If you ever used Process Monitor to track activity of a process, you might have encountered the following pattern: The image above is a snippet from events captured by Process Monitor during the execution of x32dbg.exe on Windows 7. DNSAPI.DLL and IPHLPPAPI.DLL are persisted in the System directory, so you might question yourself: Why would […]
The DLL Search Order And Hijacking It Read More »
As a reverse engineer, every now and then you encounter a situation where you dive deeper into the internal structures of an operating system as usual. Be it out of simple curiosity, or because you need to understand how a binary uses specific parts of the operating system in certain ways . One of the
PEB: Where Magic Is Stored Read More »
You probably already guessed it from the title’s name, API Hashing is used to obfuscate a binary in order to hide API names from static analysis tools, hindering a reverse engineer to understand the malware’s functionality. A first approach to get an idea of an executable’s functionalities is to more or less dive through the
Deobfuscating DanaBot’s API Hashing Read More »
UpnP is a set of networking protocols to permit network devices to discover each other’s presence on a network and establish services for various functionalities.Too lazy to port forward yourself ? Just enable UpnP to automatically establish working configurations with devices! Dynamic device configuration like this makes our life more comfortable for sure. Sadly it
UpnP – Messing up Security since years Read More »
Hello everyone :-).I am continuing my analysis on QBot with this article. If you didn’t read my previous posts, I’ve already covered the packer[1] as well as various QBot’s anti analysis measurements and process injection[2]. In this blog post I will explain how the jump to the actual payload is performed. I will also cover
An old enemy – Diving into QBot part 3 Read More »
Intro I hope everyone is healthy :-). I finally managed to find some time to continue my analysis of QBot. If you did not read my previous articles, I’ve already covered the packer[1] as well as the string decryption algorithm[2]. I’ve linked them both here. In this blog post I will cover the process execution
An old enemy – Diving into QBot part 2 Read More »
In a time where Corona is all over the news, cyber criminals are also taking advantage of this situation. Weeks ago I stumbled on a twitter post regarding the MustangPanda APT group and decided to take a look at it. Summary The attack consists of multiple stages and it all starts with a LNK File
Mustang Panda joins the COVID-19 bandwagon Read More »