12-20 03:35:22                      
0x816c9020 python.exe       1032   1116      1       93  2012-12-21 02:55:00                      
0x815c7910 IEXPLORE.EXE     1740   1632      3       76  2012-12-21 04:14:13  

If there's injected code, we should be able to find it pretty easily. In fact, the malfind plugin located 20+ suspicious segments of memory - each which contain what looks like the beginning of a function.

$ ./vol.py -f ~/Desktop/cuckoo/storage/analyses/10/memory.dmp malfind -p 1740
Volatile Systems Volatility Framework 2.3_alpha
Process: IEXPLORE.EXE Pid: 1740 Address: 0xa70000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00a70000  55 8b ec 50 b8 10 00 00 00 81 c4 04 f0 ff ff 50   U..P...........P
0x00a70010  48 75 f6 8b 45 fc 81 c4 48 fe ff ff 53 56 57 8b   Hu..E...H...SVW.
0x00a70020  45 08 89 45 bc 8b 45 bc 8b 80 b4 08 00 00 8b f8   E..E..E.........
0x00a70030  8b 40 34 89 45 b8 8b 45 b8 8b 80 24 03 00 00 89   .@4.E..E...$....

0xa70000 55               PUSH EBP
0xa70001 8bec             MOV EBP, ESP
0xa70003 50               PUSH EAX
0xa70004 b810000000       MOV EAX, 0x10
0xa70009 81c404f0ffff     ADD ESP, 0xfffff004
0xa7000f 50               PUSH EAX
0xa70010 48               DEC EAX
0xa70011 75f6             JNZ 0xa70009
0xa70013 8b45fc           MOV EAX, [EBP+0xfffffffc]
0xa70016 81c448feffff     ADD ESP, 0xfffffe48
0xa7001c 53               PUSH EBX
0xa7001d 56               PUSH ESI
0xa7001e 57               PUSH EDI
0xa7001f 8b4508           MOV EAX, [EBP+0x8]
0xa70022 8945bc           MOV [EBP+0xffffffbc], EAX
0xa70025 8b45bc           MOV EAX, [EBP+0xffffffbc]
0xa70028 8b80b4080000     MOV EAX, [EAX+0x8b4]
0xa7002e 8bf8             MOV EDI, EAX
0xa70030 8b4034           MOV EAX, [EAX+0x34]
0xa70033 8945b8           MOV [EBP+0xffffffb8], EAX
0xa70036 8b45b8           MOV EAX, [EBP+0xffffffb8]
0xa70039 8b8024030000     MOV EAX, [EAX+0x324]
0xa7003f 89               DB 0x89

Process: IEXPLORE.EXE Pid: 1740 Address: 0xa30000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 2, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00a30000  55 8b ec 50 b8 10 00 00 00 81 c4 04 f0 ff ff 50   U..P...........P
0x00a30010  48 75 f6 8b 45 fc 83 c4 b8 53 56 57 8b 75 08 33   Hu..E....SVW.u.3
0x00a30020  c0 89 86 b9 08 00 00 33 c0 89 45 e4 68 4d 4b 58   .......3..E.hMKX
0x00a30030  5a 8b 86 db 0a 00 00 50 8b 86 e1 00 00 00 50 ff   Z......P......P.

0xa30000 55               PUSH EBP
0xa30001 8bec             MOV EBP, ESP
0xa30003 50               PUSH EAX
0xa30004 b810000000       MOV EAX, 0x10
0xa30009 81c404f0ffff     ADD ESP, 0xfffff004
0xa3000f 50               PUSH EAX
0xa30010 48               DEC EAX
0xa30011 75f6             JNZ 0xa30009
0xa30013 8b45fc           MOV EAX, [EBP+0xfffffffc]
0xa30016 83c4b8           ADD ESP, -0x48
0xa30019 53               PUSH EBX
0xa3001a 56               PUSH ESI
0xa3001b 57               PUSH EDI
0xa3001c 8b7508           MOV ESI, [EBP+0x8]
0xa3001f 33c0             XOR EAX, EAX
0xa30021 8986b9080000     MOV [ESI+0x8b9], EAX
0xa30027 33c0             XOR EAX, EAX
0xa30029 8945e4           MOV [EBP+0xffffffe4], EAX
0xa3002c 684d4b585a       PUSH DWORD 0x5a584b4d
0xa30031 8b86db0a0000     MOV EAX, [ESI+0xadb]
0xa30037 50               PUSH EAX
0xa30038 8b86e1000000     MOV EAX, [ESI+0xe1]
0xa3003e 50               PUSH EAX
0xa3003f ff               DB 0xff

Process: IEXPLORE.EXE Pid: 1740 Address: 0x160000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00160000  00 11 42 ab 71 07 4a ab 71 2b 3e ab 71 27 4c ab   ..B.q.J.q+>.q'L.
0x00160010  71 6f 67 ab 71 53 2e ab 71 e1 2e ab 71 55 53 ab   qog.qS..q...qUS.
0x00160020  71 e1 9a 80 7c 74 9b 80 7c c7 06 81 7c 6b 23 80   q...|t..|...|k#.
0x00160030  7c 17 6c dd 77 42 78 dd 77 ab 7a dd 77 d7 ea dd   |.l.wBx.w.z.w...

