Challenge-Sillyputty
Malware Details
Name - putty.exe.malz Type - Backdoor
Hashes
MD5-
MD5sum.exe putty.exe.malzOutput - 334a10500feb0f3444bf2e86ab2e76da *putty.exe.malz
SHA256-
sha256sum.exe putty.exe.malzOutput -0c82e654c09c8fd9fdf4899718efa37670974c9eec5a8fc18a167f93cea6ee83 *putty.exe.malz
Virustotal results - Malicious
Architecture of binary - Intel x86
Static Analysis
Strings-
Tool used - FLOSS
Command -
Screenshot-->
Interesting Strings-->
IAT analysis-
Tools used - PEview
Interesting results -->
Malware is in the form of a windows portable executable
Looking at IMAGE_SECTION_HEADER.text we get,
Virtual size and size of raw data is approximately same. Thus the binary is an unpacked binary.
A lot of libraries and APIs have been loaded. This confirms that the binary is an unpacked one.
Now for further analysis , open PEstudio.
Bringing it all together-
Tools used - PEstudio
Interesting results -->
Potential Malware indicators -->
File-header (intel-386) -->
Flagged IAT Imports-->
Out of total 326 imports, 51 of them were flagged as malicious with majority of them being focused on windowing and execution. But this doesn't conclude anything as legitimate putty program also uses these APIs.
Dynamic Analysis
Initial detonation
Without network - A blue powershell window pops up and closes itself immediately.
A normal putty window opens. Most probably the malware detected the sandbox.
With network -
The same happens on detonation of the sample.
Network Analysis
Tools used- inetsim and wireshark.
After detonation and capturing packets from the malware-
We see a http request for 3 files one after the other in wireshark -
And a DNS request -->
for the domain address-->
This domain address doesn't exist in our network. So we edit out hosts file to point to the windows box .
Command-->
Host Analysis
Tools used - procmon , tcpview
We fire up procmon and detonate the malware.
A lot of processes load up. Looking up process tree we get -
A powershell command is running in the background. This must be the blue window we saw at the beginning.The command is -
There is also a conhost.exe (console host) running under powershell which must host the above command. This is the command for a remote shell which the malware author might be trying to exploit.
We can conclude that this is a backdoor.
Converting the base64 string we get to know that the malware opens up a port on localhost:8443 and only communicates with ssl/https. Thus in order to interact with the shell we type-
We run both the command and the malware and we get the shell -
Last updated