2

Im trying to run some malware samples in my Virtual lab to capture their IOC's. Im doing this for my Masters Thesis but i can not seem to get the malware to run.

I have downloaded samples from hybrid analysis. if i try and run the malware using run32dll <sample>,#1 i get nothing start.

Im running a petya malware sample downloaded from hybrid-analysis.com

rundll32.exe C:\027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745.bin.dll",#1"

If I look at the sample in PE Explorer i get told it's not a valid exe or DLL.

Anyone have any experience executing malware that can assist a newbie in this?

I'm more of an Infrastructure and OS guy. I would have thought running the would have been easy.

I have attached my lab design on the post. The Host Machine is an Ubuntu box with 32 GB ram and a bunch of processors The Lab is a VirtualBox environment. The Home network is the way to the internet Virtual Lab -> Host System -> Internet Gateway

enter image description here

Any help in the resolution of my problem gratefully received.

  • And you are running this on a Windows machine? Which one? What arch? You've spent more time talking about your lab than saying anything about the machine you are running this command on. – schroeder Jan 14 '18 at 11:21
  • @twelsh37 - have you checked the hash of the downloaded file? I believe the name is it's sha256. – Hector Jan 14 '18 at 11:32
  • All, Thanks for pointing out my weaknesses on submitting. I should have been better than this. Its a win 10 x 64 box. Guest 3. I have now recopied the files to the environment and appended .DLL on the file and its now being opened by PE explorer. It hasnt caused it to run yet but im working on it – twelsh37 Jan 14 '18 at 11:35
  • Some malware implements detection of virtualization, specifically to make it harder to analyse. There are a lot of ways to detect if software is running in a VM, so it's tricky to defeat universally. – Matthew Jan 14 '18 at 17:16
  • actually you can , but malware will try to detect if it is run in a vm environment. – AXANO Jan 14 '18 at 21:46
4

I saw a report on this a while ago, many ransomewares will try too detect if they're in a VM or lab environment and will refuse too run, basically as a defense mechanism for exactly what you're doing.

Depending on the family of malware there are tests in the code that check for things like the visualization environment (Are we running on Xen? OOOH! Juicy Target!/Are we running on VMware/VBox? Uh-Oh, might be a Lab! ABORT!), File structure (Not much here? ABORT! Oldest file is from last week? Hmm... ABORT!) too things such as multiple subnets (Traffic is routing through 192.168.1.1 but my gateway is 10.0.2.1? ABORT!) even things like screen resolution can be tested against (800x600 Res? ABORT!)!

In short, as researcher get smarter about how they test malware, the authors of said malware adapt to defeat those efforts!

2

Malware sample 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 doesn't seem to implement any kind of a sandbox/environment detection. You're saying it doesn't run. What error is displayed by rundll32?

Note that the immediate effects of running sample 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 are subtle. It silently writes to a few locations on disk and schedules a reboot after 60 minutes, and that's only after an hour when all the dark magic starts.

Check if there's a copy of that DLL under C:\Windows\ that you haven't created yourself. If a copy is there, it means the sample has started its dirty job.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.