Skip to content

Common API used in Malware

reversing api

Import tablosu ve runtime resolve edilen API’ler davranışı hızla sınıflandırır. IAT boşsa GetProcAddress zincirini takip et.

Metodoloji

Section titled “Metodoloji”

  1. rabin2 -i / DIE ile import ve packer durumunu gör.

  2. Network / inject / crypto / persistence kümelerini işaretle.

  3. Dinamik olarak çağrı argümanlarını yakala (Frida/x64dbg).

  4. C2, inject hedefi ve kalıcılık yolunu not et.

Import triage

Section titled “Import triage”
Terminal window
rabin2 -i sample.exe | head -80
Terminal window
objdump -p sample.exe | rg 'DLL Name|vma'
Terminal window
pestudio sample.exe
Terminal window
floss sample.exe | rg -i 'http|VirtualAlloc|CreateRemoteThread|RegSetValue'

Process / inject

Section titled “Process / inject”
VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
NtCreateThreadEx, QueueUserAPC, SetThreadContext
OpenProcess, NtMapViewOfSection
Terminal window
frida -f sample.exe -l trace_inject.js
Terminal window
# x64dbg: bp CreateRemoteThread

Network / C2

Section titled “Network / C2”
InternetOpenUrlA/W, HttpSendRequest, WinHttpSendRequest
WSAStartup, connect, send, recv
DnsQuery_A
Terminal window
tcpdump -i any host not 10.0.0.0/8 -n
Terminal window
procmon / Accept filter: Operation is TCP Connect

Crypto / string

Section titled “Crypto / string”
CryptDecrypt, BCryptDecrypt, CryptImportKey
AES_* (OpenSSL), EVP_DecryptUpdate
Terminal window
frida-trace -f sample.exe -i 'CryptDecrypt' -i 'BCryptDecrypt'

Persistence

Section titled “Persistence”
RegSetValueEx (Run/RunOnce), StartService, ITaskService
CopyFile → Startup folder, WMI EventSubscription
Terminal window
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Checklist

Section titled “Checklist”
[ ] import/IAT triage tamam
[ ] inject/network/crypto kümeleri işaretlendi
[ ] runtime argümanlar yakalandı
[ ] C2/persist yolu belgelendi