3

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).

Even if I suspend all threads, it does the following: When a new remote thread is created(CreateRemoteThread / ZwCreateThread) (internally calling CreateThread is ok) it patches a 0xC3(ret) to the entry point.

I tried suspending it on creation then resuming it later but as soon as it is resumed the entry point gets patched before it can execute.

I've looked at hooks in PCHunter, there is no hooks in unnamed functions or thread related functions.

IDA Pro isn't helping much, the process is obfuscated a lot.

I don't know what should be the next step at this point, so I'm hoping someone can help me figure this out.

It looks like a hook or a callback is set somewhere but I don't know of any callback that gets executed on thread creation(at least in usermode) and I can't seem to find any hook related to threads in windows dll's.

Improve this question
4
  • Why don't you use kernel mode debugger?
    – Anton Kukoba
    Jun 26, 2018 at 8:30
  • You write "Ida Pro isn't helping much..". Do you get Ida attached or are you able to run under Ida?
    – josh
    Jun 26, 2018 at 10:50
  • Process is x64 so I can't attach IDA's debugger on it. Kernel mode debugger was also detected. Managed to modify an existing thread entry point to run another thread's entry point to get around this.
    – David
    Jun 27, 2018 at 3:40
  • tls callback might help you.
    – sudhackar
    Jul 5, 2018 at 8:04

1 Answer 1

Reset to default
1

The act of injecting a thread will trigger a call to any Thread Local Storage callbacks which the PE file might carry, even when all other threads are suspended. Such a callback might be responsible for overwriting your thread code, since the callback has access to the important thread information such as its entry-point.

Improve this answer
3
  • I seem to recall there was a vulnerability in IDA some time ago connected to the TLS callbacks.
    – 0xC0000022L ♦
    Jul 2, 2018 at 10:32
  • How would they access the entry point of the thread? The target is obfuscated and I can't seem to figure out much of their callback, also tried making a test program with a TLS callback, I can't seem to get the entry point with the args or GetThreadContext (Rcx is a negative value)
    – David
    Jul 11, 2018 at 0:24
  • the callback runs within the same process-space as the just-created thread. Then it's just a matter of the callback calling NtQueryInformationThread to ask for the thread's entrypoint, then calling VirtualProtect(exec+write) on that address, and finally overwriting the entrypoint code with the RET.
    – peter ferrie
    Jul 14, 2018 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.