427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
355
427_Botnet_10.qxd 1/9/07 3:06 PM Page 355

---

all monitored processes shortly before they are terminated. So, if a malware
sample is compressed and/or encrypted, you will get a decompressed and
decrypted version of the binary code. All process dumps are also stored in the
mentioned 
.
cab file.
W
ARNING
Please keep in mind that the main purpose of CWSandbox is to monitor
and not to block the actions of the analyzed file. This means that your
local system as well as other remote systems could be infected by it, and
sensitive data might be retrieved from your local host and sent to the
malware operator. Furthermore, active malicious code could remain
after the analysis process has finished. The sandbox tries to terminate all
created processes and to stop all malicious threads that have been
injected into running system services, but this is not possible in all cases,
so you always should reset your system to a clean state afterward.
Cwmonitor.dll
The cwmonitor.dll is injected into each monitored process by the sandbox
application.This is done automatically if the malware starts a new process or if
an existing process is infected with malicious code. If a monitored process
wants to perform either of these operations, the sandbox application controls
this creation/injection as described here. If a new application should be
started, the sandbox intercepts directly after creating the process and before
executing any single operation of it.Then the monitoring DLL is injected and
the newly created process is resumed only if the initialization routine of the
DLL has been successfully performed.The infection of an already running
process works in an analog way. If a monitored process injects code into an
already running one, CWSandbox intercepts this before any single operation
of the injected code is allowed to be executed.Then the monitoring DLL is
injected and completely initialized. If the initialization of the DLL fails for
some reason, the created process or infected thread is terminated automati-
cally without being able to perform any single instruction.
In its initialization routine, the DLL first collects some information about
the hosting process, such as username or security context information.Then it