alien177

alien177

Unknown Driver Analysis

Summary The main idea behind this post is to describe the approach I used to identify the unknow driver's DriverEntry and its dispatch routines, using the BlackCat driver as an example. Environment Tools used during the analysis: Visual Studio 2019 Community, Windows Driver Kit - Windows 10.0.19041.685,

INC Ransomware v2

Summary INC ransomware has been around since the summer 2023. Cybereason created a very detailed write-up for INC ransomware version 1 (V1) earlier this year. You can read it here. Later, INC ransomware version 2 (V2) appeared, and it looks like they added several new command line options as well

Writing a Simple Encryptor

Introduction This blog will be part of a series dedicated to ransomware protection, detection, and recovery. Here, we will explore how to create a simple file encryptor and decryptor from scratch. Encryption is the foundation of every ransomware sample. So, how difficult is it to make one? Environment Things you

Diving in SyscallHook

Intro This short blog post is an attempt to explain the steps performed by the SyscallHook framework to hook the NtCreateFile system routine. SyscallHook SyscallHook is the framework developed by Anze Lesnik for monitoring and hooking system calls. It is based on the older InfinityHook framework. The main idea behind

Extracting IP from getaddrinfo call

Summary This short post documents tracking down the IP address location and value resolved by the getaddrinfo function call with the help of x64dbg. Tools To follow along you will need to build 32-bit WinSock server and client provided by Microsoft and x64dbg. Getaddrinfo The getaddrinfo function resolves the provided

PSScriptAnalyzer: Tokens and ASTs

Introduction Bumped into the PSScriptAnalyzer the other day and a very interesting work on detecting PowerShell scripts obfuscation using ASTs by Daniel Bohannon. So figured it might be interesting to create a small write-up about ASTs, PSScriptAnalyzer, custom PSScriptAnalyzer rules, and put all the info that's out there in one

Part I: Remcos .NET Loader

Summary Quick RE of Remcos .NET loader (e0516fbf7582151fe90b672925f75734). Static Analysis I will skip the static analysis write up since it was not very exciting. We are working with a 32 bit .NET Windows PE and you can find a couple of interesting things statically by examining the file's metadata stream

Registry: LsaSrv

Introduction Grzegorz Tworek discovered that the LsaSrv registry key could be potentially used for persistence on the host since it contains the list of DLLs that LSASS.exe automatically loads. However, it requires a little bit of work to modify its value due to its original permissions. Therefore, I figured

"/0/0"

Summary I bumped into this cool research from eWhite Hats [https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf] the other day and figured why not to build and RE it. Might learn something in the process ¯\_(ツ)_/¯. So here we go. Compilation TL;DR version of the paper