0x160000 0011             ADD [ECX], DL
0x160002 42               INC EDX
0x160003 ab               STOSD
0x160004 7107             JNO 0x16000d
0x160006 4a               DEC EDX
0x160007 ab               STOSD
0x160008 712b             JNO 0x160035
0x16000a 3eab             STOSD
0x16000c 7127             JNO 0x160035
0x16000e 4c               DEC ESP
0x16000f ab               STOSD
0x160010 716f             JNO 0x160081
0x160012 67ab             STOS [ES:DI], EAX
0x160014 7153             JNO 0x160069
0x160016 2eab             STOSD
0x160018 71e1             JNO 0x15fffb
0x16001a 2eab             STOSD
0x16001c 7155             JNO 0x160073
0x16001e 53               PUSH EBX
0x16001f ab               STOSD
0x160020 71e1             JNO 0x160003
0x160022 9a807c749b807c   CALL FAR 0x7c80:0x9b747c80
0x160029 c706817c6b23     MOV DWORD [ESI], 0x236b7c81
0x16002f 807c176cdd       CMP BYTE [EDI+EDX+0x6c], 0xdd
0x160034 7742             JA 0x160078
0x160036 78dd             JS 0x160015
0x160038 77ab             JA 0x15ffe5
0x16003a 7add             JP 0x160019
0x16003c 77d7             JA 0x160015
0x16003e ea               DB 0xea
0x16003f dd               DB 0xdd

Process: IEXPLORE.EXE Pid: 1740 Address: 0x150000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00150000  55 8b ec 81 c4 30 fa ff ff 8b 75 08 8d 86 fb 03   U....0....u.....
0x00150010  00 00 50 6a 00 6a 00 ff 96 85 00 00 00 89 86 c5   ..Pj.j..........
0x00150020  08 00 00 ff 96 89 00 00 00 3d b7 00 00 00 75 04   .........=....u.
0x00150030  c9 c2 04 00 56 8d 86 6b 09 00 00 50 8d 86 45 01   ....V..k...P..E.

0x150000 55               PUSH EBP
0x150001 8bec             MOV EBP, ESP
0x150003 81c430faffff     ADD ESP, 0xfffffa30
0x150009 8b7508           MOV ESI, [EBP+0x8]
0x15000c 8d86fb030000     LEA EAX, [ESI+0x3fb]
0x150012 50               PUSH EAX
0x150013 6a00             PUSH 0x0
0x150015 6a00             PUSH 0x0
0x150017 ff9685000000     CALL DWORD [ESI+0x85]
0x15001d 8986c5080000     MOV [ESI+0x8c5], EAX
0x150023 ff9689000000     CALL DWORD [ESI+0x89]
0x150029 3db7000000       CMP EAX, 0xb7
0x15002e 7504             JNZ 0x150034
0x150030 c9               LEAVE
0x150031 c20400           RET 0x4
0x150034 56               PUSH ESI
0x150035 8d866b090000     LEA EAX, [ESI+0x96b]
0x15003b 50               PUSH EAX
0x15003c 8d               DB 0x8d
0x15003d 864501           XCHG [EBP+0x1], AL

Process: IEXPLORE.EXE Pid: 1740 Address: 0xa50000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00a50000  00 00 00 00 00 00 00 00 00 00 c5 00 00 00 cc 00   ................
0x00a50010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00a50020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00a50030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0xa50000 0000             ADD [EAX], AL
0xa50002 0000             ADD [EAX], AL
0xa50004 0000             ADD [EAX], AL
0xa50006 0000             ADD [EAX], AL
0xa50008 0000             ADD [EAX], AL
0xa5000a c500             LDS EAX, [EAX]
0xa5000c 0000             ADD [EAX], AL
0xa5000e cc               INT 3
0xa5000f 0000             ADD [EAX], AL
0xa50011 0000             ADD [EAX], AL
0xa50013 0000             ADD [EAX], AL
0xa50015 0000             ADD [EAX], AL
0xa50017 0000             ADD [EAX], AL
0xa50019 0000             ADD [EAX], AL
0xa5001b 0000             ADD [EAX], AL
0xa5001d 0000             ADD [EAX], AL
0xa5001f 0000             ADD [EAX], AL
0xa50021 0000             ADD [EAX], AL
0xa50023 0000             ADD [EAX], AL
0xa50025 0000             ADD [EAX], AL
0xa50027 0000             ADD [EAX], AL
0xa50029 0000             ADD [EAX], AL
0xa5002b 0000             ADD [EAX], AL
0xa5002d 0000             ADD [EAX], AL
0xa5002f 0000             ADD [EAX], AL
0xa50031 0000             ADD [EAX], AL
0xa50033 0000             ADD [EAX], AL
0xa50035 0000             ADD [EAX], AL
0xa50037 0000             ADD [EAX], AL
0xa50039 0000             ADD [EAX], AL
0xa5003b 0000             ADD [EAX], AL
0xa5003d 0000             ADD [EAX], AL
0xa5003f 00               DB 0x0

Process: IEXPLORE.EXE Pid: 1740 Address: 0xa40000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00a40000  e8 00 00 00 60 38 1c 00 ff ff ff ff 00 00 00 00   ....`8..........
0x00a40010  00 00 00 00 00 00 00 00 00 00 00 00 d0 3f 1c 00   .............?..
0x00a40020  ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00a40030  00 00 00 00 00 00 a5 00 00 00 00 00 01 00 00 00   ................

0xa40000 e800000060       CALL 0x60a40005
0xa40005 381c00           CMP [EAX+EAX], BL
0xa40008 ff               DB 0xff
0xa40009 ff               DB 0xff
0xa4000a ff               DB 0xff
0xa4000b ff00             INC DWORD [EAX]
0xa4000d 0000             ADD [EAX], AL
0xa4000f 0000             ADD [EAX], AL
0xa40011 0000             ADD [EAX], AL
0xa40013 0000             ADD [EAX], AL
0xa40015 0000             ADD [EAX], AL
0xa40017 0000             ADD [EAX], AL
0xa40019 0000             ADD [EAX], AL
0xa4001b 00d0             ADD AL, DL
0xa4001d 3f               AAS
0xa4001e 1c00             SBB AL, 0x0
0xa40020 ff               DB 0xff
0xa40021 ff               DB 0xff
0xa40022 ff               DB 0xff
0xa40023 ff00             INC DWORD [EAX]
0xa40025 0000             ADD [EAX], AL
0xa40027 0000             ADD [EAX], AL
0xa40029 0000             ADD [EAX], AL
0xa4002b 0000             ADD [EAX], AL
0xa4002d 0000             ADD [EAX], AL
0xa4002f 0000             ADD [EAX], AL
0xa40031 0000             ADD [EAX], AL
0xa40033 0000             ADD [EAX], AL
0xa40035 00a500000000     ADD [EBP+0x0], AH
0xa4003b 0001             ADD [ECX], AL
0xa4003d 0000             ADD [EAX], AL
0xa4003f 00               DB 0x0

