326 lines
12 KiB
Markdown
326 lines
12 KiB
Markdown
# Common Malware Indicators Reference
|
|
|
|
## Suspicious Import Functions
|
|
|
|
### Process Injection/Manipulation
|
|
- `CreateRemoteThread` - Inject code into another process
|
|
- `WriteProcessMemory` - Write to another process's memory
|
|
- `VirtualAllocEx` - Allocate memory in another process
|
|
- `OpenProcess` - Access another process
|
|
- `NtUnmapViewOfSection` - Process hollowing technique
|
|
- `SetThreadContext` - Modify thread execution
|
|
- `ResumeThread` - Resume suspended thread (often after injection)
|
|
- `QueueUserAPC` - APC injection technique
|
|
|
|
### Keylogging
|
|
- `SetWindowsHookEx` - Install keyboard hooks
|
|
- `GetAsyncKeyState` - Poll keyboard state
|
|
- `GetForegroundWindow` - Get active window title
|
|
- `GetKeyState` - Check key status
|
|
|
|
### Network Activity
|
|
- `InternetOpen` / `InternetOpenUrl` - WinINet HTTP requests
|
|
- `HttpSendRequest` - Send HTTP request
|
|
- `send` / `recv` - Raw socket communication
|
|
- `WSAStartup` - Initialize Winsock
|
|
- `connect` / `socket` - Network connections
|
|
- `URLDownloadToFile` - Download files from URLs
|
|
|
|
### Persistence Mechanisms
|
|
- `RegSetValueEx` / `RegCreateKeyEx` - Registry manipulation
|
|
- `CreateService` - Install Windows service
|
|
- `StartService` - Start service
|
|
- `ITaskService` / `ITaskFolder::RegisterTaskDefinition` - COM interfaces for scheduled task creation; `schtasks.exe /create` is the command-line equivalent
|
|
|
|
### Stealth/Anti-Analysis
|
|
- `IsDebuggerPresent` - Debugger detection
|
|
- `CheckRemoteDebuggerPresent` - Remote debugger check
|
|
- `NtQueryInformationProcess` - Process information (anti-debug)
|
|
- `GetTickCount` - Timing checks (anti-sandbox)
|
|
- `Sleep` - Delay execution (sandbox evasion)
|
|
- `FindWindow` - Look for analysis tools
|
|
|
|
### EDR/Telemetry Evasion
|
|
- `EtwEventWrite` / `NtTraceEvent` - ETW patching target; writing 0xC3 (ret) to prologue blinds EDR telemetry
|
|
- `AmsiScanBuffer` / `AmsiScanString` / `AmsiInitialize` - AMSI bypass targets; patched to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat
|
|
- `UpdateProcThreadAttribute` - PPID spoofing when called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
|
|
- `VirtualProtect` - Required before patching; look for calls targeting ntdll.dll or amsi.dll memory ranges
|
|
- `GetProcAddress` + `LoadLibrary` - Runtime API resolution to avoid static import evidence (common in syscall stubs)
|
|
|
|
### Callback-based Shellcode Execution
|
|
- `EnumChildWindows` / `EnumDesktopWindows` - Callback used as execution primitive instead of CreateThread
|
|
- `CreateTimerQueueTimer` - Timer callback used to invoke shellcode
|
|
- `TpAllocWork` / `TpPostWork` / `TpReleaseWork` - Threadpool callbacks for shellcode dispatch
