427 Botnet fm qxd

www.syngress.com
380
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 380

---

connectionestablished="0" socket="652"/>

Some malware use the integrated 
Terminalserver
of Windows to allow
remote access.They modify the relevant registry settings to allow remote con-
nections in general. In that case, you will find some lines in the report that
look like these:

subkey_or_value="TSEnabled" data="[REG_DWORD, value: 00000001]"/>
subkey_or_value="Start" data="[REG_DWORD, value: 00000002]"/>
subkey_or_value="fDenyTSConnections" data="[REG_DWORD, value: 00000000]"/>

Changing the network routes or hijacking the DNS resolving process is
also part of the performed evil operations.That way, the malware either com-
pletely blocks accesses to hosts that provide updates for security software or
the operating system, or it routes all those requests to infected hosts.This can
be performed by modifying the hosts file, which resides in the
system32\drivers\etc\log directory in the Windows folder. An attempt to do
so can be detected by locating an 

action, which refers to that file
and requests 
WRITE
access. Some malware completely reroutes all DNS
requests to a special host, which is enabled to return different IP addresses
dynamically. Such a modification normally takes place in two steps: First the
network configuration for the network adapter is modified by changing the
relevant registry settings; then the network interface is advised to refresh its
configuration. Of course, the second step is only optional. If it is not per-
formed, the modified network configuration is activated on next system
startup.The tracks of these actions will look like this:

Interfaces\{9E4D711D-1234-5678-9ABC-9E6F3F301B84}"
subkey_or_value="NameServer" data="85.255.114.68,85.255.112.150"/>
subkey_or_value="NameServer" data="85.255.114.68 85.255.112.150"/>