The strings are in plain… correct me if i am wrong Figure 8. How is the malicious payload protected?īy analyzing the find resource function we will come across the following codes that suggests to us that the payload is XOR by “A”. IDA Pro further confirmed that this is the payload that will be extracted out. In the resource, we can see a suspicious looking payload. Create Suspended process, unmap memory Figure 4. This is a recipe for process hollowing technique in which the running process will look like svchost.exe (in this case) but it is actually running something else instead. It is trying to create a process in suspended state, calls UnmapViewOfSection to unmap the original code and tries to write process memory in it. How does the launcher program hide execution? Write file to practicalmalwareanalysis.log Figure 2. Malware reverse tools, GitBook Segurança. Please see here for more details about these tools and a complete list of tools used during malware analysis. It shows real-time file system, Registry and process/thread activity. Analyze the malware found in the file Lab12-02.exe.īased on dynamic analysis results using procmon and process explorer, we can conclude that this is a keylogger that performs process hollowing on svchost.exe. It is an advanced monitoring tool for Windows programs developed by Microsoft.

Process monitor malware analysis