2 Antworten in diesem Thema

[LVArturs]

I have two questions.

First, is process hollowing still viable? I can get past ESET and Kaspersky, but Avast! Behaviour Shield always catches it, no matter what I do. Should I try RtlCreateUserProcess instead of CreateProcess? Maybe changing order, where viable, or using interchangeable Nt (or Zw) functions instead of some of the ones in this list:

    CreateProcess
    NtUnmapViewOfSection
    VirtualAllocEx
    WriteProcessMemory
    GetThreadContext
    SetThreadContext
    ResumeThread

 

Or is this a dead end, and I should venture in finding another method?

 

 

Second, autorun usually increases heuristic scores a lot (if I add autorun methods on top of process hollowing, then only ESET lets it through). Dropping an icon in the Startup folder seems somewhat less detectable than adding registry entries, but still not good enough. Are there alternative methods or should I look at other parts of code to decrease the score?

 

Thanks.

Bearbeitet von LVArturs, 10 May 2018 - 23:52 Uhr.

[gr33d]

I think the AVs hook the NtDll so it doesn't matter which API you use. You could try to selfinject and resolve all the imports, patch the imagebase and jmp to AddressOfEntryPoint.

 

That way you only need VirtualAlloc, LoadLibrary and GetProcAddress.

[LVArturs]

Yeah, I guess I could, but, embarassingly, I'm doing the hollowing from a managed process through pInvoke and stuff, so I don't know if self-injecting a native process from a managed one would work.

 

Okay, I'm hijacking my own thread and changing the topic slightly - say I'm launching a managed process from a managed one - that's easy and AV usually have no issue with this + autorun. But whenever it gets to actually running the payload, say a RAT, it is usually detected. How? My guess would be by how the RAT communicates back home. Could that be it? Because, before I start modifying sources or maybe even decompiling .NET RATs and their libraries and then editing, it would be nice to know what to look at. Or is there no general way detection is done, and I'm back to trial & error?