VM CPU usage at 100% when using ie URL analysis package

[seanthegeek]

Some recent change in the analysis package is causing CPU usage to stay at 100% without IE actually opening during a URL analysis with the ie package.

[kevoreilly]

Hi Sean, sorry not to get back to you earlier - are you still seeing this?

[seanthegeek]

Yes, I'm still seeing this after pulling the latest commit this morning

[seanthegeek]

@kevoreilly Bump

[seanthegeek]

Also occurs on your hosted instance. https://cape.contextis.com/analysis/87836/

[kevoreilly]

Hmm I just tried with old loader and it seemed to work. So possibly an issue with the new loader and IE. Let me look into it.

[seanthegeek]

@kevoreilly Have you had a chance to look at this?

[kevoreilly]

Yes I just spent a while digging into this and have found the problem is due to a monitor code change which was attempting to mitigate problems with IcedID samples caused by a measure put in to allow VBCrypter samples to run (kevoreilly/capemon@f4fe2d5).

I've just compiled a monitor reverting just this change and IE seems to load up again - please give the attached monitor a go and let me know.

I'm not sure how to best fix this whilst keeping compatability with VBCrypter samples - I'll need to speak to the researcher who made that mod in the first place and work out if there isn't a better way.

capemon.zip

[seanthegeek]

@kevoreilly My VMs are 64 bit. Can you build a 64 bit version?

[kevoreilly]

IE is 32-bit - even on 64-bit windoze ;-)

…

On Mon, 23 Sep 2019, 21:32 Sean Whalen, ***@***.***> wrote: @kevoreilly <https://github.com/kevoreilly> My VMs are 64 bit. Can you build a 64 bit version? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#333?email_source=notifications&email_token=AFJQY4CNLEEOGBSJF5ODJ7DQLERV3A5CNFSM4HG54XI2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7MFRJI#issuecomment-534272165>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFJQY4EBKQUGLGTRXMLTQQ3QLERV3ANCNFSM4HG54XIQ> .

[seanthegeek]

Seeing the same issue. It goes in analyzer/windows/dll/, right?

[kevoreilly]

Oh dear - no IE window?

[kevoreilly]

I'm gonna have to call it a night as it's getting late over here - but progress has been made, am hopeful we will nail this bug once we get to the bottom of it.