3

I have a suspicious process. I found it by ProcessHacker's network tab.

ProcessHacker display the process as Unknown.

The process listening into a constant port number that's also not found by standard windows tools.

The process id also not found by standard windows tools.

Looking at Wireshark traffic, I see there is traffic going to two IPs in Russia.

I attempted to attach Frida into this process but Frida reports an error like below,

[Error: Unexpected error allocating memory in target process (VirtualAlloc returned 0x00000005)]

I've used both 64 bit and 32 bit versions of Frida but still same error.

10
  • Possibly the process is hooking functions from the Windows api, can you check if it has something low than the user level? currently taking into account Windows 10 it is not possible to hook to hide at the user level, however at the kernel level yes it is possible and yes the hacker process can detect because it has a kernel driver in its directory, only a kernel can detect a process hidden by a kernel, tell me if there is anything new or if my answer was useful, put there as a final answer.
    – 0x0A
    Apr 16 at 17:18
  • @0x0A The computer I suspected had malware earlier and I reinstalled Windows from scratch after then. Is this sign of a bootkit? OS is Windows 10 Server Edition. From what I found in the Internet, the bootkit usage is in decline.
    – jeffbRTC
    Apr 16 at 19:21
  • @0x0A I don't know what you mean by low. Can you elaborate?
    – jeffbRTC
    Apr 16 at 19:21
  • @0x0A The process is invisible in task manager and only visible in Process Hacker's network tab and when I click "Go to process" in the Process Hacker, nothing happen.
    – jeffbRTC
    Apr 16 at 19:24
  • About Bootkit / Rootkit depends on how you did the formatting of the operating system, rootkit is mod and bootkit are few that have enough knowledge to develop, referring to below I refer to the lowest part of the operating system in the theory of rings, where usermode is your manager and kernel would be a possible infected driver, about the task manager yes it is him I mean it is possible to use techniques to hide a process, a suggestion (if you want to remove that process) is to run an antivirus in boot mode operating system see kaspersky in boot.
    – 0x0A
    Apr 16 at 19:50
3

It's not a malware. It's cygwin's ssh-agent and it uses non existent PID as parent. I was able figure this out using a new version of ProcessHacker.

1
  • 1
    Parent probably was real but just exited at some point. Unlike Unix, that doesn’t lead to termination of child processes in Windows.
    – Igor Skochinsky
    Apr 17 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.