SlideShare a Scribd company logo

Process injection - Malware style

•
•
Sander Demeester
Sander Demeester

As computer systems become more sophisticated, process injection techniques also evolve. These techniques are notorious for their use by "malicious software" to hide code execution and avoid detection. In this presentation we dive deep into the Windows runtime and we demonstrate these techniques. Besides, we also learn how to code construction and design patterns that relate to perform hidden code can recognize.

1 of 51
Download to read offline
Process Injection Malware style
Who am I • Security Researcher • PwC: Consultant • Former student UGent • {@ -F-G}/SanderDemeester
Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
Windows PE • It’s a file format! • It contains information about the executable • It’s THE windows format for all executables • DLL • EXE • SYS
• Imports - Functions from other libraries • Exports - Functions that should be called • NT Headers - used by windows loader • Sections - .text, .rdata, .data,… • Relocations - Preferred base address • Resources - Strings, icons, … • Much more..
PE - A short demo
What is a process? • It’s the execution of a program • One or more threads run in the context of a process • Thread - Conceptually, an execution unit inside the process
Process as a structure • Fine.. A process is a thing that runs in the system.. • The OS uses different kernel structures to manage those processes • Remember, a process believes it has the whole adres space to It’s self..
EPROCESS • Executive component of windows kernel • It's a process object for a process • Kernel use: IO transfer, handle virtual memory • Drivers: PsGetCurrentProcess()
PEB • Structure in userspace • Used by operating system code in user-space (ntdll,kernel32) • Contains information about a running process • CLI parameters, pointer to heap,image base address • A pointer to PEB_LDR_DATA
PEB_LDR_DATA • Contains information about the loaded modules associated with the running process • Has the anchor for a doubly linked list that contains each loaded module • LDR_DATA_TABLE_ENTRY
TIB • Stores information about the current thread • Can be obtained via the FS or GS registers • Used to obtain information about the running thread • Things like the SEH, stack base • Access to the thread local storage array
PEB,TIB - A short demo
So…What does this mean? • Different windows components need to interact with the process • Windows API’s need to provide access to that information
Process in memory • There is something called virtual memory • Maps memory addresses into physical addresses, the virtual memory address space • A collection of contiguous segments • Each process thinks.. It's all mine
Virtual memory - A short demo
Virtual memory • Mapping virtual memory addresses into physical addresses • Base relocation: Fixing memory locations at load time. • Relative virtual addresses or RVA • Just made the job of the loader easier • Three types of “addresses” • Logical addresses: perspective of the running process • Linear addresses: logical addresses after segment translation • Physical addresses: linear addresses after page table translation
Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
Injection.. Why? • We would like to hide the fact that we are running code • Makes deployment a lot easier • Bypass certain security filters
DLL Injection • Force a different process to load a DLL at runtime • Use the windows API • The OS automatically calls the DLLMain function • DLL inherits the same rights as the target process • Everything the malicious code does will appear to come from the injected process
DLL Injection - Why? • Everything the malicious code does will appear to come from the injected process • It inherits all the permissions of the process • Read from that process virtual memory
DLL Injection - Demo
DLL injection steps • The loader obtains a handle to the victim process • Most often uses CreateToolhelp32snapshot, Process32First and Process32Next • Obtain the Process ID • Obtain the handle to the process
DLL injection steps • Make room to create a new thread • Allocate enough memory in the victims process for the DLL name • Write only the name to the virtual memory of our victim • Obtain a module handle to LoadLibraryA
DLL injection steps • The CreateRemoteThread is used to open and execute a thread in the victims process • The CreateRemoteThread is passed three parameters • hProcess - process handle • lpStartAddress - starting point of the code for our new thread, in our case. LoadLibraryA • lpParameter - argument for the new thread
DLL Injection - code constructs
Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
Process replacement - Why? • Disguise malware as a legit process • Can not crash the host process and risk being discovered • Same permissions as the replaced process
Process replacement • Processes are just bytes in memory • Overwrite the memory space of our victim process • Disguises our code as a legitimate process • Inherit all the permissions of the replaced process
Process replacement - How would we do it? • Create a process in a suspended state • Replace all the code and memory in the process with our code • Run the process • Easy!
Process replacement - A short demo
What do we need? • We need a different “process” to replace the existing one? • A way to “stop” a legitimate process that is running? • A lot of information on the legitimate process • Ways to write into the virtual memory of a different process? • A brain that works
Windows resources • A program contains “resources” • Contains raw images, bitmaps and dialog boxes • But it can contain what we want? • Steganography? Anyone? • Lets put a PE in it!
Resource hacker - A short demo
• Create a new process in a SUSPENDED_STATE
Process replacement steps • Obtain our PE file stored in the resource section • Create a new windows process in the suspended state • Access the “thread context” of the suspended progress thread. • The EBX register of newly created process contains a pointer to the PEB structure
Process replacement steps • The PEB structure contains a lot of information about the process, including the image base address. • Using an “undocumented" API call NtUnmapViewOfSection we can remove the code from memory • Windows Native System Services routine - use a function pointer to get to it.
• We need to place our malicious PE file into memory • Obtain the image base address and the size of our program • Call VirtualAllocEx and pass it the handle of our suspended thread and set the permissions of the allocated memory to PAGE_EXECUTE_READWRITE
• So far so good • Start parsing the PE file to obtain pointers to the different section • SizeOfHeaders is at some offset in the PE header • NumberOfSections is at some offset in the PE header • Copy the PE header to the exact same place in the virtual adres space as the suspended process • Read the IMAGE_HEADER_SECTION and perform some pointer calculations
• Keep going.. • Using the structures • IMAGE_SECTION_HEADERS.SizeOfRawData • IMAGE_SECTION_HEADERS.PointerToRawData • IMAGE_SECTION_HEADER.VirtualAddress • We perform pointer calculations to copy the data over
Are we done yet? • The windows loader has done most of the work • We need to tell the loader where it should jump to • Patch the original program entry point with the one from our PE file • After loading, lpContext->_eax contains our OEP • Call SetThreadContext to update the thread context • Start of suspended process
Process replacement - code constructs
Is this still the same process? • How do you define a process? • As far as windows is concerned, it’s what It's loaded into memory • Using the API to observe the process, it is the original process
Can we detect this? • We can monitor for a sequence of strange API calls? • We can compare the code sections of the running process with the ones stored on the filesystem • We can define rules on how a program should behave and compare
What other techniques do we have? • Direct injection • Local and remote hook injection • Detour hijacking • APC injection from user space and kernel space • I’m sure, many more.
BSidesLV 2015 • Injection on Steroids: Code-less code injection and 0-day techniques.. • State-of-the-art
(*(*FNPTR) (LPVOID,*char)) (QUESTIONS,”?”)
Process injection - Malware style