Process: IEXPLORE.EXE Pid: 1740 Address: 0xa60000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00a60000  55 8b ec 83 c4 c8 53 56 57 8b 5d 08 8b 73 08 33   U.....SVW.]..s.3
0x00a60010  c0 89 45 f0 c6 45 e3 00 80 be b8 08 00 00 00 0f   ..E..E..........
0x00a60020  84 b2 00 00 00 c6 86 b8 08 00 00 00 8b 86 b4 08   ................
0x00a60030  00 00 33 d2 89 50 38 6a 01 8b 03 03 45 f0 50 8d   ..3..P8j....E.P.

0xa60000 55               PUSH EBP
0xa60001 8bec             MOV EBP, ESP
0xa60003 83c4c8           ADD ESP, -0x38
0xa60006 53               PUSH EBX
0xa60007 56               PUSH ESI
0xa60008 57               PUSH EDI
0xa60009 8b5d08           MOV EBX, [EBP+0x8]
0xa6000c 8b7308           MOV ESI, [EBX+0x8]
0xa6000f 33c0             XOR EAX, EAX
0xa60011 8945f0           MOV [EBP+0xfffffff0], EAX
0xa60014 c645e300         MOV BYTE [EBP+0xffffffe3], 0x0
0xa60018 80beb808000000   CMP BYTE [ESI+0x8b8], 0x0
0xa6001f 0f84b2000000     JZ 0xa600d7
0xa60025 c686b808000000   MOV BYTE [ESI+0x8b8], 0x0
0xa6002c 8b86b4080000     MOV EAX, [ESI+0x8b4]
0xa60032 33d2             XOR EDX, EDX
0xa60034 895038           MOV [EAX+0x38], EDX
0xa60037 6a01             PUSH 0x1
0xa60039 8b03             MOV EAX, [EBX]
0xa6003b 0345f0           ADD EAX, [EBP+0xfffffff0]
0xa6003e 50               PUSH EAX
0xa6003f 8d               DB 0x8d

Process: IEXPLORE.EXE Pid: 1740 Address: 0xc50000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00c50000  55 8b ec 83 c4 cc 53 56 57 89 4d dc 89 55 e0 33   U.....SVW.M..U.3
0x00c50010  d2 8b f8 8b 87 b4 08 00 00 8b f0 8b 40 34 89 45   ............@4.E
0x00c50020  cc 8b 45 cc 8b 80 24 03 00 00 89 45 e8 8b 45 cc   ..E...$....E..E.
0x00c50030  8b 40 08 05 b0 01 00 00 89 45 e4 64 ff 35 00 00   .@.......E.d.5..

0xc50000 55               PUSH EBP
0xc50001 8bec             MOV EBP, ESP
0xc50003 83c4cc           ADD ESP, -0x34
0xc50006 53               PUSH EBX
0xc50007 56               PUSH ESI
0xc50008 57               PUSH EDI
0xc50009 894ddc           MOV [EBP+0xffffffdc], ECX
0xc5000c 8955e0           MOV [EBP+0xffffffe0], EDX
0xc5000f 33d2             XOR EDX, EDX
0xc50011 8bf8             MOV EDI, EAX
0xc50013 8b87b4080000     MOV EAX, [EDI+0x8b4]
0xc50019 8bf0             MOV ESI, EAX
0xc5001b 8b4034           MOV EAX, [EAX+0x34]
0xc5001e 8945cc           MOV [EBP+0xffffffcc], EAX
0xc50021 8b45cc           MOV EAX, [EBP+0xffffffcc]
0xc50024 8b8024030000     MOV EAX, [EAX+0x324]
0xc5002a 8945e8           MOV [EBP+0xffffffe8], EAX
0xc5002d 8b45cc           MOV EAX, [EBP+0xffffffcc]
0xc50030 8b4008           MOV EAX, [EAX+0x8]
0xc50033 05b0010000       ADD EAX, 0x1b0
0xc50038 8945e4           MOV [EBP+0xffffffe4], EAX
0xc5003b 64               DB 0x64
0xc5003c ff               DB 0xff
0xc5003d 35               DB 0x35
0xc5003e 0000             ADD [EAX], AL

Process: IEXPLORE.EXE Pid: 1740 Address: 0xc70000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00c70000  53 56 8b c8 8b 99 b4 08 00 00 8b 73 34 8b da 33   SV.........s4..3
0x00c70010  c9 ff 96 d4 01 00 00 33 c0 89 43 04 33 c0 89 43   .......3..C.3..C
0x00c70020  08 5e 5b c3 00 00 00 00 00 00 00 00 00 00 00 00   .^[.............
0x00c70030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0xc70000 53               PUSH EBX
0xc70001 56               PUSH ESI
0xc70002 8bc8             MOV ECX, EAX
0xc70004 8b99b4080000     MOV EBX, [ECX+0x8b4]
0xc7000a 8b7334           MOV ESI, [EBX+0x34]
0xc7000d 8bda             MOV EBX, EDX
0xc7000f 33c9             XOR ECX, ECX
0xc70011 ff96d4010000     CALL DWORD [ESI+0x1d4]
0xc70017 33c0             XOR EAX, EAX
0xc70019 894304           MOV [EBX+0x4], EAX
0xc7001c 33c0             XOR EAX, EAX
0xc7001e 894308           MOV [EBX+0x8], EAX
0xc70021 5e               POP ESI
0xc70022 5b               POP EBX
0xc70023 c3               RET
0xc70024 0000             ADD [EAX], AL
0xc70026 0000             ADD [EAX], AL
0xc70028 0000             ADD [EAX], AL
0xc7002a 0000             ADD [EAX], AL
0xc7002c 0000             ADD [EAX], AL
0xc7002e 0000             ADD [EAX], AL
0xc70030 0000             ADD [EAX], AL
0xc70032 0000             ADD [EAX], AL
0xc70034 0000             ADD [EAX], AL
0xc70036 0000             ADD [EAX], AL
0xc70038 0000             ADD [EAX], AL
0xc7003a 0000             ADD [EAX], AL
0xc7003c 0000             ADD [EAX], AL
0xc7003e 0000             ADD [EAX], AL

