Lab 6-4

In this lab, we’ll analyze the Malware found in the file Lab06-04.exe.

1) What is the difference between the calls made from the main method in Labs 6-3 and 6-4?

It’s pretty clear that the difference from Lab06-03 to Lab06-04 is the addition of a Loop:

In this case, is a for loop that will execute 1440 times (0x5A0h). Inside this loop the parse_command and sub_401150 function are executed.

2) What new code construct has been added to main?

The new code construct is a for loop:

for (i=0;i<1440;++i)
{
	...
}

3) What is the difference between this lab’s parse HTML function and those of the previous labs?

The parse_command function in Lab06-04.exe takes a new parameter (ecx - the loop cycle count):

Taking a look at how this parameter is used we can see that from the Bot Master perspective, it is possible to obtain the loop cycle count on the User-Agent (e.g. For cycle 120 the User-Agent would be “Internet Explorer 7.50/pma120”)

4) How long will this program run? (Assume that it is connected to the Internet.)

The Malware may be executing for [ 86400 - 230400 seconds], depending on the commands obtained from http://praticalmalwareanalysis.com/cc.htm (if a sleep command is provided the Malware will sleep for 160 seconds on each cycle).

5) Are there any new network-based indicators for this Malware?

Yes. The User-Agents on this new Malware sample are going to be different from the previous samples as seen in 3).

6) What is the purpose of this Malware?

The Malware purpose keeps being the same. It checks whether or not it has an active connection to the Internet, then retrieves a command from a Web page (hidden in a commentary) and execute. There are 5 different commands as seen in 4):

• Create a Directoy
• Copy a provided file to C:\Temp\cc.exe
• Delete C:\Temp\cc.exe
• Create persistency for said file
• Sleep for 100 seconds

The only big difference in this Malware in terms of functionality is that it waits for multiple commands (with the for loop) and not just one as before.