Recommended

Windows internals Essentials
Windows internals EssentialsWindows internals Essentials
Windows internals Essentials
John Ombagi
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Windows PowerShell
Windows PowerShellWindows PowerShell
Windows PowerShell
Sandun Perera
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning
Cysinfo Cyber Security Community
 
Windows internals
Windows internalsWindows internals
Windows internals
Piyush Jain
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
Will Schroeder
 
Hunting malware with volatility v2.0
Hunting malware with volatility v2.0Hunting malware with volatility v2.0
Hunting malware with volatility v2.0
Frank Boldewin
 
Kheirkhabarov24052017_phdays7
Kheirkhabarov24052017_phdays7Kheirkhabarov24052017_phdays7
Kheirkhabarov24052017_phdays7
Teymur Kheirkhabarov
 

Recommended

Windows internals Essentials
Windows internals EssentialsWindows internals Essentials
Windows internals Essentials
John Ombagi
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
Windows PowerShell
Windows PowerShellWindows PowerShell
Windows PowerShell
Sandun Perera
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning
Cysinfo Cyber Security Community
 
Windows internals
Windows internalsWindows internals
Windows internals
Piyush Jain
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
Will Schroeder
 
Hunting malware with volatility v2.0
Hunting malware with volatility v2.0Hunting malware with volatility v2.0
Hunting malware with volatility v2.0
Frank Boldewin
 
Kheirkhabarov24052017_phdays7
Kheirkhabarov24052017_phdays7Kheirkhabarov24052017_phdays7
Kheirkhabarov24052017_phdays7
Teymur Kheirkhabarov
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
Paul Melson
 
CNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbgCNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbg
Sam Bowne
 
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Sam Bowne
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder
 
CNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
Sam Bowne
 
Practical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
Sam Bowne
 
Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging
Sam Bowne
 
Practical Malware Analysis Ch13
Practical Malware Analysis Ch13Practical Malware Analysis Ch13
Practical Malware Analysis Ch13
Sam Bowne
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Teymur Kheirkhabarov
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
Will Schroeder
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Windows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsWindows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary Artefacts
Brent Muir
 
Oscp - Journey
Oscp - JourneyOscp - Journey
Oscp - Journey
Vandana Verma
 
Lateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your NetworkLateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your Network
EC-Council
 
Feature Engineering for NLP
Feature Engineering for NLPFeature Engineering for NLP
Feature Engineering for NLP
Bill Liu
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
CNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic DuplicationCNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic Duplication
Sam Bowne
 
How to find_vulnerability_in_software
How to find_vulnerability_in_softwareHow to find_vulnerability_in_software
How to find_vulnerability_in_software
sanghwan ahn
 
CNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware LaunchingCNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware Launching
Sam Bowne
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
Joe Desimone
 

More Related Content

What's hot

Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
Paul Melson
 
CNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbgCNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbg
Sam Bowne
 
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Sam Bowne
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder
 
CNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
Sam Bowne
 
Practical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
Sam Bowne
 
Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging
Sam Bowne
 
Practical Malware Analysis Ch13
Practical Malware Analysis Ch13Practical Malware Analysis Ch13
Practical Malware Analysis Ch13
Sam Bowne
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
Teymur Kheirkhabarov
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
Will Schroeder
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
GIBIN JOHN
 
Windows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsWindows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary Artefacts
Brent Muir
 
Oscp - Journey
Oscp - JourneyOscp - Journey
Oscp - Journey
Vandana Verma
 
Lateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your NetworkLateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your Network
EC-Council
 
Feature Engineering for NLP
Feature Engineering for NLPFeature Engineering for NLP
Feature Engineering for NLP
Bill Liu
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo
 
CNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic DuplicationCNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic Duplication
Sam Bowne
 
How to find_vulnerability_in_software
How to find_vulnerability_in_softwareHow to find_vulnerability_in_software
How to find_vulnerability_in_software
sanghwan ahn
 

What's hot (20)

Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
 
CNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbgCNIT 126: 10: Kernel Debugging with WinDbg
CNIT 126: 10: Kernel Debugging with WinDbg
 
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
 
CNIT 126 11. Malware Behavior
CNIT 126 11. Malware BehaviorCNIT 126 11. Malware Behavior
CNIT 126 11. Malware Behavior
 
Practical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware BehaviorPractical Malware Analysis: Ch 11: Malware Behavior
Practical Malware Analysis: Ch 11: Malware Behavior
 
Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging Practical Malware Analysis: Ch 8: Debugging
Practical Malware Analysis: Ch 8: Debugging
 
Practical Malware Analysis Ch13
Practical Malware Analysis Ch13Practical Malware Analysis Ch13
Practical Malware Analysis Ch13
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
Windows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary ArtefactsWindows 10 Forensics: OS Evidentiary Artefacts
Windows 10 Forensics: OS Evidentiary Artefacts
 
Oscp - Journey
Oscp - JourneyOscp - Journey
Oscp - Journey
 
Lateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your NetworkLateral Movement: How attackers quietly traverse your Network
Lateral Movement: How attackers quietly traverse your Network
 
Feature Engineering for NLP
Feature Engineering for NLPFeature Engineering for NLP
Feature Engineering for NLP
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
CNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic DuplicationCNIT 152 8. Forensic Duplication
CNIT 152 8. Forensic Duplication
 
How to find_vulnerability_in_software
How to find_vulnerability_in_softwareHow to find_vulnerability_in_software
How to find_vulnerability_in_software
 

Similar to Process injection - Malware style

CNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware LaunchingCNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware Launching
Sam Bowne
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
Joe Desimone
 
Threads in Operating System | Multithreading | Interprocess Communication
Threads in Operating System | Multithreading | Interprocess CommunicationThreads in Operating System | Multithreading | Interprocess Communication
Threads in Operating System | Multithreading | Interprocess Communication
Shivam Mitra
 
OS Internals and Portable Executable File Format
OS Internals and Portable Executable File FormatOS Internals and Portable Executable File Format
OS Internals and Portable Executable File Format
Aitezaz Mohsin
 