Process: IEXPLORE.EXE Pid: 1740 Address: 0xc60000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00c60000  55 8b ec 83 c4 e4 53 56 57 8b 5d 10 8b 45 08 8b   U.....SVW.]..E..
0x00c60010  90 b4 08 00 00 8b 72 34 8b 86 24 03 00 00 89 45   ......r4..$....E
0x00c60020  e8 8b 86 d8 01 00 00 05 e0 00 00 00 89 45 e4 64   .............E.d
0x00c60030  ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0 ff   .5.....E..u..E..

0xc60000 55               PUSH EBP
0xc60001 8bec             MOV EBP, ESP
0xc60003 83c4e4           ADD ESP, -0x1c
0xc60006 53               PUSH EBX
0xc60007 56               PUSH ESI
0xc60008 57               PUSH EDI
0xc60009 8b5d10           MOV EBX, [EBP+0x10]
0xc6000c 8b4508           MOV EAX, [EBP+0x8]
0xc6000f 8b90b4080000     MOV EDX, [EAX+0x8b4]
0xc60015 8b7234           MOV ESI, [EDX+0x34]
0xc60018 8b8624030000     MOV EAX, [ESI+0x324]
0xc6001e 8945e8           MOV [EBP+0xffffffe8], EAX
0xc60021 8b86d8010000     MOV EAX, [ESI+0x1d8]
0xc60027 05e0000000       ADD EAX, 0xe0
0xc6002c 8945e4           MOV [EBP+0xffffffe4], EAX
0xc6002f 64ff3500000000   PUSH DWORD [FS:0x0]
0xc60036 8f45ec           POP DWORD [EBP+0xffffffec]
0xc60039 ff75e8           PUSH DWORD [EBP+0xffffffe8]
0xc6003c 8f45f0           POP DWORD [EBP+0xfffffff0]
0xc6003f ff               DB 0xff

Process: IEXPLORE.EXE Pid: 1740 Address: 0xc90000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00c90000  55 8b ec 51 53 56 57 8b 7d 0c 8b 55 08 8b f2 8b   U..QSVW.}..U....
0x00c90010  86 b4 08 00 00 8b 40 34 8b df 83 7b 08 00 7c 56   ......@4...{..|V
0x00c90020  83 7d 14 00 7c 50 8b 4b 08 03 4d 14 89 4d fc 83   .}..|P.K..M..M..
0x00c90030  7d fc 00 7e 41 8b 4d fc 3b 4b 04 7e 1a 8b 4d fc   }..~A.M.;K.~..M.

0xc90000 55               PUSH EBP
0xc90001 8bec             MOV EBP, ESP
0xc90003 51               PUSH ECX
0xc90004 53               PUSH EBX
0xc90005 56               PUSH ESI
0xc90006 57               PUSH EDI
0xc90007 8b7d0c           MOV EDI, [EBP+0xc]
0xc9000a 8b5508           MOV EDX, [EBP+0x8]
0xc9000d 8bf2             MOV ESI, EDX
0xc9000f 8b86b4080000     MOV EAX, [ESI+0x8b4]
0xc90015 8b4034           MOV EAX, [EAX+0x34]
0xc90018 8bdf             MOV EBX, EDI
0xc9001a 837b0800         CMP DWORD [EBX+0x8], 0x0
0xc9001e 7c56             JL 0xc90076
0xc90020 837d1400         CMP DWORD [EBP+0x14], 0x0
0xc90024 7c50             JL 0xc90076
0xc90026 8b4b08           MOV ECX, [EBX+0x8]
0xc90029 034d14           ADD ECX, [EBP+0x14]
0xc9002c 894dfc           MOV [EBP+0xfffffffc], ECX
0xc9002f 837dfc00         CMP DWORD [EBP+0xfffffffc], 0x0
0xc90033 7e41             JLE 0xc90076
0xc90035 8b4dfc           MOV ECX, [EBP+0xfffffffc]
0xc90038 3b4b04           CMP ECX, [EBX+0x4]
0xc9003b 7e1a             JLE 0xc90057
0xc9003d 8b4dfc           MOV ECX, [EBP+0xfffffffc]

