Advanced malware analysis training session11 part2 dissecting the heart beat rat functionalities
- 2. Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working. However in no circumstances neither the Trainer nor Cysinfo is responsible for any damage or loss caused due to use or misuse of the information presented here.
- 3. Acknowledgement Special thanks to Null community for their extended support and co-operation. Special thanks to ThoughtWorks for the beautiful venue. Thanks to all the trainers who have devoted their precious time and countless hours to make it happen.
- 4. Advanced Malware Analysis Training This presentation is part of our Advanced Malware Analysis Training program. Currently it is delivered only during our local meets for FREE of cost. .
- 5. Who am I Monnappa K A Member of Cysinfo Info Security Investigator @ Cisco Reverse Engineering, Malware Analysis, Memory Forensics Email: [email protected] Blog: http://malware-unplugged.blogspot.in Twitter: @monnappa22 LinkedIn: http://www.linkedin.com/pub/monnappa-ka-grem-ceh/42/45a/1b8
- 6. HeartBeat RAT Functionalities Part 2A - Demo Part 2B - Demo Part 2C – Demo Part 2D – Demo Part 2E– Demo Part 2F– Demo Part 2G - Demo References
- 7. In this session, we will cover below HeartBeat RAT functionalities o Part 2a) Decrypting various communications o Part 2b) Functionality 1 - Process enumeration o Part 2c) Functionality 2 - Process termination o Part 2d) Functionality 3 - Create and Write to File o Part 2e) Functionality 4 - Launch new application (create process) o Part 2f) Functionality 5 - Reverse Shell o Part 2g) Functionality 6 - Restart System
- 9. Below screenshot shows the encrypted process listing sent to the C2 server
- 10. Below screenshot shows the decrypted process listing
- 11. Below screenshot shows the encrypted reverse shell sent by the malware
- 12. Below screenshot shows the decrytped reverse shell
- 14. Since malware expects atleast 2056 bytes of data, sending more than 2056 bytes of fake data
- 15. Malware received the fake date we sent
- 16. Malware decrypts the received data from 9th byte
- 17. Malware checks if the first four byte is 01 00 00 00, so modifying the first four bytes
- 18. When malware receives the command code 1 (01 00 00 00), its enumerates processes on the system
- 19. Malware encrypts the enumerated processes using the xor encryption algorithm
- 20. Malware sends encrypted process listing to the C2 (command and control) server
- 22. Malware checks if the first four byte is 02 00 00 00, so modifying the first four bytes
- 23. Malware interprets 9th byte as process id and terminates the process with that process id. Lets give malware the process id of calc.exe
- 24. Malware opens handle to the calc.exe pid 1968
- 25. Terminates calc.exe process Malware terminates the process by calling “TerminateProcess” API call
- 26. Malware Sends Encrypted Status Code After terminating the process, malware encrypts the process termination status code and sends it to C2
- 28. Malware checks if the first four byte is 03 00 00 00, so modifying the first four bytes
- 29. Malware Creates File Malware reads the data starting from the 9th byte It interprets this as the file name and creates a file
- 30. Malware Writes Encrypted Data Malware receives data from C2, encrypts it and writes the encrypted data to the file.
- 32. Malware checks if the first four byte is 04 00 00 00, so modifying the first four bytes
- 33. Malware Launches Application Malware reads bytes starting from the 9th byte and interprets this as the path to the application to launch.
- 34. Sends Encrypted Status Code After launching the new application, malware encrypts the application launch status code and sends it to C2
- 36. Malware Checks for Command Code 5 Malware checks if the first four byte is 05 00 00 00, so modifying the first four bytes
- 37. Malware launches cmd.exe Malware creates cmd.exe process
- 38. Malware creates Reverse Shell Malware creates Reverse Shell
- 39. Sends Encrypted Reverse Shell Malware sends encrypted reverse shell to the C2
- 41. Malware Checks for Command Code 0A Malware checks if the first four byte is 0A 00 00 00, so modifying the first four bytes
- 42. Malware Restarts The System Malware restarts the system
- 43. Thank You !