427 Botnet fm qxd

www.syngress.com
362
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 362

---

notification 

approves the fact that the malware process termi-
nates itself after starting its copy from the Windows system directory.
c:\82f78a89bde09a71ef99b3cedb991bcc.exe" targetpid="1612"
creationflags="DETACHED_PROCESS" showwindow="SW_HIDE"
apifunction="CreateProcessA" successful="1"/>
apifunction="NtTerminateProcess"/>
That is all for the first process, and this is exactly what we see for the most
of these simple bots: On their first start, they simply copy themselves to the
Windows directory, then they execute this new copy and terminate the initial
application.
Analysis of Arman.exe 
Let’s now take an intensive look at the actions of the second process, which
promises more interesting results:
--install c:\82f78a89bde09a71ef99b3cedb991bcc.exe" filesize="113152"
md5="82f78a89bde09a71ef99b3cedb991bcc" username="Administrator"
parentindex="1" starttime="00:02.031" terminationtime="02:00.547"
startreason="CreateProcess" terminationreason="Timeout"
executionstatus="OK">
We know that this process is created from the same binary, only from a
different location.Therefore, the MD5 and the file size have the same values
as for the first one. From the values of the attributes 
parentindex
and 
startreason
we know that the execution was initiated by the first process.The 
termination-
reason
tells us that this second process did not terminate itself but would have
continued to execute if the sandbox application had not terminated it at the
end of the analysis.

desiredaccess="FILE_ANY_ACCESS" flags="SECURITY_ANONYMOUS"/>