Process: IEXPLORE.EXE Pid: 1740 Address: 0xc80000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00c80000  53 56 8b c8 8b 99 b4 08 00 00 8b 73 34 8b ca 33   SV.........s4..3
0x00c80010  db 89 19 33 db 89 59 04 33 db 89 59 08 33 db 89   ...3..Y.3..Y.3..
0x00c80020  59 0c 33 c9 ff 96 d4 01 00 00 5e 5b c3 00 00 00   Y.3.......^[....
0x00c80030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0xc80000 53               PUSH EBX
0xc80001 56               PUSH ESI
0xc80002 8bc8             MOV ECX, EAX
0xc80004 8b99b4080000     MOV EBX, [ECX+0x8b4]
0xc8000a 8b7334           MOV ESI, [EBX+0x34]
0xc8000d 8bca             MOV ECX, EDX
0xc8000f 33db             XOR EBX, EBX
0xc80011 8919             MOV [ECX], EBX
0xc80013 33db             XOR EBX, EBX
0xc80015 895904           MOV [ECX+0x4], EBX
0xc80018 33db             XOR EBX, EBX
0xc8001a 895908           MOV [ECX+0x8], EBX
0xc8001d 33db             XOR EBX, EBX
0xc8001f 89590c           MOV [ECX+0xc], EBX
0xc80022 33c9             XOR ECX, ECX
0xc80024 ff96d4010000     CALL DWORD [ESI+0x1d4]
0xc8002a 5e               POP ESI
0xc8002b 5b               POP EBX
0xc8002c c3               RET
0xc8002d 0000             ADD [EAX], AL
0xc8002f 0000             ADD [EAX], AL
0xc80031 0000             ADD [EAX], AL
0xc80033 0000             ADD [EAX], AL
0xc80035 0000             ADD [EAX], AL
0xc80037 0000             ADD [EAX], AL
0xc80039 0000             ADD [EAX], AL
0xc8003b 0000             ADD [EAX], AL
0xc8003d 0000             ADD [EAX], AL
0xc8003f 00               DB 0x0

Process: IEXPLORE.EXE Pid: 1740 Address: 0xcb0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00cb0000  53 56 57 55 51 89 0c 24 8b fa 8b f0 8b c6 8b 90   SVWUQ..$........
0x00cb0010  b4 08 00 00 8b 6a 34 8b df 54 57 56 ff 95 d8 01   .....j4..TWV....
0x00cb0020  00 00 89 03 8b 04 24 89 43 0c 5a 5d 5f 5e 5b c3   ......$.C.Z]_^[.
0x00cb0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0xcb0000 53               PUSH EBX
0xcb0001 56               PUSH ESI
0xcb0002 57               PUSH EDI
0xcb0003 55               PUSH EBP
0xcb0004 51               PUSH ECX
0xcb0005 890c24           MOV [ESP], ECX
0xcb0008 8bfa             MOV EDI, EDX
0xcb000a 8bf0             MOV ESI, EAX
0xcb000c 8bc6             MOV EAX, ESI
0xcb000e 8b90b4080000     MOV EDX, [EAX+0x8b4]
0xcb0014 8b6a34           MOV EBP, [EDX+0x34]
0xcb0017 8bdf             MOV EBX, EDI
0xcb0019 54               PUSH ESP
0xcb001a 57               PUSH EDI
0xcb001b 56               PUSH ESI
0xcb001c ff95d8010000     CALL DWORD [EBP+0x1d8]
0xcb0022 8903             MOV [EBX], EAX
0xcb0024 8b0424           MOV EAX, [ESP]
0xcb0027 89430c           MOV [EBX+0xc], EAX
0xcb002a 5a               POP EDX
0xcb002b 5d               POP EBP
0xcb002c 5f               POP EDI
0xcb002d 5e               POP ESI
0xcb002e 5b               POP EBX
0xcb002f c3               RET
0xcb0030 0000             ADD [EAX], AL
0xcb0032 0000             ADD [EAX], AL
0xcb0034 0000             ADD [EAX], AL
0xcb0036 0000             ADD [EAX], AL
0xcb0038 0000             ADD [EAX], AL
0xcb003a 0000             ADD [EAX], AL
0xcb003c 0000             ADD [EAX], AL
0xcb003e 0000             ADD [EAX], AL

Process: IEXPLORE.EXE Pid: 1740 Address: 0xca0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00ca0000  55 8b ec 83 c4 e4 53 56 57 8b 7d 14 8b 55 08 8b   U.....SVW.}..U..
0x00ca0010  82 b4 08 00 00 8b 40 34 8b 88 24 03 00 00 89 4d   ......@4..$....M
0x00ca0020  e8 8b 80 d0 01 00 00 05 88 00 00 00 89 45 e4 64   .............E.d
0x00ca0030  ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0 ff   .5.....E..u..E..

0xca0000 55               PUSH EBP
0xca0001 8bec             MOV EBP, ESP
0xca0003 83c4e4           ADD ESP, -0x1c
0xca0006 53               PUSH EBX
0xca0007 56               PUSH ESI
0xca0008 57               PUSH EDI
0xca0009 8b7d14           MOV EDI, [EBP+0x14]
0xca000c 8b5508           MOV EDX, [EBP+0x8]
0xca000f 8b82b4080000     MOV EAX, [EDX+0x8b4]
0xca0015 8b4034           MOV EAX, [EAX+0x34]
0xca0018 8b8824030000     MOV ECX, [EAX+0x324]
0xca001e 894de8           MOV [EBP+0xffffffe8], ECX
0xca0021 8b80d0010000     MOV EAX, [EAX+0x1d0]
0xca0027 0588000000       ADD EAX, 0x88
0xca002c 8945e4           MOV [EBP+0xffffffe4], EAX
0xca002f 64ff3500000000   PUSH DWORD [FS:0x0]
0xca0036 8f45ec           POP DWORD [EBP+0xffffffec]
0xca0039 ff75e8           PUSH DWORD [EBP+0xffffffe8]
0xca003c 8f45f0           POP DWORD [EBP+0xfffffff0]
0xca003f ff               DB 0xff

Process: IEXPLORE.EXE Pid: 1740 Address: 0xcc0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00cc0000  55 8b ec 81 c4 b0 fe ff ff 53 56 57 8b fa 89 45   U........SVW...E
0x00cc0010  d8 8b 75 d8 8b 86 b4 08 00 00 8b 58 34 8b 83 24   ..u........X4..$
0x00cc0020  03 00 00 89 45 e8 8b 43 0c 05 c9 04 00 00 89 45   ....E..C.......E
0x00cc0030  e4 64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45   .d.5.....E..u..E

