2

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:

  1. Being executed
  2. Decrypt a lot of data from memory and obtain a new PE (from memory)
  3. Create a child process in suspended state
  4. Dump the new data obtained into the Created child process
  5. SetThreadContext
  6. ResumeThread

Now one issue i was thinking about, is the fact i dont know what the EntryPoint is so i dont know what part of the memory bytes i would change to EB FE (JMP < ToSelf >) To be able to debug the process from the start

Once the new process is created and im attaching a debugger to it - OLLYDbg for that case (And the process is on Pause state) Pressing F8 - step over causing the application to have a huge delay of like 10 seconds untill the Opcode is finished - which makes no sense. Also if i watch the newly created process on Sysinternals - ProcessExplorer I can see that after i press F8 the CPU usage of that process is very high 50-90 for all that time, until the opcode is finished. Which also results in all of the computer to run very slowly

What could cause that? and how would i be able to bypass that?

It does not happen if i dont debug the process.

  • Have you changed EB FE back to the original opcodes? Instead of pressing F8 you can try to Resume All Threads. – 0xec Oct 4 '15 at 14:41
  • does attaching to a suspended child process succeed ? – blabb Oct 4 '15 at 20:02
  • @ExtremeCoders, Yes ofcourse i remembered. – RE-Beginner Oct 5 '15 at 1:21
  • @blabb, and yes it succeedes, basically OllyDbg creates a new thread for him self for debugging the process – RE-Beginner Oct 5 '15 at 1:21
  • oh ollydbg 2.01 resumes the thread from supended state when attaching to a suspended process i dont think that behaviour is a standard behaviour windbg or ollydbg 1.10 never succeded in attaching to a suspended process and that is how it should be i think well in such case you CANT resume from your parent thread i think and may cause inconsistent result i would bet – blabb Oct 5 '15 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.