Black Energy Driver

Documenting my research of Black Energy Driver, which is the loaded driver in the memory sample from "Malware Analyst Cookbook".
I was focusing integrating disassembling and Windows internals skill with memory forensics skills.

Background

Black Energy is a malware used to perform variety of attacks. It contains multiple plugins used to perform different attacks capabilities.
I used Volatility to preform all the analysis of the memory sample and I have find out that there is loaded driver used by the malware.
I was interesting about the key features of the Black Energy Driver and wanted to understand how can I perform static reverse engineering of the driver when I have only the memory dump.
I couldn't find any report or documentation about loaded driver so I decided to try by myself 😄

Memory forensics

I will skip this part because this is the well documented part. You can find lot of information and examples of investigating the Black Energy Driver using Volatility plugins.
I will go back to specific Volatility-plugins to fill the gap when I will dump the Black Energy Driver and start disassembling it.

Callbacks

After running callbacks plugin on the memory sample we can see strange module-name appear: 00004A2A.

The callbacks used by this module are: PsCreateThreadNotifyRoutine which can be used track and to notify the Driver whenever new Thread is created or terminated in the system.

Dump the driver

After finding indicator of suspicious module we can dump it and try finding it's logic using IDA.
Let's find the base address of the module by it's name using modscan plugins and grep:

We can use moddump to dump the module and perform further analysis using IDA:

After dumping the module we should rebasing the driver address layout as it was when it was running when the memory dump was taken.
Now we can load the module into IDA and perform rebasing to whole the module:

Now we can start disassembling the module and search for more insights 💪✌️

One more thing: IAT recovery

After fixing the address layout we can start reversing the module.
The reversing process will be very difficult because IDA won't recognized any import functions used by the module, because the IAT is "broken"
We can use a another Volatility plugin to to recover the IAT using volatility impscan plugin:

The output is very useful for our mission:
- IAT - represent address from the IAT directory of the module when is was running
- Function - The name of the import-function used in this address.
I was writing simple script using Python to convert the output of impscan to useful IDC script which we can use in IDA:

The script can be used as follow: impscam_to_idc.py <iat_dump> <recovery_output>
Let's look at the output (IDC script):

Let's load the output script and fix the IAT of the module:

Now we can see the recovered IAT and we can continue examining the module:

Now IDA can provide us all the useful features, such as XRefs, etc.

Using the recovered imports

TODO

Return to the callback routine

TODO

Dispatch routines

TODO

Custom import loading

TODO

avivshabtay / blackenergydriver Goto Github PK