Automating malware analysis with Node.js, Docker and RabbitMQ

@CapacitorSet

1. Manual reverse engineering
2. VM analysis
3. Emulation

Original code: it's there, but we can't read it

Formatted code

Obfuscation

Equivalent, but unreadable code

Final result

1. listaUrl = [20 URL...]
2. For each element of listaUrl:
1. Do a GET request
2. If the response is not OK (404 not found, unreachable, etc.), go to the next
3. If the response is not an executable, go to the next
4. Save the response to %TEMP%/randomname.exe
5. Execute the file

Accurate understanding
15 minutes to 1 hour
Requires a deep knowledge of JScript

1. Manual reverse engineering
2. VM analysis
3. Emulation

Monitoring

• Intercepting Windows API calls
  • reading the system registry
  • creating new processes
  • ...
• Memory monitoring
• Disk activity monitoring
• Network monitoring (DNS, downloads, etc)

Problems

Malware has measures against automated analysis:

• Make sure not to be in a VM
• Check for monitoring processes

processList = GetObject("WinMgmts:").InstancesOf("Win32_Process")
isVM = false;
for (i = 0; i < processList.length; i++) {
	if (processList[i] == "Wireshark.exe") isVM = true;
	if (processList[i] == "OllyDbg.exe") isVM = true;
	if (processList[i] == "...") isVM = true;
}
if (!isVM) {
	// ...
}

Results

1. Connecting to sito1.com... timeout.
2. Connecting to sito2.it... connected.Con: not every URL is detected!
3. Downloaded http://sito2.it/locky.exe
4. Saved C:\TEMP\locky.exe
5. Executed C:\TEMP\locky.exePro: we also analyse the actual virus
6. locky.exe encrypted the file Desktop\photo.jpg
7. ...

1. Manual reverse engineering
2. VM analysis
3. Emulation

Microsoft JScript is a JavaScript dialect

Any JavaScript engine can run JScript, with modifications

ActiveX libraries

We want to create "fake" libraries, that emulate the real ones and capture informations

Stubs

Fictitious versions (stub) of the ActiveX components we are interested in

They seem to work correctly, but log interactions:

class XMLHTTP {
	download(url) {
		headers["User-Agent"] = "Internet Explorer 6.0";
		print(`New request to ${url}`);
		output = request("GET", url);
		print(`I downloaded ${output.length} byte.`);
		print("File type: " + identify(output));
		return output;
	}
}

AST rewriting

We dissect the code and add new nodes

eval(foobar.decrypt() + "unknown code")

eval(rewrite(foobar.decrypt() + "unknown code"))

1. listaUrl = [20 URL...]
2. For each element of listaUrl:
1. Do a GET request
   Offline analysis
2. If the response is not ok (404 not found, unreachable, etc.) go to the next
3. If the response is not an executable, go to the next
4. Save the response to %TEMP%/randomname.exe
5. Execute the file

Very fast: 5 to 90 seconds
Tiny footprint: ~50 MB RAM
More flexible → more powerful
Easy to debug
Requires patches/bugfixes
Might require human intervention

In practice:

Malware analysis pipeline

We need an isolated, easily-reproducible environment

We useDocker containers: isolated from the host, instanced in a single command:

docker run CapacitorSet/box-js     \ # Image name
    --volume ~/sample.js:/samples/ \ # Shared folders
    --env "QUEUE_IP=172.17.0.1"      # Environment variables

We need to put samples to be analyzed in a sample, and process them with several workers

We create a work queue with RabbitMQ

Easily scalable approach: we can add and remove workers at will

Applications

Typical scenario: malware analysis researcher/company

The user quickly extracts the second stages, either as URLs or as files, and can analyze them with VirusTotal/Malwr/other sandboxes

In short: emulation simplifies and speeds up first-stage analysis, and results in more accurate analyses