CNIT 126 7: Analyzing Malicious Windows Programs
CNIT 126 7: Analyzing Malicious Windows ProgramsCNIT 126 7: Analyzing Malicious Windows Programs
CNIT 126 7: Analyzing Malicious Windows Programs
Sam Bowne
 
Chapter -2 operating system presentation
Chapter -2 operating system presentationChapter -2 operating system presentation
Chapter -2 operating system presentation
chnrketan
 
CNIT 126 Ch 7: Analyzing Malicious Windows Programs
CNIT 126 Ch 7: Analyzing Malicious Windows ProgramsCNIT 126 Ch 7: Analyzing Malicious Windows Programs
CNIT 126 Ch 7: Analyzing Malicious Windows Programs
Sam Bowne
 
Operating Systems 1 (7/12) - Threads
Operating Systems 1 (7/12) - ThreadsOperating Systems 1 (7/12) - Threads
Operating Systems 1 (7/12) - Threads
Peter Tröger
 
They why behind php frameworks
They why behind php frameworksThey why behind php frameworks
They why behind php frameworks
Kirk Madera
 
Utilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino APIUtilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino API
Oliver Busse
 
Course 102: Lecture 18: Process Life Cycle
Course 102: Lecture 18: Process Life CycleCourse 102: Lecture 18: Process Life Cycle
Course 102: Lecture 18: Process Life Cycle
Ahmed El-Arabawy
 
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
Tech in Asia ID
 
44CON 2014 - Meterpreter Internals, OJ Reeves
44CON 2014 - Meterpreter Internals, OJ Reeves44CON 2014 - Meterpreter Internals, OJ Reeves
44CON 2014 - Meterpreter Internals, OJ Reeves
44CON
 
Practical Malware Analysis Ch12
Practical Malware Analysis Ch12Practical Malware Analysis Ch12
Practical Malware Analysis Ch12
Sam Bowne
 
Powering up on PowerShell - BSides Greenville 2019
Powering up on PowerShell - BSides Greenville 2019Powering up on PowerShell - BSides Greenville 2019
Powering up on PowerShell - BSides Greenville 2019
Fernando Tomlinson, CISSP, MBA
 
Utilizing the open ntf domino api
Utilizing the open ntf domino apiUtilizing the open ntf domino api
Utilizing the open ntf domino api
Oliver Busse
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
midnite_runr
 
Utilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino APIUtilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino API
Oliver Busse
 
Php internal architecture
Php internal architecturePhp internal architecture
Php internal architecture
Elizabeth Smith
 
Yapc10 Cdt World Domination
Yapc10 Cdt World DominationYapc10 Cdt World Domination
Yapc10 Cdt World DominationcPanel
 

Similar to Process injection - Malware style (20)

CNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware LaunchingCNIT 126 12: Covert Malware Launching
CNIT 126 12: Covert Malware Launching
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
 
Threads in Operating System | Multithreading | Interprocess Communication
Threads in Operating System | Multithreading | Interprocess CommunicationThreads in Operating System | Multithreading | Interprocess Communication
Threads in Operating System | Multithreading | Interprocess Communication
 
OS Internals and Portable Executable File Format
OS Internals and Portable Executable File FormatOS Internals and Portable Executable File Format
OS Internals and Portable Executable File Format
 
CNIT 126 7: Analyzing Malicious Windows Programs
CNIT 126 7: Analyzing Malicious Windows ProgramsCNIT 126 7: Analyzing Malicious Windows Programs
CNIT 126 7: Analyzing Malicious Windows Programs
 
Chapter -2 operating system presentation
Chapter -2 operating system presentationChapter -2 operating system presentation
Chapter -2 operating system presentation
 
CNIT 126 Ch 7: Analyzing Malicious Windows Programs
CNIT 126 Ch 7: Analyzing Malicious Windows ProgramsCNIT 126 Ch 7: Analyzing Malicious Windows Programs
CNIT 126 Ch 7: Analyzing Malicious Windows Programs
 
Operating Systems 1 (7/12) - Threads
Operating Systems 1 (7/12) - ThreadsOperating Systems 1 (7/12) - Threads
Operating Systems 1 (7/12) - Threads
 
They why behind php frameworks
They why behind php frameworksThey why behind php frameworks
They why behind php frameworks
 
Utilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino APIUtilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino API
 
Course 102: Lecture 18: Process Life Cycle
Course 102: Lecture 18: Process Life CycleCourse 102: Lecture 18: Process Life Cycle
Course 102: Lecture 18: Process Life Cycle
 
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
"You Don't Know NODE.JS" by Hengki Mardongan Sihombing (Urbanhire)
 
44CON 2014 - Meterpreter Internals, OJ Reeves
44CON 2014 - Meterpreter Internals, OJ Reeves44CON 2014 - Meterpreter Internals, OJ Reeves
44CON 2014 - Meterpreter Internals, OJ Reeves
 
Practical Malware Analysis Ch12
Practical Malware Analysis Ch12Practical Malware Analysis Ch12
Practical Malware Analysis Ch12
 
Powering up on PowerShell - BSides Greenville 2019
Powering up on PowerShell - BSides Greenville 2019Powering up on PowerShell - BSides Greenville 2019
Powering up on PowerShell - BSides Greenville 2019
 
Utilizing the open ntf domino api
Utilizing the open ntf domino apiUtilizing the open ntf domino api
Utilizing the open ntf domino api
 
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
Patching Windows Executables with the Backdoor Factory | DerbyCon 2013
 
Utilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino APIUtilizing the OpenNTF Domino API
Utilizing the OpenNTF Domino API
 
Php internal architecture
Php internal architecturePhp internal architecture
Php internal architecture
 
Yapc10 Cdt World Domination
Yapc10 Cdt World DominationYapc10 Cdt World Domination
Yapc10 Cdt World Domination
 

Recently uploaded

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Thierry Lestable
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
Thijs Feryn
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Tobias Schneck
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 

Recently uploaded (20)

