1

On one of my Windows machines (so I am admin and basically can do whatever I want with it) I'd like to analyse traffic which obviously is directed to a malware C&C server. The traffic is TLS encrypted and originates from an injected/infected service which I know (so I know the exact executable file which is causing it).

I'm generally looking for the best (and most light weight) approach here. Be it installing something on the Windows machine itself or using some kind of middleware/TLS proxy. Ideally the end result should be a decrypted wireshark compatible package dump.

I'm not only looking for a "light weight" solution because I want to have it as easy as possible but also because the malware I'm dealing with seems quite evasive. I already tried cuckoo and on a cuckoo VM it's not even trying to connect the C&C server. Same on every online "deep analyse" service. But as soon as it runs on bare metal Windows or custom made VMs which try to hide its VM status and has lots of hardware passthrough the C&C connections pop up.

I would know how to go about this if I'd like to listen on browser traffic (How does a Web Security Gateway analyse SSL Encrypted Traffic?) but I fear this will not work because the malware will have a cert hard coded and ignore root certs I install on the system which would be used by a TLS proxy. If my thinking is wrong and such a TLS proxy would definitely work please also let me know.

5

There's no way to guarantee the ability to listen to all TLS traffic from a given host. As you mention, the malware might not even use the system security store. It also might have a hard-coded certificate (or at least public key) that it is expecting, in which case it will notice any attempt at a man-in-the-middle attack unless you can steal the server's private key (or crack the public key).

You do have a few options, though. Since you're really only interested in cracking traffic from one particular program, this gets somewhat more plausible.

  • Attempt to reverse engineer the binary and see if there's a hardcoded certificate or key in it. If so, you can attempt to replace this key with the one your MitM uses. However, this will change the binary's fingerprint, so if it attempts to validate its own integrity you'll need to eliminate or patch that check, too.
  • Find out what crypto library the malware is using, and replace it with a "backdoored" version that logs all traffic to plain text. If it's just using the Windows libraries, you'll need to obtain or create such a backdoored one but it should be possible to force the process to use it (although, again, if it's checking the fingerprint or signature on those binaries then this won't work until you patch that out). If it's using a third-party library such as OpenSSL, you can replace that easily, though again look out for authenticity checks. If it's using statically-linked code, this approach is much trickier but might still be possible by dynamically patching the process image at runtime to replace the TLS code's entry point with a backdoored function (though this will require significant reverse engineering).
  • Attempt to reverse engineer the malware enough to just patch out the use of TLS, and tell it to send the traffic in plain text instead. The server obviously won't accept this, but you can use an invisible proxy that encrypts the outbound traffic (and decrypts responses) and logs the plain text both ways. Again, beware integrity checks, and also the server might expect a client certificate that you'll need to pull out of the binary.
  • Attempt to reverse engineer the program enough to tell what it would do from static analysis. This won't tell you what the server would say, but should in theory let you write your own client that the server will trust if that part interests you too. However, any half-competent malware author will include protections and obfuscations to make reverse engineering the binary very hard (this applies to all previous approaches requiring reverse engineering too, of course).
|improve this answer|||||
  • Very informativ and good answer! Unfortunately I fear this goes beyond my time and capabilities. Another question: I was trying cuckoo since they say they can "analyze network traffic, even when encrypted with SSL/TLS" - seemingly they capture "TLS Master Secrets" for this. Could this be an approach without reverse engineering/patching the malware or would it again only work if a "general" MitM approach would also work? (I also don't want to go through too much trouble because maybe the API under the TLS connection has some 'custom encryption' and then I'm out anyways...) – Jey DWork Jan 21 at 19:32
  • Yeah, malware analysis is hard, and is basically an entire specialized subfield of security and reverse engineering. It can be fun to give it a shot, but if the malicious author has any idea what they're doing it'll get beyond a novice pretty quickly. Cuckoo is worth trying, as it attempts to automate some of the stuff above, but it's not hard to defeat. – CBHacking Jan 21 at 20:21
  • And since cuckoo in my initial tries seemingly was already defeated by this malware, for the time being I'm giving up on this. The incident also was with near 100% certainty completely blocked since we have a strickt whitelist only approach on our firewalls (this is how we found it in the moment of execution). Still it would have been nice to know what it was trying to do/send... Thanks a lot for the valuable information nevertheless! – Jey DWork Jan 22 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.