2

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , but this process hollowing doesn't call to that Api.

This is the exactly what happens:

  • CreateProcessA: creates a new process and the process creation flag 0x00000004 is used to create the process in the suspended state

    • ReadProcessMemory: reads image base of the suspended process

    • NtCreateSection: creates two read/write/execute sections

    • ZwMapViewOfSection: maps the read/write/execute sections into the malware’s address space

    • ZwMapViewOfSection: maps the second section into the suspended process’s address space (this section is therefore shared between both processes).

    • ReadProcessMemory: reads image base of the suspended process’s image into section 1

    • ReadProcessMemory: reads image base of the malware’s image into section 2

    • NtMapViewOfSection: overwrites the suspended process's entry point code by mapping section 1 to the new process base address

    • ResumeThread: resumes the thread of the suspended process executing the injected code

Knowing this, and due english its my not maternal language and there are too much technical words... which call of the apis above should I have a look to find the EP? Probably the last NtMapViewOfSection ?

1

The technique you described above is known as "dynamic forking" or "process hollowing".

You can find the entry point of the child process by following the steps described in https://reverseengineering.stackexchange.com/a/8431/1562, though I'd recommend setting a breakpoint on NtSetContextThread() instead of on SetThreadContext() since the malware may skip the latter and instead directly call the former.

  • 1
    I don't have any call to that API, what's more the process I have its like that appears in here: lexsi.com/securityhub/overview-kronos-banking-malware-rootkit/… After creating the process with CreateProcessInternalW there are calls to the API's I posted , and finally this ones: CreateThreadEx Calling NtResumeThread() to run the new process. maybe Im missing something ? – Peterlagunas Apr 23 '16 at 16:49
  • Great, then the "entry point" is likely the lpStartAddress parameter passed to CreateThreadEx(). – Jason Geffner Apr 24 '16 at 20:04
  • Thank you for replaying. The 5th argument points me to nowhere As you can see here imgur.com/Nd3Iwze, those are the parameters and that direction doesn't even exist in my memory map. I'm sorry for failing over and over again and probably bugging you but I really need to get through this – Peterlagunas Apr 26 '16 at 2:56
  • Okay, about the last comment, I imaginated that I couldn't access cause of a kind of protection ? Because as I have readed again the post you told me , it appears as I have not rights to enter in the memory of the process. So my new question is some of the API's before could protect it? Where would you recommend me to take a look ? and thank you so much again – Peterlagunas Apr 26 '16 at 3:11
  • 1
    Thank you very much!!! I have dumped it already :) thank you again ! – Peterlagunas Apr 26 '16 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.