Analysis of a vac module
FileSize: 58,880 Bytes
.text hash: 0x59DC680
Number of scans: 4
TimeDateStamp: 0x564B49A8h Tue Nov 17 15:37:12 2015
Scan Number 2.
For those of you curious about part one.
It was a analysis of the first scan of this module in which it stored the modules of a target process.
Just another heads up:
For anyone interested, I run lionsneck.com and use my knowledge of vac to keep my builds undetected.
The second scan calls EnumProcesses to get up to 500 process ids.
It then passes the ids into a subroutine that decrypts the xored string:
into
Once decrypted it passes the handle to ntdll.dll and the function name to GetProcAddress to get the function pointer.
If the pointer is valid, it calls NtQuerySystemInformation in a loop passing SystemHandleInformation and a buffer from VirtualAlloc.
While the NTSTATUS of the call is STATUS_INFO_LENGTH_MISMATCH it calls VirtualFree on the buffer allocated and Reallocates it with a increased size of 0x100000 bytes. If there are no open handles from the received buffer, it calls GetLastError and returns.
After all the calls are successful, it iterates through the handles comparing them to a last process id. It starts with the process id of 1 so there will always be at least 1 hidden process id counted.
As it iterates the handles, it checks the process id associated with the handle to that of the ids return from EnumProcesses. If it finds a process id that has a open handle but isn't returned in EnumProcesses. It appends the process id to the process id buffer up to 500 ids.
This method essentially finds PIDs of hidden processes.
Lastly the subroutine frees the handle buffer with VirtualFree.
Next the scan iterates all the process ids including the hidden process ids and opens a handle to them with OpenProcess with the flags PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_DUP_HANDLE. The bare minimum needed for querying information about the processes.
Once open, it calls GetProcessImageFileName to obtain the full path of the main executable module.
Immediately after it calls GetProcessTimes and stores the creation time.
Since it has everything it needs, it calls CloseHandle to free the handle it just opened.
Then the scan checks the length of the image path and separates the image name from its path.
It does a quick hash on the image name and its path separately using this method:
Once hashed, it stores the image name, path, and both hashes into buffer up to 0x4000 bytes.
tl;dr This scan gets the file name and path of all processes, including hidden ones.
I'm glad to provide any info on vac and I hope it was educational for you guys
FileSize: 58,880 Bytes
.text hash: 0x59DC680
Number of scans: 4
TimeDateStamp: 0x564B49A8h Tue Nov 17 15:37:12 2015
Scan Number 2.
For those of you curious about part one.
It was a analysis of the first scan of this module in which it stored the modules of a target process.
Just another heads up:
For anyone interested, I run lionsneck.com and use my knowledge of vac to keep my builds undetected.
The second scan calls EnumProcesses to get up to 500 process ids.
It then passes the ids into a subroutine that decrypts the xored string:
Quote:"\x10*\x0F+;,'\r'-*;3\x17081,3?*710"
into
Quote:NtQuerySystemInformation
Once decrypted it passes the handle to ntdll.dll and the function name to GetProcAddress to get the function pointer.
If the pointer is valid, it calls NtQuerySystemInformation in a loop passing SystemHandleInformation and a buffer from VirtualAlloc.
While the NTSTATUS of the call is STATUS_INFO_LENGTH_MISMATCH it calls VirtualFree on the buffer allocated and Reallocates it with a increased size of 0x100000 bytes. If there are no open handles from the received buffer, it calls GetLastError and returns.
After all the calls are successful, it iterates through the handles comparing them to a last process id. It starts with the process id of 1 so there will always be at least 1 hidden process id counted.
As it iterates the handles, it checks the process id associated with the handle to that of the ids return from EnumProcesses. If it finds a process id that has a open handle but isn't returned in EnumProcesses. It appends the process id to the process id buffer up to 500 ids.
This method essentially finds PIDs of hidden processes.
Lastly the subroutine frees the handle buffer with VirtualFree.
Next the scan iterates all the process ids including the hidden process ids and opens a handle to them with OpenProcess with the flags PROCESS_QUERY_LIMITED_INFORMATION and PROCESS_DUP_HANDLE. The bare minimum needed for querying information about the processes.
Once open, it calls GetProcessImageFileName to obtain the full path of the main executable module.
Immediately after it calls GetProcessTimes and stores the creation time.
Since it has everything it needs, it calls CloseHandle to free the handle it just opened.
Then the scan checks the length of the image path and separates the image name from its path.
It does a quick hash on the image name and its path separately using this method:
Code
int __cdecl HashString(char *szInput, int iInputLength)
{
int iCount; // edx@1
int result; // eax@1
char *szTemp; // esi@2
iCount = iInputLength;
result = 0x45D71892;
if ( iInputLength )
{
szTemp = szInput;
do
{
result = ((unsigned __int8)*szTemp++ | 0x20) + 0x21 * result;
--iCount;
}
while ( iCount );
}
return result;
}Once hashed, it stores the image name, path, and both hashes into buffer up to 0x4000 bytes.
tl;dr This scan gets the file name and path of all processes, including hidden ones.
I'm glad to provide any info on vac and I hope it was educational for you guys
