Virtual network for malware analysis

Question

I'm attempting to do some analysis work on a malware sample but I'm running into a wall. I can't get the malware to execute correctly and talk to its C2 server. In my lab I have a Windows machine that executes the malware, a pfSense router that only has LAN, and an additional Linux host on the same subnet as the Windows machine that runs INetSim (a fake web server). On my windows host I normally use Mandiant apateDNS which responds to all DNS queries with my INetSim address, however I believe that this malware is detecting that an not executing as a result, so what I need is to configure my pfSense router to tunnel all requests to the INetSim box and I'm not sure how to go about that.

Answer 1

What makes you believe it is not executing properly? Many variants of malware have checks and balances that disable full execution if certain programmed parameters are not met for example:

• Check if I am virtualized if so don't run
• Check to see if I have true Internet connectivity if not don't run
• Check to see if I can exploit anything on this machine for proper privileges

In the first, you could edit out any traces of VMWare, Virtualbox, etc. In the second, this can become tricky. If you browse over to Virustotal and check samples, you will see many make what appear to be absurd connections to legitimate sites (e.g., ping 8.8.8.8 or 8.8.4.4). It may work like this:

InfectedHost --> do something --> legitimate site
InfectedHost --> check value of what I just did
InfectedHost --> does value match pre-programming? If not die

When using DNS you need to be cautious as well. Once upon a three years ago, I was analyzing a variant of SDBot. The variant would put "windowsupdate.com" in the host file pointed at a bogus address. It could make a beacon connection:

InfectedHost --> windowsupdate.com
InfectedHost --> give me this update (would never work but return a 404)

The 404 is what would trigger the C&C functionality. My suggestion is to analyze all of the activity and give it what it wants. On the worse case, create a snapshot/ghost of your image. Let it run in a true isolated network for a minute or so. Freeze it, analyze the traffic, and go from there. Keep in mind, it's all in the programming, so you may need to disassemble it in IDA as well. The instances of SDBot I analyzed would never begin immediate connections, they'd wait till different times, scattered hours, hours after an infection.