PE Relocation Table

Introduction One interesting section in a PE file is ".reloc" section that houses a special table called Relocation Table which is an important piece of information needed for Windows loader to load the program into the memory for running the program. When developing advanced malware artifacts, we need to implement functionalities found in Windows loader…

Assembly Byte Embedding & Reflection

This is a follow up writing to my previous article on basics of reflection. It is very common to see an encoded/encrypted/archived payload stored within the malware stagers that gets deployed at runtime using reflection. The stored payload data will be an array of bytes representing the assembly in its raw form. Recall that an…

Reflection in C# 101

Background As someone who is engaged in cyber threat intelligence, one needs to keep track of novel techniques employed by the adversaries to deliver their payload on to the target systems without having to touch the filesystem at all, completely fileless deployment, thus bypassing baseline detection mechanisms. As a means to achieve fileless delivery, malware…

Incorporate Windows ETW in your code using Krabsetw

Introduction In this post we are going to discuss about how we can perform ETW tracing using krabsetw ETW library. We will not be discussing ETW basics here, for that I would recommend readers to check out following posts: ETW 101 Primer on ETW using krabsetw library Clone the krabsetw repo Go to krabs directory.…

The Stack, The Windows & The Adventures

Introduction This post is a "how-to" for writing Win32 code for performing a stackwalk on both x86 and x64 architectures and along the way we will learn the theory behind some of the concepts associated with the stack. In fact this is a quick note created for myself when I started working on designing a…

The Stack Series: The X64 Stack

Overview of x64 stack static RSP On x64 CPU, RSP register serves as both frame pointer and stack pointer, all the stack references are performed based on RSP as a result both local variables and parameters are referenced using RSP. The POP/PUSH instructions alter the RSP, because of this very fact, x64 permits changes to…

Analysing a Multi Stager : A case study of QBOT

motivation This is not going to be about QBOT analysis rather a quick "how-to" for analysing malwares that employ multiple stages in the infection chain. Recently, in my work, I got a sample (a mal pdf) for analysis, at the time I had no prior information and task was identification. Interestingly initial vector used to…

The Stack Series: Return Address Spoofing on x64

introduction The stack of a process has the potential to give away the true nature of the running program in the memory. Hence it is one of the monitored entities by the security solutions. When a program executes any interesting functions like InternetConnectA, security systems may initiate a stack check to find out if there…

Memory Hiding Technique Series: Ekko – The basics

Introduction In previous post, we covered Gargoyle memory hiding technique, this time we will look at another technique called Ekko, a POC created by C5pider which is actually based on Austin Hudson's findings from reversing MDSec NightHawk payload. The implementation of the Ekko is very straightforward. There is a timer for synchronization. The Asynchronous Procedure…

Memory Hiding Technique Series: Gargoyle

introduction As reflective loading has become the staple vector for staging malware, adversaries rely on in-memory payloads for ensuring both operational security and evasion in the post exploitation phase and to counter such effort we have quite a few robust tools like Moneta and PE-sieve for scanning memories to catch active beacons/agents hidden inside running…

Tale of Hosting .NET in unmanaged code Part 0x3: HavocFramework

recap We are wrapping up the "Tale of Hosting .Net" series by covering the implementation details of InlineAssembly-Execute feature in Havoc Framework- A very recent open source C2 framework developed by C5pider. Here in this post we are reiterating everything we saw in the earlier posts part-1 and part-2, so make sure you read it…

Tale of Hosting .NET in unmanaged code- PART/0x2 | InMemory Execution.

background In the previous post, we implemented a basic host program that could load up the CLR and execute an assembly. The issue with that approach is loading of the .NET assembly, we loaded the assembly from the disk and required passing of additional information like type and method name. In this post we will…

Tale of Hosting .NET in unmanaged code- PART/0x1

offensive .NET Amazing folks in the community especially those who are inclined towards adversary simulation and other advanced attack vectors started tooling in C#. Why? you might ask. The reason is the .NET is at the heart of Windows and it is heavily integrated with the architecture itself, one could simply harness the power of…