Hi Sebastien, The userhandles plugin is contained within a suite of win32k utils that haven't been released yet. I'm looking forward to getting them distributed sometime after Volatility 2.1 release. MHL On Sat, Feb 18, 2012 at 6:35 PM, Sebastien Bourdon-Richard <sebastienbr(a)gmail.com> wrote:

I am conducting an examination of a test system infected with a sample from the internet. See attached virustotal scan if you are interested what it is. fawi.exe is the dropped infection result of sample ssl.exe I am having trouble answering the question, "Where is the malware?". This is not the usual rundll or infected program in memory, it is injected. I think it is in the kernel, but this is a new area for me. Any direction on how I answer that question is appreciated. (One thought I had is: that the malware is hooked into the SSDT that zone alarm's vsdatant.sys hooks and since vsmon.exe probably uses vsdatant.sys, that is why the malware looks like it is in vsmon.exe - but it is just hooked into the kernel.) Here is where I am at and how I got there: The infection started executing ssl.exe, here is some prefetch info: SSL.EXE-028F0541.pf Saturday, February 25, 2012 23:08:41 Z (UTC) Nothing in PSSCAN, no ssl.exe anywhere in fact. It dropped: \DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\YPYCUB\FAWI.EXE and executed it: FAWI.EXE-398259A4.pf Saturday, February 25, 2012 23:08:41 Z (UTC) PSSCAN shows it ran for 3 secs Offset Name PID PPID PDB Time created Time exited 0x0420ca70 fawi.exe 3812 2468 0x0cd44000 2012-02-25 23:08:37 2012-02-25 23:08:40 Seeing this: fawi.exe pid: 3812 Unable to read PEB for task. did not surprise me since it had exited. I could easily see how it is in NTUSER.DAT and starts with the run key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run {AED24BF3-7C21-B878-2172-0CFD5C3474CA} "C:\Documents and Settings\Mike\Application Data\Ypycub\fawi.exe" Glows Anger Hebrew Orb Networks 8.3.0.0 c:\documents and settings\mike\application data\ypycub\fawi.exe f4cc71ca8e5522519b9c6e8d350d876b (MD5) Since fawi.exe has terminated, my only clue is explorer.exe communications seen by cports.exe 2/25/2012 5:08:39 PM Added Explorer.EXE TCP 192.168.1.44:1185 94.63.147.98:80 (An interesting note: Win32dd and FDPRO were both unable to collect a memory image. I hibernated the system and converted hiberfil.sys to a file I could analyze with Volatility.) Explorer.exe seemed the first suspect as it was the only process sending network i/o out 0x043d7360 explorer.exe 1756 1732 0x107ff000 2012-02-25 11:30:26 I pulled the dlls, files and reg keys for PID 1756, along with a memdmp. Nothing interesting in the dlls files or keys. I examined the dmp and found an unusual string in it along with ssl.exe and fawi.exe and this "Glows Anger Hebrew" A search of the internet shows one reference in a similiar infection in February. I found it on the internet just 2 days after the first sample was sent to virustotal. I searched the 458 MB memory image for "Glows Anger Hebrew" and got 5 hits. Here is my text file for the strings function 357229672:Glows 280642408:Glows 257105340:Glows 113457472:Glows 357230696:Glows Results from strings is: 357230696 [kernel:df864868 ] Glows 357229672 [kernel:df864468 ] Glows 257105340 [kernel:e1ec1dbc ] Glows 113457472 [1456:2ac0940 ] Glows 280642408 [1456:45b8368 ] Glows PID 1456 is: vsmon.exe pid: 1456 Command line : C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service PSSCAN is 0x043e6020 vsmon.exe 1456 848 0x102da000 2012-02-25 11:30:25 I dumped PID 1456 and searched the dmp. I also grabbed a couple of other processes (because 3 were kernel references). See search results in the attached JPG (cut and paste test did not work out well). So, strings said that the malware is injected in vsmon.exe. Is that correct? Now I guess my next step is to identify the thread? Or is this malware 'everywhere' in that it is in the kernel, and everyone mapps to it? I need some help on next steps. Am I moving in the right direction? BTW, who else is doing this type of work? and are you interested in colaborating? I am in Houston, TX. Thanks for your help! Mike Lambert dragonforen(a)hotmail.com michael-lambert.us/index.htm