{"id":7046,"date":"2014-10-04T13:33:57","date_gmt":"2014-10-04T13:33:57","guid":{"rendered":"http:\/\/www.bsk-consulting.de\/?p=1006"},"modified":"2022-10-04T15:53:00","modified_gmt":"2022-10-04T13:53:00","slug":"smart-dll-execution-malware-analysis-sandbox-systems","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/","title":{"rendered":"Smart DLL execution for Malware Analysis in Sandbox Systems"},"content":{"rendered":"

[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on” da_disable_devices=”off|off|off”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Text” _builder_version=”4.18.0″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” sticky_enabled=”0″]While analysing several suspicious DLL files I noticed that some of these files (which were obviously malicious) didn’t perform their malicious activity unless a certain function was triggered. The malware used a registry entry to execute a certain function that is exported by the DLL called “InstallM”. I had to run “rundll32.exe malware.dll,InstallM” to trigger the malicious activity.
\nIn order to automate the process of A) analyzing the exported functions and B) run the various DLL functions I created a script called “DLLRunner”. What it does is rather simple:<\/p>\n

    \n
  1. First, it uses the Python module pefile to analyze the PE and retrieve a list of all exported functions with name and ordinal.<\/li>\n
  2. Second, it executes the various exported functions by name or ordinal<\/li>\n
  3. Third, it passes a set of parameters to the function in order to satisfy requirements and trigger any activity (simple “fuzzing”)<\/li>\n<\/ol>\n

