4

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.

I am going through a malware analysis course and following the debugging process of the trainer in the video, when I am trying to debug the same malware on my system, I am not able to hit the same break points as him.

I am using x32Dbg for debugging.

The following are some examples of the issue -

  • The API CreateProcessInternalW hits for him but never hits for me in any malware sample.
  • The API WriteProcessMemory hits for him but never hits for me in any malware sample.
  • On stepping over VirtualAlloc breakpoint, for him the API is VirtualAllocEx and for me its NtAllocateVirtualMemory
  • On stepping over VirtualProtect breakpoint, for him the API is VirtualProtectEx and for me its zwprotectvirtualmemory

The following are the things I have tried -

  • I have made sure that the tutor and me are running the same operating system (Windows 10)
  • I have tried to use both 64bit and 32bit versions of Windows 10
  • I have made sure I have the same malware sample as the malware samples are provided by the tutor himself and also I have verified the hash of the malware.
  • I have made sure the difference is not being caused by a Anti-Analysis mechanism of the malware
  • I have verified the above point by analysing the malware behaviour and found that the malware is being executed the same way as it is for him
  • Like for one case for a malware, for the tutor the malware was using the CreateProcessInternalW API to call cmd.exe and drop a file in a directory, for me the API doesn't hit but the file is still dropped.

I am not sure what is causing this difference of API calls and trying to fix this issue.

Help would be appreciated.

1
  • 1
    Is the trainer in the video using the same version of the debugger?
    – fpmurphy
    Apr 8, 2023 at 2:40

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.