1\ #MalwareAnalysis: Detecting Process Hollowing
The first pattern to look for are any calls to create processes in a suspended state:
> CreateProcessA
"dwCreationFlags" set 0x04 CREATE_SUSPENDED
Purpose is to disguise malicious code in a legit exe by replacing the contents.
The first pattern to look for are any calls to create processes in a suspended state:
> CreateProcessA
"dwCreationFlags" set 0x04 CREATE_SUSPENDED
Purpose is to disguise malicious code in a legit exe by replacing the contents.
2\ Following the process being started in a suspended state... (usually svchost.exe but who's counting). Then there are API calls to native/non native APIs:
> ZwUnmapviewofsection
> virtualallocex
> writeprocessmemory
> setthreadcontext
> NTgetcontextthread
> ntreadvirtualmemory
> ZwUnmapviewofsection
> virtualallocex
> writeprocessmemory
> setthreadcontext
> NTgetcontextthread
> ntreadvirtualmemory
3\ Other ones:
> NTResumethread
> NTwritevirtualmemory
> ntsetcontextthread
The logic is to look for signs of processes being started in suspended state - then the process being hollowed, replaced with "malicious" contents and resuming of execution.
> NTResumethread
> NTwritevirtualmemory
> ntsetcontextthread
The logic is to look for signs of processes being started in suspended state - then the process being hollowed, replaced with "malicious" contents and resuming of execution.
4\ Native APIs being the ones with Nt/Zw refer to this tweet
https://twitter.com/inversecos/status/1442356680130379778
• • •
Missing some Tweet in this thread? You can try to
force a refresh