0xcc0000 55               PUSH EBP
0xcc0001 8bec             MOV EBP, ESP
0xcc0003 81c4b0feffff     ADD ESP, 0xfffffeb0
0xcc0009 53               PUSH EBX
0xcc000a 56               PUSH ESI
0xcc000b 57               PUSH EDI
0xcc000c 8bfa             MOV EDI, EDX
0xcc000e 8945d8           MOV [EBP+0xffffffd8], EAX
0xcc0011 8b75d8           MOV ESI, [EBP+0xffffffd8]
0xcc0014 8b86b4080000     MOV EAX, [ESI+0x8b4]
0xcc001a 8b5834           MOV EBX, [EAX+0x34]
0xcc001d 8b8324030000     MOV EAX, [EBX+0x324]
0xcc0023 8945e8           MOV [EBP+0xffffffe8], EAX
0xcc0026 8b430c           MOV EAX, [EBX+0xc]
0xcc0029 05c9040000       ADD EAX, 0x4c9
0xcc002e 8945e4           MOV [EBP+0xffffffe4], EAX
0xcc0031 64ff3500000000   PUSH DWORD [FS:0x0]
0xcc0038 8f45ec           POP DWORD [EBP+0xffffffec]
0xcc003b ff75e8           PUSH DWORD [EBP+0xffffffe8]
0xcc003e 8f               DB 0x8f
0xcc003f 45               INC EBP

Process: IEXPLORE.EXE Pid: 1740 Address: 0xcd0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00cd0000  55 8b ec 83 c4 80 53 56 57 89 4d d8 89 55 dc 89   U.....SVW.M..U..
0x00cd0010  45 e0 8b 5d 08 8b 45 e0 89 45 c0 8b 45 c0 8b 80   E..]..E..E..E...
0x00cd0020  b4 08 00 00 89 45 bc 8b 70 34 8b 86 24 03 00 00   .....E..p4..$...
0x00cd0030  89 45 e8 8b 46 58 05 6e 03 00 00 89 45 e4 64 ff   .E..FX.n....E.d.

0xcd0000 55               PUSH EBP
0xcd0001 8bec             MOV EBP, ESP
0xcd0003 83c480           ADD ESP, -0x80
0xcd0006 53               PUSH EBX
0xcd0007 56               PUSH ESI
0xcd0008 57               PUSH EDI
0xcd0009 894dd8           MOV [EBP+0xffffffd8], ECX
0xcd000c 8955dc           MOV [EBP+0xffffffdc], EDX
0xcd000f 8945e0           MOV [EBP+0xffffffe0], EAX
0xcd0012 8b5d08           MOV EBX, [EBP+0x8]
0xcd0015 8b45e0           MOV EAX, [EBP+0xffffffe0]
0xcd0018 8945c0           MOV [EBP+0xffffffc0], EAX
0xcd001b 8b45c0           MOV EAX, [EBP+0xffffffc0]
0xcd001e 8b80b4080000     MOV EAX, [EAX+0x8b4]
0xcd0024 8945bc           MOV [EBP+0xffffffbc], EAX
0xcd0027 8b7034           MOV ESI, [EAX+0x34]
0xcd002a 8b8624030000     MOV EAX, [ESI+0x324]
0xcd0030 8945e8           MOV [EBP+0xffffffe8], EAX
0xcd0033 8b4658           MOV EAX, [ESI+0x58]
0xcd0036 056e030000       ADD EAX, 0x36e
0xcd003b 8945e4           MOV [EBP+0xffffffe4], EAX
0xcd003e 64               DB 0x64
0xcd003f ff               DB 0xff

Process: IEXPLORE.EXE Pid: 1740 Address: 0xcf0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00cf0000  55 8b ec 83 c4 a4 53 56 57 89 55 dc 89 45 e0 8b   U.....SVW.U..E..
0x00cf0010  45 e0 8b 90 b4 08 00 00 8b 5a 34 8b 83 24 03 00   E........Z4..$..
0x00cf0020  00 89 45 e8 8b 83 54 04 00 00 05 41 01 00 00 89   ..E...T....A....
0x00cf0030  45 e4 64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f   E.d.5.....E..u..

0xcf0000 55               PUSH EBP
0xcf0001 8bec             MOV EBP, ESP
0xcf0003 83c4a4           ADD ESP, -0x5c
0xcf0006 53               PUSH EBX
0xcf0007 56               PUSH ESI
0xcf0008 57               PUSH EDI
0xcf0009 8955dc           MOV [EBP+0xffffffdc], EDX
0xcf000c 8945e0           MOV [EBP+0xffffffe0], EAX
0xcf000f 8b45e0           MOV EAX, [EBP+0xffffffe0]
0xcf0012 8b90b4080000     MOV EDX, [EAX+0x8b4]
0xcf0018 8b5a34           MOV EBX, [EDX+0x34]
0xcf001b 8b8324030000     MOV EAX, [EBX+0x324]
0xcf0021 8945e8           MOV [EBP+0xffffffe8], EAX
0xcf0024 8b8354040000     MOV EAX, [EBX+0x454]
0xcf002a 0541010000       ADD EAX, 0x141
0xcf002f 8945e4           MOV [EBP+0xffffffe4], EAX
0xcf0032 64ff3500000000   PUSH DWORD [FS:0x0]
0xcf0039 8f45ec           POP DWORD [EBP+0xffffffec]
0xcf003c ff75e8           PUSH DWORD [EBP+0xffffffe8]
0xcf003f 8f               DB 0x8f

Process: IEXPLORE.EXE Pid: 1740 Address: 0xd00000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00d00000  53 56 57 55 51 8b e9 8b fa 8b f0 8b c6 8b 90 b4   SVWUQ...........
0x00d00010  08 00 00 8b 5a 34 55 ff 53 70 88 04 24 6a 01 8d   ....Z4U.Sp..$j..
0x00d00020  44 24 04 50 57 56 ff 93 cc 01 00 00 33 c0 8a 04   D$.PWV......3...
0x00d00030  24 50 55 57 56 ff 93 cc 01 00 00 5a 5d 5f 5e 5b   $PUWV......Z]_^[