    This is what it does:<\/p>\n

    \nrundll32.exe path\/to\/file.dll,exportedfunc1\nrundll32.exe path\/to\/file.dll,exportedfunc2\nrundll32.exe path\/to\/file.dll,exportedfunc3\n<\/pre>\n
    The simple fuzzing mode looks like this:<\/p>\n
    \nrundll32.exe path\/to\/file.dll,exportedfunc1 \"0\"\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"1\"\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"http:\/\/evil.local\"\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"Install\"\n...\n<\/pre>\n
    Examples<\/h2>\n
    I tested the script on “url.dll” which is typically located in the system32 folder.<\/p>\n
    \npython dllrunner.py -f C:\\Testing\\url.dll --debug\n<\/pre>\n
    \"Run
    DLLRunner executing all exported functions<\/p><\/div>\n
    It caused a function called “TelnetProtocolHandler” and “TelnetProtocolHandlerA” to pop a telnet shell.<\/p>\n
    \"DLL
    DLLRunner popping telnet windows via exported function\u00a0“TelnetProtocolHandler”<\/p><\/div>\n
    If you pass “–fuzz” DLLRunner will pass several params to the functions. This caused a function in “url.dll” to pop browser windows with a fuzz parameter “http:\/\/evil.local”.<\/p>\n
    \npython dllrunner.py -f C:\\Testing\\url.dll --debug --fuzz\n<\/pre>\n
    \"DLLRunner
    Running DLLRunner in Fuzzing mode<\/p><\/div>\n
    I am still not sure if this is something useful. I have to do further testing to improve the fuzzing idea. I am open to any advice and would like to see something like this integrated in common sandboxes like cuckoo.<\/p>\n
    Download<\/h2>\n
    DLLRunner on Github<\/a>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
    While analysing several suspicious DLL files I noticed that some of these files (which were obviously malicious) didn’t perform their malicious activity unless a certain function was triggered. The malware used a registry entry to execute a certain function that is exported by the DLL called “InstallM”. I had to run “rundll32.exe malware.dll,InstallM” to trigger the malicious activity. In order to automate the process of A) analyzing the exported functions and B) run the various DLL functions I created a script called “DLLRunner”. What it does is rather simple: First, it uses the Python module pefile to analyze the PE and retrieve a list of all exported functions with name and ordinal. Second, it executes the various exported functions by name or ordinal Third, it passes a set of parameters to the function in order to satisfy requirements and trigger any activity (simple “fuzzing”) This is what it does: rundll32.exe path\/to\/file.dll,exportedfunc1 rundll32.exe path\/to\/file.dll,exportedfunc2 rundll32.exe path\/to\/file.dll,exportedfunc3 The simple fuzzing mode looks like this: rundll32.exe path\/to\/file.dll,exportedfunc1 “0” rundll32.exe path\/to\/file.dll,exportedfunc1 “1” rundll32.exe path\/to\/file.dll,exportedfunc1 “http:\/\/evil.local” rundll32.exe path\/to\/file.dll,exportedfunc1 “Install” … Examples I tested the script on “url.dll” which is typically located in the system32 folder. python dllrunner.py -f C:\\Testing\\url.dll –debug It caused a function called […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"While analysing several suspicious DLL files I noticed that some of these files (which were obviously malicious) didn't perform their malicious activity unless a certain function was triggered. The malware used a registry entry to execute a certain function that is exported by the DLL called \"InstallM\". I had to run \"rundll32.exe malware.dll,InstallM\" to trigger the malicious activity.\r\nIn order to automate the process of A) analyzing the exported functions and B) run the various DLL functions I created a script called \"DLLRunner\". What it does is rather simple:\r\n
      \r\n\t
    1. First, it uses the Python module pefile to analyze the PE and retrieve a list of all exported functions with name and ordinal.<\/li>\r\n\t
    2. Second, it executes the various exported functions by name or ordinal<\/li>\r\n\t
    3. Third, it passes a set of parameters to the function in order to satisfy requirements and trigger any activity (simple \"fuzzing\")<\/li>\r\n<\/ol>\r\nThis is what it does:\r\n[cc lang=\"bash\"]\r\nrundll32.exe path\/to\/file.dll,exportedfunc1\r\nrundll32.exe path\/to\/file.dll,exportedfunc2\r\nrundll32.exe path\/to\/file.dll,exportedfunc3\r\n[\/cc]\r\nThe simple fuzzing mode looks like this:\r\n[cc lang=\"bash\"]\r\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"0\"\r\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"1\"\r\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"http:\/\/evil.local\"\r\nrundll32.exe path\/to\/file.dll,exportedfunc1 \"Install\"\r\n...\r\n[\/cc]\r\n
      Examples<\/h2>\r\nI tested the script on \"url.dll\" which is typically located in the system32 folder.\r\n[cc lang=\"bash\"]\r\npython dllrunner.py -f C:Testingurl.dll --debug\r\n[\/cc]\r\n[caption id=\"attachment_1007\" align=\"alignnone\" width=\"584\"]\"Run<\/a> DLLRunner executing all exported functions[\/caption]\r\nIt caused a function called \"TelnetProtocolHandler\" and \"TelnetProtocolHandlerA\" to pop a telnet shell.\r\n[caption id=\"attachment_1008\" align=\"alignnone\" width=\"620\"]\"DLL<\/a> DLLRunner popping telnet windows via exported function\u00a0\"TelnetProtocolHandler\"[\/caption]\r\nIf you pass \"--fuzz\" DLLRunner will pass several params to the functions. This caused a function in \"url.dll\" to pop browser windows with a fuzz parameter \"http:\/\/evil.local\".\r\n[cc lang=\"bash\"]\r\npython dllrunner.py -f C:Testingurl.dll --debug --fuzz\r\n[\/cc]\r\n[caption id=\"attachment_1012\" align=\"alignnone\" width=\"620\"]\"DLLRunner<\/a> Running DLLRunner in Fuzzing mode[\/caption]\r\nI am still not sure if this is something useful. I have to do further testing to improve the fuzzing idea. I am open to any advice and would like to see something like this integrated in common sandboxes like cuckoo.\r\n
      Download<\/h2>\r\nDLLRunner on Github<\/a>","_et_gb_content_width":"","footnotes":""},"categories":[255,264],"tags":[90,475,476,477,478,124,479,480,481,217,482,173],"class_list":["post-7046","post","type-post","status-publish","format-standard","hentry","category-command-line","category-tool","tag-analysis","tag-dll","tag-execution","tag-exported","tag-functions","tag-malware","tag-ordinal","tag-rundll32","tag-rundll32-exe","tag-sandbox","tag-smart","tag-system"],"yoast_head":"\nSmart DLL execution for Malware Analysis in Sandbox Systems - Nextron Systems<\/title>\n<meta name=\"description\" content=\"Smart DLL execution for Malware Analysis in Sandbox Systems\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"Smart DLL execution for Malware Analysis in Sandbox Systems\",\"datePublished\":\"2014-10-04T13:33:57+00:00\",\"dateModified\":\"2022-10-04T13:53:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\"},\"wordCount\":439,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"keywords\":[\"analysis\",\"dll\",\"execution\",\"exported\",\"functions\",\"malware\",\"ordinal\",\"rundll32\",\"rundll32.exe\",\"sandbox\",\"smart\",\"system\"],\"articleSection\":[\"Command Line\",\"Tool\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\",\"name\":\"Smart DLL execution for Malware Analysis in Sandbox Systems - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2014-10-04T13:33:57+00:00\",\"dateModified\":\"2022-10-04T13:53:00+00:00\",\"description\":\"Smart DLL execution for Malware Analysis in Sandbox Systems\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Smart DLL execution for Malware Analysis in Sandbox Systems - Nextron Systems","description":"Smart DLL execution for Malware Analysis in Sandbox Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"Smart DLL execution for Malware Analysis in Sandbox Systems","datePublished":"2014-10-04T13:33:57+00:00","dateModified":"2022-10-04T13:53:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/"},"wordCount":439,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"keywords":["analysis","dll","execution","exported","functions","malware","ordinal","rundll32","rundll32.exe","sandbox","smart","system"],"articleSection":["Command Line","Tool"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/","url":"https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/","name":"Smart DLL execution for Malware Analysis in Sandbox Systems - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2014-10-04T13:33:57+00:00","dateModified":"2022-10-04T13:53:00+00:00","description":"Smart DLL execution for Malware Analysis in Sandbox Systems","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2014\/10\/04\/smart-dll-execution-malware-analysis-sandbox-systems\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/7046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=7046"}],"version-history":[{"count":4,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/7046\/revisions"}],"predecessor-version":[{"id":14661,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/7046\/revisions\/14661"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=7046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=7046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=7046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}