Análisis de ataques APT

Understanding targeted attacks

Saturday, February 4, 2012

Who am I?

• Jaime Blasco

• Alienvault Labs Manager


What are we talking about?

• Group of sophisticated, coordinated and political/financial/military motivated attackers .

• The intruder can exploit publicly known vulnerabilities but the attackers also are highly skilled and well funded and can research and exploit new vulnerabilities.

• The attacker wants to accomplish a mission that can take place over months.


Agenda

• cat /dev/urandom


Example: Kalachakra

• Camp information at Bodhgaya.doc

• CVE 2010-3333


SpearPhishing


Shellcode

Staged XOR Loader


Shellcode

• Resolves imports by hashes

• Ror to generate hashes (ror ebx 7)


Shellcode


Dropped EXE


Dropped EXE

• Language of compilation system: Chinese

• Dropped Files:• C:\Documents and Settings\Administrator\7240672406.dat

• C:\Documents and Settings\Administrator\temp.dat

• Mark the presence on the system:


7240672406.dat


Injection


Obfuscation


Injected Code

• User Mode Process Dumper

• WinDBG to the rescue:


GET / HTTP/1.0Accept: */*Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 6.0)Host: update.microsoft.com/windowsupdate/v7/default.aspx?ln=zh-cnConnection: Keep-Alive

C&C Traffic


kalachakra32.doc


Dropped EXE

• Created Files:

AhnLab-V3, DrWeb, JiangminSaturday, February 4, 2012

Embedded Resource


Debug Info

.\InstallerMFC.cpp-CInstallerMFCApp::InitInstance-56: Installer Hello!

.\InstallerMFC.cpp-CInstallerMFCApp::InitInstance-75: dwConfigDataSize = [40]

.\InstallerMFC.cpp-CInstallerMFCApp::InitInstance-171: ReleaseResource done!

.\install.cpp-InstallSrvPlugin-51: InstallSrvPlugin!

.\install.cpp-InstallSrvPlugin-125: szHost = [218.106.193.184] szPort = [81]

.\install.cpp-InstallSrvPlugin-261: Install Service by WinAPI!

.\install.cpp-InstallSrvPlugin-295: StartServiceEx!

.\SrvPlugin.cpp-ServiceMain-291: g_szServiceName = [5a1bcffe]

.\SrvPlugin.cpp-ConnectClientThread-528: ConnectClientThread

.\SrvPlugin.cpp-ConnectClientThread-638: szHost = [218.106.193.184] szPort = [81]

.\SrvPlugin.cpp-ConnectClientThread-638: szHost = [218.106.193.184] szPort = [81]


Create Service"20120131205652.906","2020","82799b64ca7f2e8cd218223da9d146c3.exe","CreateServiceA","FAIL

URE","0x00466f40","lpServiceName->5a1bcffe","dwServiceType->0x00000110","dwStartType->SERV

ICE_AUTO_START","lpBinaryPathName->C:\WINDOWS\system32\rundll32.exe "C:\Archivos de programa\Archivos comunes\Microsoft Shared\Triedit\5a1bcffe.dll",ServiceEntry"


Av Aware• Check for kisknl.sys (Kingsoft Antivirus)

• Look for KSafeTray.exe and disable it: OpenThread -> SuspendThread

• Check for TmComm.sys (TrendMicro)

• Check for HookPort.sys (QQ 360)

• Depending of the AV present use the native API to install the service or the following method:

• FindWindowA("CabinetWClass", WindowName);

• FindWindowExA(v15, 0, "WorkerW", 0);

• SendMessageA, RegOpenKeyExA, SYSTEM\\CurrentControlSet\\Services\\


WTF!


Real World


Sykipot


Exploits


Samples


Features


C&C Servers


Certificate Access


Smartcard Access


OpenIOC• Indicators Of Compromise

• XML format to describe:

• File Attributes

• Registry entries

• Process attributes

• Network Attributes

• ...

• http://openioc.org/


http://openioc.org/

http://openioc.org/

Example


Thank you

•Follow me on twitter: jaimeblascob


Análisis de ataques APT

Technology

Transcript of Análisis de ataques APT