Malware Reverse Engineering Process 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings Physical Memory Remote Memory Snapshot Live Recon Session Static Binary Forensic Binary Journal Responder Pro 2.0 Digital DNA Report contains suspicious behaviors and malicious characteristics exhibited by code and ranked by severity If needed, an analyst can examine the suspicious code objects and conduct additional reverse engineering Analyst documents findings in malware report: Processes and Drivers Loaded Modules Network Socket Info Passwords Encryption Keys Decrypted files Order of execution Runtime State Information Rootkits Configuration Information Logged in Users NDIS buffers Open Files Unsaved Documents Live Registry Video Buffers – screen shots BIOS Memory VOIP Phone calls Instant Messenger chat Goal:  Gain the lowest level of diagnostic visibility in order to detect unknown malware and malicious behaviors To obtain our goal we created the latest advances in memory forensics & reverse engineering technology. The result was Digital DNA. HBGary Malware Reverse Engineering Process Version 0.1

1. Acquire Malware Specimen Malware Reverse Engineering Process:  Acquire Malware Specimen 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings Create Responder project, a container for all the files necessary to analyze, annotate and interpret a memory image or static binary Malware specimens can be analyzed using Responder Pro 2.0 from: Physical Memory Snapshot Virtual Machine infection Regular host infection Live REcon Session in Virtual Machine Live REcon Session on regular host Static Disassembly Analysis Combinations of 1 - 4   HBGary Malware Reverse Engineering Process Version 0.1

2. Automated Reverse Engineering Malware Reverse Engineering Process:  Automated Reverse Engineering 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings Responder 2.0 with Digital DNA automatically reverse engineers the malware specimen. Live REcon launches malware safely in virtual machine, executes code, creates forensic binary journal for analysis in Responder Pro. Responder automatically scans for suspicious behavior and adds this to the Report Tab, ranked by severity. HBGary Malware Reverse Engineering Process Version 0.1

3. Review Automated RE Report Malware Reverse Engineering Process:  Review Automated RE Report 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings The Report Tab stores the human-readable results of an analysis and allows the user to quickly create report items from interesting pieces of data. Identifies any SDT entries that contain hooks. Identifies any IDT entries that contain hooks. Results in the Report Tab are ranked by Severity. HBGary Malware Reverse Engineering Process Version 0.1

4. Manual Reverse Engineering Malware Reverse Engineering Process:  Manual Reverse Engineering 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings Responder Pro 2.0 provides Analysts with a framework and logical workflow for malware reverse engineering: Malware installation & deployment factors Communication factors Information security factors Defensive factors Development factors Command & control factors Using the Object Tab as a guide, the Analyst performs manual reverse engineering to answer questions about the malware's behavior such as... HBGary Malware Reverse Engineering Process Version 0.1

4. Manual Reverse Engineering Malware Reverse Engineering Process:  Manual Reverse Engineering (Cont) 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings Development Factors In what country was the malware created? Was it professionally developed? Are there multiple versions? Is there a platform involved? Is the a toolkit involved? Are there multiple parts developed by different groups or developers? Communication Factors Where does it connect to on the Internet? Drop points, Update Sites, C&C,  IP addresses or DNS names incoming or outbound connections? Does it use encryption? Does it use Steganography? Command & Control Factors How is the malware controlled by its master? Do commands come from a cutout site? What commands are supported? Sniffing, logging, search file system, Attack Poison Pill - Self-destruct? Installation & Deployment Factors Does it use the registry? Does it drop any files? Autorun.inf? USB? Open shares? Does it sleep and awaken later? JavaScript?  Flash? Infection Point/Attack Vector Defensive Factors Signs of packing or obfuscation AV Sabotage Does it have self-defense? Does it use rootkit techniques/stealth? Does it bypass the operating system? Information Security Factors Identify the risks associated with the binary What does it steal? Does it sniff keystrokes, passwords, 2 factor authentication tokens? Can it destroy data? Can it alter or inject data? Does it download additional tools? HBGary Malware Reverse Engineering Process Version 0.1

4. Manual Reverse Engineering Malware Reverse Engineering Process:  Manual Reverse Engineering (Cont) 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings 3.  Responder Pro 2.0 provides an organized view into malware behavior and traits: Interrupt Descriptor Table Panel Network Sockets Panel Registry Keys Panel Drivers Panel Keys & Passwords Panel Processes Panel System Descriptor Tables Panel 4.  Responder Canvas Tool provides graphical representations of code and data so an analyst can rapidly identify relationships, view control flow of modules, program dependancies and interactions. HBGary Malware Reverse Engineering Process Version 0.1

Malware Reverse Engineering Process: Document Findings 1. Acquire Malware Specimen 2. Automated Reverse Engineering 3. Review Automated RE Report 4. Manual Reverse Engineering 5. Document Findings The Analyst documents the malware in the Report Tab Processes and Drivers Loaded Modules Network Socket Info Passwords Encryption Keys Decrypted files Order of execution Runtime State Information Reports can be exported in several formats Adobe (PDF) Microsoft Excel (XLS) Comma-separated Value File (CSV) HTML page Text file Rich Text Format file (RTF) Results are incorporated into a formal deliverable HBGary Malware Reverse Engineering Process Version 0.1