427 Botnet fm qxd

www.syngress.com
Using Sandbox Tools for Botnets • Chapter 10
359
427_Botnet_10.qxd 1/9/07 3:06 PM Page 359

---

father-child relationship shows that the father process has created or injected
into the child process.This is the 
calltree
for our malware sample:

starttime="00:00.219" startreason="AnalysisTarget">

c:\82f78a89bde09a71ef99b3cedb991bcc.exe" starttime="00:02.031"
startreason="CreateProcess"/>


From that output you can see that the initial malware process, which was
created from the binary c:\82f78a89bde09a71ef99b3cedb991bcc.exe, starts a
new process using the command line C:\WINDOWS\system32\arman.exe
—install c:\82f78a89bde09a71ef99b3cedb991bcc.exe.This new file c:\win-
dows\system32\arman.exe most probably was created previously by the initial
process. Via the call parameters, we can see that it recently has been installed
and also where the original malware file is stored. We will see in detail later
what is going on inside this first process. Furthermore, you can see the relative
start time points of the two processes:The first one is started only a few hun-
dred milliseconds after the analysis starts, and the second one starts roughly
after 2 seconds. From the attribute 
startreason
we know that the first process
was started by the sandbox itself and that this process has created the second
one by calling a Windows API function for creating new processes, such as
CreateProcess
. Another possible value for this attribute is 
InjectedCode
, which is
used for those processes that were not newly created but that were already
running and then injected with malicious code.
Analysis of
82f78a89bde09a71ef99b3cedb991bcc.exe 
The 


section contains one 


subsection with detailed infor-
mation for each participating process. From the attributes of the 


element we learn some more information about the process itself:
filename="c:\82f78a89bde09a71ef99b3cedb991bcc.exe" filesize="113152"
md5="82f78a89bde09a71ef99b3cedb991bcc" username="Administrator"