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 

Process injection - Malware style

  • 2. Who am I • Security Researcher • PwC: Consultant • Former student UGent • {@ -F-G}/SanderDemeester
  • 3. Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
  • 4. Windows PE • It’s a file format! • It contains information about the executable • It’s THE windows format for all executables • DLL • EXE • SYS
  • 5. • Imports - Functions from other libraries • Exports - Functions that should be called • NT Headers - used by windows loader • Sections - .text, .rdata, .data,… • Relocations - Preferred base address • Resources - Strings, icons, … • Much more..
  • 6. PE - A short demo
  • 7. What is a process? • It’s the execution of a program • One or more threads run in the context of a process • Thread - Conceptually, an execution unit inside the process
  • 8. Process as a structure • Fine.. A process is a thing that runs in the system.. • The OS uses different kernel structures to manage those processes • Remember, a process believes it has the whole adres space to It’s self..
  • 9.
  • 10. EPROCESS • Executive component of windows kernel • It's a process object for a process • Kernel use: IO transfer, handle virtual memory • Drivers: PsGetCurrentProcess()
  • 11. PEB • Structure in userspace • Used by operating system code in user-space (ntdll,kernel32) • Contains information about a running process • CLI parameters, pointer to heap,image base address • A pointer to PEB_LDR_DATA
  • 12. PEB_LDR_DATA • Contains information about the loaded modules associated with the running process • Has the anchor for a doubly linked list that contains each loaded module • LDR_DATA_TABLE_ENTRY
  • 13. TIB • Stores information about the current thread • Can be obtained via the FS or GS registers • Used to obtain information about the running thread • Things like the SEH, stack base • Access to the thread local storage array
  • 14. PEB,TIB - A short demo
  • 15. So…What does this mean? • Different windows components need to interact with the process • Windows API’s need to provide access to that information
  • 16. Process in memory • There is something called virtual memory • Maps memory addresses into physical addresses, the virtual memory address space • A collection of contiguous segments • Each process thinks.. It's all mine
  • 17.
  • 18. Virtual memory - A short demo
  • 19. Virtual memory • Mapping virtual memory addresses into physical addresses • Base relocation: Fixing memory locations at load time. • Relative virtual addresses or RVA • Just made the job of the loader easier • Three types of “addresses” • Logical addresses: perspective of the running process • Linear addresses: logical addresses after segment translation • Physical addresses: linear addresses after page table translation
  • 20. Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
  • 21. Injection.. Why? • We would like to hide the fact that we are running code • Makes deployment a lot easier • Bypass certain security filters
  • 22. DLL Injection • Force a different process to load a DLL at runtime • Use the windows API • The OS automatically calls the DLLMain function • DLL inherits the same rights as the target process • Everything the malicious code does will appear to come from the injected process
  • 23. DLL Injection - Why? • Everything the malicious code does will appear to come from the injected process • It inherits all the permissions of the process • Read from that process virtual memory
  • 24.
  • 26. DLL injection steps • The loader obtains a handle to the victim process • Most often uses CreateToolhelp32snapshot, Process32First and Process32Next • Obtain the Process ID • Obtain the handle to the process
  • 27. DLL injection steps • Make room to create a new thread • Allocate enough memory in the victims process for the DLL name • Write only the name to the virtual memory of our victim • Obtain a module handle to LoadLibraryA
  • 28. DLL injection steps • The CreateRemoteThread is used to open and execute a thread in the victims process • The CreateRemoteThread is passed three parameters • hProcess - process handle • lpStartAddress - starting point of the code for our new thread, in our case. LoadLibraryA • lpParameter - argument for the new thread
  • 29. DLL Injection - code constructs
  • 30. Outline • Windows processes: An introduction • Dll Injection • Process replacement • Questions
  • 31. Process replacement - Why? • Disguise malware as a legit process • Can not crash the host process and risk being discovered • Same permissions as the replaced process
  • 32. Process replacement • Processes are just bytes in memory • Overwrite the memory space of our victim process • Disguises our code as a legitimate process • Inherit all the permissions of the replaced process
  • 33. Process replacement - How would we do it? • Create a process in a suspended state • Replace all the code and memory in the process with our code • Run the process • Easy!
  • 35. What do we need? • We need a different “process” to replace the existing one? • A way to “stop” a legitimate process that is running? • A lot of information on the legitimate process • Ways to write into the virtual memory of a different process? • A brain that works
  • 36. Windows resources • A program contains “resources” • Contains raw images, bitmaps and dialog boxes • But it can contain what we want? • Steganography? Anyone? • Lets put a PE in it!
  • 37. Resource hacker - A short demo
  • 38. • Create a new process in a SUSPENDED_STATE
  • 39. Process replacement steps • Obtain our PE file stored in the resource section • Create a new windows process in the suspended state • Access the “thread context” of the suspended progress thread. • The EBX register of newly created process contains a pointer to the PEB structure
  • 40. Process replacement steps • The PEB structure contains a lot of information about the process, including the image base address. • Using an “undocumented" API call NtUnmapViewOfSection we can remove the code from memory • Windows Native System Services routine - use a function pointer to get to it.
  • 41. • We need to place our malicious PE file into memory • Obtain the image base address and the size of our program • Call VirtualAllocEx and pass it the handle of our suspended thread and set the permissions of the allocated memory to PAGE_EXECUTE_READWRITE
  • 42. • So far so good • Start parsing the PE file to obtain pointers to the different section • SizeOfHeaders is at some offset in the PE header • NumberOfSections is at some offset in the PE header • Copy the PE header to the exact same place in the virtual adres space as the suspended process • Read the IMAGE_HEADER_SECTION and perform some pointer calculations
  • 43. • Keep going.. • Using the structures • IMAGE_SECTION_HEADERS.SizeOfRawData • IMAGE_SECTION_HEADERS.PointerToRawData • IMAGE_SECTION_HEADER.VirtualAddress • We perform pointer calculations to copy the data over
  • 44. Are we done yet? • The windows loader has done most of the work • We need to tell the loader where it should jump to • Patch the original program entry point with the one from our PE file • After loading, lpContext->_eax contains our OEP • Call SetThreadContext to update the thread context • Start of suspended process
  • 46. Is this still the same process? • How do you define a process? • As far as windows is concerned, it’s what It's loaded into memory • Using the API to observe the process, it is the original process
  • 47. Can we detect this? • We can monitor for a sequence of strange API calls? • We can compare the code sections of the running process with the ones stored on the filesystem • We can define rules on how a program should behave and compare
  • 48. What other techniques do we have? • Direct injection • Local and remote hook injection • Detour hijacking • APC injection from user space and kernel space • I’m sure, many more.
  • 49. BSidesLV 2015 • Injection on Steroids: Code-less code injection and 0-day techniques.. • State-of-the-art