Better information... Better health

 Lets check different  Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.

This stages are fully emulated well and can get the IOC and the behavior of the shellcode.

But lets see another first stage big shellcode with c runtime embedded in a second stage.

In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.

Here there are two types of allocations:

Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.

The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.

Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.

So we have second stage unpacked in alloc_e40064

With "mdd" we do a memory dump to disk we found the size in previous screenshot,  and we can do  some static reversing of stage2 in radare/ghidra/ida

In radare we can verify that the extracted is the next stage:

I usually do correlation between the emulation and ghidra, to understand the algorithms.

If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and  is calling the allocated buffer in 0x4f...

And this  stage2 perform several API calls let's check it in ghidra.

We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls

Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;

So lets say yes and continue the emulation.

Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected. 

Nevertheless the shellcode detects something and terminates the process.

Lets trace the branches to understand the logic:

target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'

Continuing the emulation it's setting the SEH  pointer to previous stage:

Related posts

1. Beginner Hacker Tools
2. Tools 4 Hack
3. Hacker Tools 2019
4. Hacker Search Tools
5. Hacking Tools For Windows
6. Pentest Reporting Tools
7. How To Make Hacking Tools
8. Hacker Tools Apk
9. Pentest Tools Subdomain
10. Hacker Tools 2019
11. Hacking Tools Windows 10
12. Hacker Tools Software
13. Github Hacking Tools
14. Hacker Tools For Pc
15. Hackers Toolbox
16. Hack Tools
17. Hack Tools Github
18. Nsa Hack Tools
19. Hack Tool Apk
20. Pentest Tools Github
21. Hack Tool Apk
22. Hacking Tools Windows
23. Hacker
24. Hack App
25. Hacking Tools For Windows 7
26. Hacking Tools Windows
27. Hacking Tools For Windows Free Download
28. Hack Tools
29. Hacker Tools
30. Hack Tools For Pc
31. Hacker
32. Pentest Reporting Tools
33. Pentest Tools Android
34. World No 1 Hacker Software
35. Pentest Tools For Windows
36. Pentest Tools Framework
37. Hack Tools Online
38. Hacker Tools 2019
39. Hack Tools For Ubuntu
40. Pentest Tools For Ubuntu
41. Hacking Tools For Windows 7
42. Hacker Tools Online
43. Hacker Tools Software
44. Hacker Tools Online
45. Nsa Hack Tools Download
46. Pentest Tools Url Fuzzer
47. Pentest Tools
48. Blackhat Hacker Tools
49. Hacking Tools Kit
50. Hack Tool Apk No Root
51. Nsa Hacker Tools
52. Hack Tools Pc
53. How To Hack
54. What Are Hacking Tools
55. Hack Tools For Pc
56. Pentest Tools Find Subdomains
57. What Are Hacking Tools
58. Hackrf Tools
59. Hacker Hardware Tools
60. Hacks And Tools
61. Pentest Tools Review
62. Pentest Tools Nmap
63. Hacker Tools For Ios
64. Easy Hack Tools
65. Hacker Tools For Pc
66. Tools 4 Hack
67. Easy Hack Tools
68. Pentest Box Tools Download