I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging process of the trainer in the video, when I am trying to debug the same malware on my system, I am not able to hit the same break points as him.
I am using x32Dbg for debugging.
The following are some examples of the issue -
- The API CreateProcessInternalW hits for him but never hits for me in any malware sample.
- The API WriteProcessMemory hits for him but never hits for me in any malware sample.
- On stepping over VirtualAlloc breakpoint, for him the API is VirtualAllocEx and for me its NtAllocateVirtualMemory
- On stepping over VirtualProtect breakpoint, for him the API is VirtualProtectEx and for me its zwprotectvirtualmemory
The following are the things I have tried -
- I have made sure that the tutor and me are running the same operating system (Windows 10)
- I have tried to use both 64bit and 32bit versions of Windows 10
- I have made sure I have the same malware sample as the malware samples are provided by the tutor himself and also I have verified the hash of the malware.
- I have made sure the difference is not being caused by a Anti-Analysis mechanism of the malware
- I have verified the above point by analysing the malware behaviour and found that the malware is being executed the same way as it is for him
- Like for one case for a malware, for the tutor the malware was using the CreateProcessInternalW API to call cmd.exe and drop a file in a directory, for me the API doesn't hit but the file is still dropped.
I am not sure what is causing this difference of API calls and trying to fix this issue.
Help would be appreciated.
