I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does the following:
When a new remote thread is created(
ZwCreateThread) (internally calling
CreateThread is ok) it patches a
0xC3(ret) to the entry point.
I tried suspending it on creation then resuming it later but as soon as it is resumed the entry point gets patched before it can execute.
I've looked at hooks in PCHunter, there is no hooks in unnamed functions or thread related functions.
IDA Pro isn't helping much, the process is obfuscated a lot.
I don't know what should be the next step at this point, so I'm hoping someone can help me figure this out.
It looks like a hook or a callback is set somewhere but I don't know of any callback that gets executed on thread creation(at least in usermode) and I can't seem to find any hook related to threads in windows dll's.