3

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).

Even if I suspend all threads, it does the following: When a new remote thread is created(CreateRemoteThread / ZwCreateThread) (internally calling CreateThread is ok) it patches a 0xC3(ret) to the entry point.

I tried suspending it on creation then resuming it later but as soon as it is resumed the entry point gets patched before it can execute.

I've looked at hooks in PCHunter, there is no hooks in unnamed functions or thread related functions.

IDA Pro isn't helping much, the process is obfuscated a lot.

I don't know what should be the next step at this point, so I'm hoping someone can help me figure this out.

It looks like a hook or a callback is set somewhere but I don't know of any callback that gets executed on thread creation(at least in usermode) and I can't seem to find any hook related to threads in windows dll's.

  • Why don't you use kernel mode debugger? – Anton Kukoba Jun 26 '18 at 8:30
  • You write "Ida Pro isn't helping much..". Do you get Ida attached or are you able to run under Ida? – josh Jun 26 '18 at 10:50
  • Process is x64 so I can't attach IDA's debugger on it. Kernel mode debugger was also detected. Managed to modify an existing thread entry point to run another thread's entry point to get around this. – David Jun 27 '18 at 3:40
  • tls callback might help you. – sudhackar Jul 5 '18 at 8:04
1

The act of injecting a thread will trigger a call to any Thread Local Storage callbacks which the PE file might carry, even when all other threads are suspended. Such a callback might be responsible for overwriting your thread code, since the callback has access to the important thread information such as its entry-point.

  • I seem to recall there was a vulnerability in IDA some time ago connected to the TLS callbacks. – 0xC0000022L Jul 2 '18 at 10:32
  • How would they access the entry point of the thread? The target is obfuscated and I can't seem to figure out much of their callback, also tried making a test program with a TLS callback, I can't seem to get the entry point with the args or GetThreadContext (Rcx is a negative value) – David Jul 11 '18 at 0:24
  • the callback runs within the same process-space as the just-created thread. Then it's just a matter of the callback calling NtQueryInformationThread to ask for the thread's entrypoint, then calling VirtualProtect(exec+write) on that address, and finally overwriting the entrypoint code with the RET. – peter ferrie Jul 14 '18 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.