0xd00000 53               PUSH EBX
0xd00001 56               PUSH ESI
0xd00002 57               PUSH EDI
0xd00003 55               PUSH EBP
0xd00004 51               PUSH ECX
0xd00005 8be9             MOV EBP, ECX
0xd00007 8bfa             MOV EDI, EDX
0xd00009 8bf0             MOV ESI, EAX
0xd0000b 8bc6             MOV EAX, ESI
0xd0000d 8b90b4080000     MOV EDX, [EAX+0x8b4]
0xd00013 8b5a34           MOV EBX, [EDX+0x34]
0xd00016 55               PUSH EBP
0xd00017 ff5370           CALL DWORD [EBX+0x70]
0xd0001a 880424           MOV [ESP], AL
0xd0001d 6a01             PUSH 0x1
0xd0001f 8d442404         LEA EAX, [ESP+0x4]
0xd00023 50               PUSH EAX
0xd00024 57               PUSH EDI
0xd00025 56               PUSH ESI
0xd00026 ff93cc010000     CALL DWORD [EBX+0x1cc]
0xd0002c 33c0             XOR EAX, EAX
0xd0002e 8a0424           MOV AL, [ESP]
0xd00031 50               PUSH EAX
0xd00032 55               PUSH EBP
0xd00033 57               PUSH EDI
0xd00034 56               PUSH ESI
0xd00035 ff93cc010000     CALL DWORD [EBX+0x1cc]
0xd0003b 5a               POP EDX
0xd0003c 5d               POP EBP
0xd0003d 5f               POP EDI
0xd0003e 5e               POP ESI
0xd0003f 5b               POP EBX

Process: IEXPLORE.EXE Pid: 1740 Address: 0xd10000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00d10000  55 8b ec 8b 55 10 8b 45 0c 8b 48 08 89 8a b8 00   U...U..E..H.....
0x00d10010  00 00 8b 48 0c 89 8a c4 00 00 00 8b 40 10 89 82   ...H........@...
0x00d10020  b4 00 00 00 33 c0 5d c2 10 00 8b c0 55 8b ec 83   ....3.].....U...
0x00d10030  c4 e4 53 56 57 8b 5d 10 8b 45 08 8b 90 b4 08 00   ..SVW.]..E......

0xd10000 55               PUSH EBP
0xd10001 8bec             MOV EBP, ESP
0xd10003 8b5510           MOV EDX, [EBP+0x10]
0xd10006 8b450c           MOV EAX, [EBP+0xc]
0xd10009 8b4808           MOV ECX, [EAX+0x8]
0xd1000c 898ab8000000     MOV [EDX+0xb8], ECX
0xd10012 8b480c           MOV ECX, [EAX+0xc]
0xd10015 898ac4000000     MOV [EDX+0xc4], ECX
0xd1001b 8b4010           MOV EAX, [EAX+0x10]
0xd1001e 8982b4000000     MOV [EDX+0xb4], EAX
0xd10024 33c0             XOR EAX, EAX
0xd10026 5d               POP EBP
0xd10027 c21000           RET 0x10
0xd1002a 8bc0             MOV EAX, EAX
0xd1002c 55               PUSH EBP
0xd1002d 8bec             MOV EBP, ESP
0xd1002f 83c4e4           ADD ESP, -0x1c
0xd10032 53               PUSH EBX
0xd10033 56               PUSH ESI
0xd10034 57               PUSH EDI
0xd10035 8b5d10           MOV EBX, [EBP+0x10]
0xd10038 8b4508           MOV EAX, [EBP+0x8]
0xd1003b 8b               DB 0x8b
0xd1003c 90               NOP
0xd1003d b408             MOV AH, 0x8
0xd1003f 00               DB 0x0

Process: IEXPLORE.EXE Pid: 1740 Address: 0xd20000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00d20000  55 8b ec 83 c4 d0 53 56 57 be 39 05 00 00 8b c6   U.....SVW.9.....
0x00d20010  8b 90 b4 08 00 00 8b 5a 34 8b 83 24 03 00 00 89   .......Z4..$....
0x00d20020  45 e8 8b 83 ec 03 00 00 05 cd 00 00 00 89 45 e4   E.............E.
0x00d20030  64 ff 35 00 00 00 00 8f 45 ec ff 75 e8 8f 45 f0   d.5.....E..u..E.

0xd20000 55               PUSH EBP
0xd20001 8bec             MOV EBP, ESP
0xd20003 83c4d0           ADD ESP, -0x30
0xd20006 53               PUSH EBX
0xd20007 56               PUSH ESI
0xd20008 57               PUSH EDI
0xd20009 be39050000       MOV ESI, 0x539
0xd2000e 8bc6             MOV EAX, ESI
0xd20010 8b90b4080000     MOV EDX, [EAX+0x8b4]
0xd20016 8b5a34           MOV EBX, [EDX+0x34]
0xd20019 8b8324030000     MOV EAX, [EBX+0x324]
0xd2001f 8945e8           MOV [EBP+0xffffffe8], EAX
0xd20022 8b83ec030000     MOV EAX, [EBX+0x3ec]
0xd20028 05cd000000       ADD EAX, 0xcd
0xd2002d 8945e4           MOV [EBP+0xffffffe4], EAX
0xd20030 64ff3500000000   PUSH DWORD [FS:0x0]
0xd20037 8f45ec           POP DWORD [EBP+0xffffffec]
0xd2003a ff75e8           PUSH DWORD [EBP+0xffffffe8]
0xd2003d 8f45f0           POP DWORD [EBP+0xfffffff0]

Process: IEXPLORE.EXE Pid: 1740 Address: 0xd30000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00d30000  55 8b ec 81 c4 d0 fe ff ff 53 56 57 89 55 e0 8b   U........SVW.U..
0x00d30010  d8 8b f3 8b 86 b4 08 00 00 89 45 d8 8b 78 34 8b   ..........E..x4.
0x00d30020  87 24 03 00 00 89 45 e8 8b 87 e8 03 00 00 05 13   .$....E.........
0x00d30030  01 00 00 89 45 e4 64 ff 35 00 00 00 00 8f 45 ec   ....E.d.5.....E.

