[PMAT] Malware Analysis: SillyPutty

This challenge covers the concepts related to Basic Static and Dynamic analysis of a malware.

Sample: putty.exe

[embed]PMAT-labs/labs/1-3.Challenge-SillyPutty at main · HuskyHacks/PMAT-labs Labs for Practical Malware Analysis & Triage. Contribute to HuskyHacks/PMAT-labs development by creating an account on…github.com

Basic Static Analysis:

Sample Binary Information

Using PEView we can determine the compilation date, architecture and whether it’s a console or a GUI application. Review IMAGE_FILE_HEADER

32-bit architecture

File Hashes

 SHA256:

  λ sha256sum.exe "C:\Users\vboxuser\Desktop\putty.exe"
  \0c82e654c09c8fd9fdf4899718efa37670974c9eec5a8fc18a167f93cea6ee83 *C:\\Users\\vboxuser\\Desktop\\putty.exe

 MD5:

  λ md5sum.exe "C:\Users\vboxuser\Desktop\putty.exe"
\334a10500feb0f3444bf2e86ab2e76da *C:\\Users\\vboxuser\\Desktop\\putty.exe

Once we have the hash information, we would want to look at whether we have any information on a portal like Virustotal about the hash of the sample.

Sample has been identified as malicious

String Enumeration

Next, we would want to check if the binary reveals any strings which can help us understand how the binary functions.

We can use any tool, either strings\floss or we can also review the strings through PEStudio.

floss -n 5 C:\Users\vboxuser\Desktop\putty.exe > strings.txt

Power shell command found in strings

We come across an interesting powershell call where we can see a encoded base64 string which is later decompressed and decoded.

Either using power shell or Linux CLI we can try and decode the contents.

Obfuscated powershell script

echo "Base64String" | base64 -d > outfile

Above command will provide you with a compressed zip which can be extracted to get the contents of the PS script.

Contents of the obfuscated PS Script reveal that it trying to establish a connection to a remote host(bonus2.corporatebonusapplication.local) on a specific Port(8443).

Binary Imports

Large number of imports are seen in the address table, reviewing these would suggest that the binary can call on other processes, read\write to file system and make network calls. You can use PEStudio\PEView or even strings found to see the imports from binary.

Few of the imports:

 ShellExecuteA
 CreateFileA
 CreateFileMappingA
 CreateFileW
 SetSecurityDescriptorDaclCreateMutexA
 CreateNamedPipeA
 CreatePipe
 CreateProcessA
 CreateThread
 FindFirstFileA
 FindFirstFileExW
 FindNextFileA
 FindNextFileW
 GetCommState
 GetCommandLineA
 GetCommandLineW
 ReadConsoleW
 ReadFile
 WriteConsoleW
 WriteFile

Basic Dynamic Analysis

Host Based Indicators

Once the sample is executed, we notice that a powershell window is launched briefly. This is further confirmed when we review the process monitor.

putty.exe — PID:2220

Filtering with the parent PID, we can see the same powershell command execution which was noted during static analysis.

Simultaneously, if you have a instance of TCPview running you should be able to register a TCP Syn call to remote host on port 8443.

TCP View

Network Based Indicators

When we have our internet simulation running, we capture a wireshark trace post executing the sample and note the DNS call being made to a remote host as noted during our Static Analysis.

Immediately after the DNS response, we can see a request TCP SYN request on port 8443. However, since we are not listening on this port, connection is reset.

Now, to see what happens when we have the remote host listening on 8443 we set up a listener and execute the malware sample again.

reverse shell

Malware sample created a reverse shell on the remote host. Reviewing the network traces we can see that the TCP handshake on port 8443 succeeded this time and we received a client hello for TLS handshake from the executing binary.

TCP and TLS connections

Thing to note here is that since we are communicating over TLS, we would need a valid certificate for us to be able to send a response back. However, in this case since we do not have one our reverse shell would terminate when we try and send a command on the shell.