427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
369
427_Botnet_10.qxd 1/9/07 3:06 PM Page 369

---

filename="C:\WINDOWS\system32\Netlib.exe" starttype="SERVICE_AUTO_START"
servicetype="SERVICE_WIN32_OWN_PROCESS,SERVICE_INTERACTIVE_PROCESS"/>

A very powerful technique for infecting a system is to install a 
kernel device
driver
. Once loaded, this driver executes in kernel mode and undergoes no
more security restrictions. Because it has full control over all running kernel
and user mode processes, it could be very hard to detect such malware. In
most cases a kernel driver implements rootkit functions to hide itself and/or
to provide system backdoors. CWSandbox can be configured to forbid the
installation of kernel drivers completely or to fool the installer by returning a
successful error code while suppressing the real installation. In any case, the
attempt to load a kernel driver can be detected by the attribute
servicetype=”SERVICE_KERNEL_DRIVER”
of a 

notifica-
tion.The analysis report section of the installing process would look like this:


filename="C:\WINDOWS\system32\xmsk64.sys" starttype="SERVICE_SYSTEM_START"
servicetype="SERVICE_KERNEL_DRIVER" desiredaccess="SERVICE_ALL_ACCESS"/>

filename="C:\WINDOWS\system32\xmsk64.sys " starttype="SERVICE_AUTO_START"
servicetype="SERVICE_KERNEL_DRIVER" desiredaccess="SERVICE_ALL_ACCESS"/>

Ultimately, loading of the driver is performed by the 
Service Control
Manager (SCM)
.This process is hooked automatically and, in its report sec-
tion, an entry like the following will be given. From the attribute
behavior=”SimulateOK”
we can see that CWSandbox was configured to only
simulate this call and to suppress the real loading.

servicename="\Registry\Machine\System\CurrentControlSet\Services\xmsk64"/>