Re: [Vol-users] understanding impscan and Zeus 1.0

Hi folks,**** ** ** Testing impscan with zeus.vmem I have a little question about the capabilities of impscan:**** ** ** Malfind finds 2 regions with injected code as seen many times:**** ** ** C:\Micha\Forensics\Volatility-2.1a>python vol.py malfind -f D:\X-Ways-Images\zeus.vmem -p 1724**** Volatile Systems Volatility Framework 2.1_rc1**** Process: explorer.exe Pid: 1724 Address: 0x1600000**** Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE**** Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6**** ** ** 0x01600000 b8 35 00 00 00 e9 cd d7 30 7b b8 91 00 00 00 e9 .5......0{......**** …**** ** ** Process: explorer.exe Pid: 1724 Address: 0x15d0000**** Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE**** Flags: CommitCharge: 38, MemCommit: 1, PrivateMemory: 1, Protection: 6**** ** ** 0x015d0000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ ..............**** …**** ** ** Base 0x015d0000 is a “real” exe-module and impscan can detect the hooked calls very well:**** ** ** C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x015d0000**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** 0x015d1000 0x77dea43c ADVAPI32.dll CryptGetHashParam**** 0x015d1004 0x77dd7535 ADVAPI32.dll RegCreateKeyExW**** 0x015d1008 0x77de8546 ADVAPI32.dll CryptReleaseContext**** 0x015d100c 0x77dd6fc8 ADVAPI32.dll RegQueryValueExW**** 0x015d1010 0x77dd778e ADVAPI32.dll InitializeSecurityDescriptor*** * 0x015d1014 0x77df986b ADVAPI32.dll GetSidSubAuthorityCount**** 0x015d1018 0x77dd77b3 ADVAPI32.dll SetSecurityDescriptorDacl**** 0x015d101c 0x77df1285 ADVAPI32.dll SetNamedSecurityInfoW**** 0x015d1020 0x77dfcaf6 ADVAPI32.dll LookupPrivilegeValueW**** 0x015d1024 0x77dea2f9 ADVAPI32.dll CryptCreateHash**** 0x015d1028 0x77de2cde ADVAPI32.dll ConvertStringSecurityDescriptorToSecurityDescriptorW**** 0x015d102c 0x77dd6a78 ADVAPI32.dll RegOpenKeyExW**** …**** ** ** Base 0x01600000 contains jump instructions to other addresses:**** ** ** 0x1600000 b835000000 MOV EAX, 0x35**** 0x1600005 e9cdd7307b JMP 0x7c90d7d7**** 0x160000a b891000000 MOV EAX, 0x91**** 0x160000f e94fdf307b JMP 0x7c90df63**** 0x1600014 8bff MOV EDI, EDI**** 0x1600016 55 PUSH EBP**** 0x1600017 8bec MOV EBP, ESP**** 0x1600019 e9ef17c175 JMP 0x7721180d**** ** ** So it seems to be consistent that impscan is unable to find hooked calls there:

>> cc(pid = 1724)

>> dis(0x01600000, length = 0x1000)

C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x01600000**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** Traceback (most recent call last):**** File "vol.py", line 185, in <module>**** main()**** File "vol.py", line 176, in main**** command.execute()**** File "C:\Micha\Forensics\Volatility-2.1a\volatility\commands.py", line 111, in execute**** func(outfd, data)**** File "C:\Micha\Forensics\Volatility-2.1a\volatility\plugins\malware\impscan.py", line 358, in render_text**** for iat, call, mod, func in data:**** File "C:\Micha\Forensics\Volatility-2.1a\volatility\plugins\malware\impscan.py", line 338, in calculate**** forward = True)**** File "C:\Micha\Forensics\Volatility-2.1a\volatility\plugins\malware\impscan.py", line 130, in _vicinity_scan**** start_addr = sortedlist[0]**** IndexError: list index out of range**** ** ** Or does the error message mean something other?

Looked at the first jump target there is the “detoured” call as expected:* *** ** ** C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x7c90d7d7**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** 0x7c97d280 0x7c832b5c kernel32.dll BaseQueryModuleData**** ** ** So impscan is not able to directly handle such trampoline calls, is it?

Following the trace of the jump targets there are two imports of BaseQueryModuleData:**** ** ** C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x7c90df63**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** 0x7c97d280 0x7c832b5c kernel32.dll BaseQueryModuleData**** ** ** Also the next jump targets import the same api calls:**** ** ** C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x7721180d**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** 0x77261000 0x77dd761b ADVAPI32.dll RegOpenKeyExA**** 0x77261004 0x77dfd4c9 ADVAPI32.dll GetUserNameA**** 0x77261034 0x77dfc41b ADVAPI32.dll RegOpenKeyA**** …**** C:\Micha\Forensics\Volatility-2.1a>python vol.py impscan -f D:\X-Ways-Images\zeus.vmem -p 1724 --base 0x771c76bd**** Volatile Systems Volatility Framework 2.1_rc1**** IAT Call Module Function**** ---------- ---------- -------------------- --------**** 0x77261000 0x77dd761b ADVAPI32.dll RegOpenKeyExA**** 0x77261004 0x77dfd4c9 ADVAPI32.dll GetUserNameA**** 0x77261034 0x77dfc41b ADVAPI32.dll RegOpenKeyA**** …**** ** ** I have no clue why theses api-call are hooked twice. Does anybody have an idea?

Regards**** ** ** Michael**** ** ** _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users