|
|
- `SetTimer` / `EnumSystemLocales` / `EnumTimeFormatsEx` - Less common callback execution primitives
|
|
|
|
### File Manipulation
|
|
- `CreateFile` / `WriteFile` / `ReadFile` - File I/O
|
|
- `DeleteFile` - Delete files
|
|
- `MoveFile` / `CopyFile` - File operations
|
|
- `FindFirstFile` / `FindNextFile` - Directory enumeration
|
|
|
|
### Encryption/Encoding
|
|
- `CryptEncrypt` / `CryptDecrypt` - Data encryption
|
|
- `CryptAcquireContext` - Crypto provider setup
|
|
- `CryptGenKey` - Generate encryption keys
|
|
|
|
## Suspicious String Patterns
|
|
|
|
### Network Indicators
|
|
- Hardcoded IP addresses (especially RFC1918 or suspicious IPs)
|
|
- Domain names (especially newly registered or suspicious TLDs)
|
|
- URL patterns: `http://`, `https://`, `ftp://`
|
|
- Port numbers in strings (especially non-standard ports)
|
|
- User-Agent strings (especially custom/unusual ones)
|
|
- Email addresses (especially for data exfiltration)
|
|
|
|
### File Paths
|
|
- `%APPDATA%`, `%TEMP%`, `%LOCALAPPDATA%` - Common malware locations
|
|
- `\Microsoft\Windows\Start Menu\Programs\Startup\` - Persistence
|
|
- `C:\ProgramData\` - Hidden location
|
|
- Hidden folders: `$Recycle.Bin`, `System Volume Information`
|
|
|
|
### Registry Keys
|
|
**Persistence (Run Keys):**
|
|
- `Software\Microsoft\Windows\CurrentVersion\Run`
|
|
- `Software\Microsoft\Windows\CurrentVersion\RunOnce`
|
|
- `SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices`
|
|
|
|
**System Modification:**
|
|
- `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` (especially Userinit, Shell)
|
|
- `SYSTEM\CurrentControlSet\Services` - Service installation
|
|
- `SOFTWARE\Microsoft\Windows\CurrentVersion\policies` - Policy changes
|
|
|
|
### Commands and Scripts
|
|
- PowerShell indicators:
|
|
- `-EncodedCommand` - Base64 encoded commands
|
|
- `-ExecutionPolicy Bypass` - Bypass script restrictions
|
|
- `-WindowStyle Hidden` - Hide execution
|
|
- `DownloadString`, `DownloadFile` - Download payloads
|
|
- `IEX` (Invoke-Expression) - Execute code
|
|
|
|
- CMD indicators:
|
|
- `cmd.exe /c` - Execute command
|
|
- `schtasks` - Task scheduling
|
|
- `reg add` - Registry manipulation
|
|
- `netsh` - Network/firewall changes
|
|
- `wmic` - WMI commands
|
|
- `rundll32` - Execute DLL functions
|
|
|
|
### Encoding/Obfuscation
|
|
- Base64 encoded strings (check for padding: `==`)
|
|
- Hex encoded data
|
|
- XOR key patterns
|
|
- Reversed strings
|
|
- Unicode/wide character strings
|
|
|
|
### Cryptocurrency
|
|
- Bitcoin addresses (start with 1, 3, or bc1)
|
|
- Ethereum addresses (0x followed by 40 hex chars)
|
|
- Monero addresses
|
|
- Wallet-related terms: "wallet.dat", "cryptocurrency"
|
|
|
|
### Ransomware Indicators
|
|
- File extension strings: `.encrypted`, `.locked`, `.crypto`, etc.