0xd30000 55               PUSH EBP
0xd30001 8bec             MOV EBP, ESP
0xd30003 81c4d0feffff     ADD ESP, 0xfffffed0
0xd30009 53               PUSH EBX
0xd3000a 56               PUSH ESI
0xd3000b 57               PUSH EDI
0xd3000c 8955e0           MOV [EBP+0xffffffe0], EDX
0xd3000f 8bd8             MOV EBX, EAX
0xd30011 8bf3             MOV ESI, EBX
0xd30013 8b86b4080000     MOV EAX, [ESI+0x8b4]
0xd30019 8945d8           MOV [EBP+0xffffffd8], EAX
0xd3001c 8b7834           MOV EDI, [EAX+0x34]
0xd3001f 8b8724030000     MOV EAX, [EDI+0x324]
0xd30025 8945e8           MOV [EBP+0xffffffe8], EAX
0xd30028 8b87e8030000     MOV EAX, [EDI+0x3e8]
0xd3002e 0513010000       ADD EAX, 0x113
0xd30033 8945e4           MOV [EBP+0xffffffe4], EAX
0xd30036 64ff3500000000   PUSH DWORD [FS:0x0]
0xd3003d 8f45ec           POP DWORD [EBP+0xffffffec]

Process: IEXPLORE.EXE Pid: 1740 Address: 0xe40000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00e40000  00 00 ac 00 08 00 ac 00 02 10 00 00 01 00 ac 00   ................
0x00e40010  05 00 ac 00 01 00 ac 00 00 00 00 00 00 00 00 00   ................
0x00e40020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00e40030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0xe40000 0000             ADD [EAX], AL
0xe40002 ac               LODSB
0xe40003 0008             ADD [EAX], CL
0xe40005 00ac0002100000   ADD [EAX+EAX+0x1002], CH
0xe4000c 0100             ADD [EAX], EAX
0xe4000e ac               LODSB
0xe4000f 000500ac0001     ADD [0x100ac00], AL
0xe40015 00ac0000000000   ADD [EAX+EAX+0x0], CH
0xe4001c 0000             ADD [EAX], AL
0xe4001e 0000             ADD [EAX], AL
0xe40020 0000             ADD [EAX], AL
0xe40022 0000             ADD [EAX], AL
0xe40024 0000             ADD [EAX], AL
0xe40026 0000             ADD [EAX], AL
0xe40028 0000             ADD [EAX], AL
0xe4002a 0000             ADD [EAX], AL
0xe4002c 0000             ADD [EAX], AL
0xe4002e 0000             ADD [EAX], AL
0xe40030 0000             ADD [EAX], AL
0xe40032 0000             ADD [EAX], AL
0xe40034 0000             ADD [EAX], AL
0xe40036 0000             ADD [EAX], AL
0xe40038 0000             ADD [EAX], AL
0xe4003a 0000             ADD [EAX], AL
0xe4003c 0000             ADD [EAX], AL
0xe4003e 0000             ADD [EAX], AL

Hmm, interesting...Upclicker uses the same fragmented code injected model as Poison Ivy. Doh, wait, this is Poison Ivy!

$ ./vol.py -f ~/cuckoo/storage/analyses/10/memory.dmp poisonivyconfig -p 1740
Volatile Systems Volatility Framework 2.3_alpha
------------------------------------------------------------
Process: IEXPLORE.EXE (1740)

Infection:
PoisonIvy has ADMIN privileges!
Version: 231
Base VA: 0x00150000
Extra VA: 0x00c20000
Data VA: 0x00160000
Mutex: nrnr999rn
Original file: C:\DOCUME~1\cooks\LOCALS~1\Temp\ce69dee5307d58db4e2a6fdbcbf87e9d
Melt original file: ON

Command and Control:
Host 01: sendmsg.jumpingcrab.com:443 (direct)
Host 02: sendmsg.jumpingcrab.com:80 (direct)
Password: menuPass
Id: 10.8sendmsg.jumpingcrab.com
Group: 

Keylogger:
Keylogger: off

Copy file:
Copy routine: 0x01130000
Destination: %WINDIR%\System32:MCPUPlayer.exe

Persistence:
Active Setup: off
HKLM Run: ON
HKLM Run name: AdobeCro CPUPlayer
Setup routine: 0x00c10000

Injector:
Inject into other processes: ON
Persistently: ON
Injector TID: 0
Injector Routine: 0x00000000
Target process name: 
Target default browser: ON

Based on the VirusTotal results supplied with Cuckoo's analysis, only Trend Micro identified the Upclicker sample as Poison Ivy (BKDR_POISON.BNE). The other 44 engines either failed to detect anything (22/45 ratio) or identified it as a generic backdoor.

Conclusion

Now that you've reached the end, you know that Trojan Upclicker is a wrapper/packer that in this case transmitted Poison Ivy as its payload. Cuckoo Sandbox can be easily modified to fit your analysis needs, even if you're a first time user. Starting with 0.5, it can be configured to acquire full memory dumps - thus it gets along quite nicely with Volatility's new VirtualBoxAddressSpace for those who wish to go deep diving in memory after an infection. You've also seen some recent malware leveraging the GUI subsystem to further its malicious intentions, which is always exciting.