Dump a child process created by malware with an ALTERNATIVE process hollowing process

Question

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , but this process hollowing doesn't call to that Api.

This is the exactly what happens:

• CreateProcessA: creates a new process and the process creation flag 0x00000004 is used to create the process in the suspended state

  • ReadProcessMemory: reads image base of the suspended process

  • NtCreateSection: creates two read/write/execute sections

  • ZwMapViewOfSection: maps the read/write/execute sections into the malware’s address space

  • ZwMapViewOfSection: maps the second section into the suspended process’s address space (this section is therefore shared between both processes).

  • ReadProcessMemory: reads image base of the suspended process’s image into section 1

  • ReadProcessMemory: reads image base of the malware’s image into section 2

  • NtMapViewOfSection: overwrites the suspended process's entry point code by mapping section 1 to the new process base address

  • ResumeThread: resumes the thread of the suspended process executing the injected code

Knowing this, and due english its my not maternal language and there are too much technical words... which call of the apis above should I have a look to find the EP? Probably the last NtMapViewOfSection ?

Answer 1

The technique you described above is known as "dynamic forking" or "process hollowing".

You can find the entry point of the child process by following the steps described in https://reverseengineering.stackexchange.com/a/8431/1562, though I'd recommend setting a breakpoint on NtSetContextThread() instead of on SetThreadContext() since the malware may skip the latter and instead directly call the former.