How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

Question

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any method to analyze this child process using immunity debugger?

Answer 1

using ollgdbgv2's debug child processes feature

Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0.

One of the new features in ollydbg 2 is the Debug Child Processes feature shown here:

When this checkbox is on when you start debugging a process, a new instance of ollydbg will automatically start whenever the debugged process creates a new process. This cannot be nested though, as a process started/debugged that way is not started by ollydbg.

Catching the process creation

Additionally, you can search for all imported functions, go over them manually and add a breakpoint on each API used to create processes, there shouldn't be more than a few of those.

Then, just let the process run until it hits one of those breakpoints and make the API call create the process in a suspended state (look up the specific API's documentation for the specifics).

You won't be able to attach to the process (because it's suspended) until it's resumed by calling ResumeThread on the process single thread. there's a common trick here that involves several steps:

1. Create the process as suspended (The process you're debugging did that for you after you changed the parameters to the process creation API call appropriately).
2. Find the executable's entry point and take note of the two first bytes at that address.
3. Replace those bytes with the 2 byte representation of jmp $ (byte code is EB FE). This is an infinite loop as the instruction jumps to itself.
4. Resume the process.
5. Now that the process is "running" you can attach to it, suspend it, restore the original two bytes and run it.

Keep in mind that a process might be creating additional threads in the child process, and those might get past the suspension. Use at your own risk :)

There are ollydbg v1.1 plugins (which means immunity plugins) that will do that for you, but you'll have to find them because I can't recall the name. tuts4you.com is a good place to start.