Dll care is malware how to#
Dll care is malware full#
Dll care is malware code#
Dll care is malware windows#

Dll care is malware how to#

Joe Stewart goes over how to do this in one of his articles. In order to debugg a dll with olly, we need to fool the debugger into thinking the dll is an exe. We now have a new file to analyze, shell32.dll. Simply looking at this piece of malware using behavioral techniques might be frustrating to an analyst since their VM would magically reboot without any notice. It creates a new registry key that allows shell32.dll to start on boot, and then restarts the machine. So far we have learned: t.exe writes two dlls to the userвЂ™s temp directory. If the logged in user has this privilege, the malware will wait 120,000 miliseconds (2 minutes) and then call the the ExitWindowsEx function with EWX_REBOOT as the argument. The 3rd call (at 00402392) is also interesting, it checks for the SeShutdownPrivilege which allows the logged in user to shutdown or reboot the PC. This is how the malware will start on system boot. InprocServer32 executes a dll on system startup. Stepping into the first call at 402387 opens a registry key and writes the value shell32.dll to it.

Dll care is malware code#

There are 3 more code branches (CALLs) that get executed before the process is terminated (ExitProcess) Looking back at the debugger, weвЂ™ve reached the end of the first code brach. We may now navigate to the directory and view the fileвЂ™s contents just to double check what happened.

Dll care is malware full#

The following writes the full path to t.exe into the file using the WriteFile function. With the file created, data will now be written to it. This will create a new file called 123.info in the below directory Slightly further down, we encounter another similar block of code which is preparing another fileД¬ontinuing on in the code, CreateFileA (self explanatory) is called with 123.info as the file name. Can you guess what lstrcatA does? Again, pretty self explanatory, this function concatenates two strings together.Д®xecuting lstrcatA results in the following being stored in the EAX register. The StringToAdd variable contains the name of the dll we saw in the strings output. This function has populated the variable ConcatString with the location of the currently logged in userвЂ™s temp directory. To single step into a instruction, use F7. We then step over (F8) the instruction and GetTempPathA will be executed. To run the program until the breakpoint, hit F9. The GetTempPathA call seems pretty self explanatory, so weвЂ™ll set a breakpoint on it (F2).

Dll care is malware windows#

WeвЂ™ll now start looking at the exe in a debugger (ollydbg).ДЄfter loading the file in olly, itвЂ™s easy to spot calls to windows API functions as they are highlighted in red. In the screenshots I am using the strings shell extension from the iDefense malware analysis pack.ДЄlready weвЂ™ve found some clues, it references a dll called shell32.dll and a CLSIDДЄs we continue to look through the file, several more interesting strings pop up, including an IP address, more dlls and a function called WriteFile. The strings that begin with a period are the different segments that reside inside the executable. As shown below, several strings are visible. To confirm this we can quickly check the fileвЂ™s ascii strings. According to PEiD, the file is not packed. We first start by checking to see if the file is packed to obscure itвЂ™s contents. Sunbelt sandbox report: didnвЂ™t produce any results. Even though this level of analysis isnвЂ™t needed for such a simple piece of malware, it makes for a great sample to learn on. For my first real foray into reverse engineering, I decided to pick something small and easy to analyse.