|
|
- Ransom note filenames: `README.txt`, `HOW_TO_DECRYPT.txt`
|
|
- Payment terms: "bitcoin", "decrypt", "ransom", "payment"
|
|
- Encryption terms: "AES", "RSA", "encrypted"
|
|
|
|
## Suspicious File Characteristics
|
|
|
|
### PE Header Anomalies
|
|
- Compilation timestamp in the future
|
|
- Compilation timestamp too old for file features
|
|
- Mismatched architecture in headers
|
|
- Unusual section names (normal: `.text`, `.data`, `.rdata`, `.rsrc`)
|
|
- High entropy sections (>7.0 suggests encryption/packing)
|
|
- Overlapping sections
|
|
- Large overlay data
|
|
- Missing or invalid digital signatures
|
|
|
|
### Entropy Analysis
|
|
- **Low entropy (0-3):** Likely unencrypted, readable data
|
|
- **Medium entropy (3-5):** Typical compiled code
|
|
- **High entropy (7-8):** Packed, encrypted, or compressed
|
|
- Check individual PE sections for high entropy
|
|
|
|
### Packer Signatures
|
|
**Common packers:**
|
|
- UPX (common, legitimate and malicious)
|
|
- ASPack
|
|
- PECompact
|
|
- Themida/WinLicense (strong protection)
|
|
- Armadillo
|
|
- VMProtect
|
|
- Enigma Protector
|
|
- Custom/unknown packers (more suspicious)
|
|
|
|
### File Size Oddities
|
|
- Very small for claimed functionality (<10KB for complex malware)
|
|
- Unusually large resources section
|
|
- Significant overlay data
|
|
- File size doesn't match claimed type
|
|
|
|
## Behavioral Indicators
|
|
|
|
### Anti-Analysis Behaviors
|
|
- Checks for VM artifacts (VMware, VirtualBox, QEMU)
|
|
- Looks for debugger presence
|
|
- Timing checks (execution delays)
|
|
- Checks for analysis tools (Process Monitor, Wireshark, IDA)
|
|
- Sandbox detection (limited resources, username checks)
|
|
- Parent process verification
|
|
- Mouse movement monitoring
|
|
- Checks for user interaction
|
|
|
|
### Modern EDR/AV Evasion Techniques
|
|
|
|
**ETW Patching:**
|
|
- Overwrites the prologue of `EtwEventWrite` or `NtTraceEvent` with a `ret` instruction (0xC3) to suppress Event Tracing for Windows telemetry
|
|
- Look for: `VirtualProtect` → `WriteProcessMemory`/`memcpy` targeting ntdll address space, followed by restoration of original page protections
|
|
- Effect: EDR and ETW-based logging goes blind for the process lifetime
|
|
|
|
**AMSI Bypass:**
|
|
- Patches `AmsiScanBuffer` or `AmsiScanString` in amsi.dll to return S_OK (0) with `AMSI_RESULT_CLEAN` (0), or to return E_INVALIDARG so the caller treats the result as no threat; disables script content scanning
|
|
- Look for: `LoadLibrary("amsi.dll")` + `GetProcAddress` + `VirtualProtect` + small write (1-8 bytes); or `AmsiInitialize` never called while PowerShell/script engine is used
|
|
- Effect: Malicious PowerShell, VBScript, or JScript passes AMSI unchecked
|
|
|
|
**Direct Syscalls / SysWhispers:**
|
|
- Bypasses EDR hooks placed on ntdll.dll exports by issuing raw syscall/sysenter instructions with the correct System Service Number (SSN)
|
|
- Look for: `syscall` or `sysenter` instructions in non-system modules (use `objdump`/`dumpbin`); runtime SSN resolution via ntdll stub scanning (Hell's Gate, Halo's Gate, Tartarus Gate patterns); absence of ntdll imports for expected operations (no `NtAllocateVirtualMemory` import but memory is allocated)
|
|
- Common SSNs targeted: NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory
|
|
|
|
**PPID Spoofing:**
|
|
- Creates a child process with a forged parent PID by passing a handle to the target parent via `UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS)` before calling `CreateProcess`
|
|
- Look for: `OpenProcess` on an unrelated high-privilege process (e.g., explorer.exe, svchost.exe) immediately before `CreateProcess`; process tree in logs showing implausible parent-child relationships
|
|
- Effect: Evades detections that trigger on suspicious parent-child pairs (e.g., Word spawning cmd.exe)
|
|
|
|
**Module Stomping / DLL Hollowing:**
|
|
- Loads a legitimate, signed DLL into memory then overwrites its `.text` section with malicious shellcode, so execution appears to originate from a trusted module
|
|
- Look for: `LoadLibrary` on an unexpected DLL followed by `VirtualProtect(PAGE_EXECUTE_READWRITE)` and `WriteProcessMemory`/`memcpy` into that DLL's base address; signed DLL mapped but exports resolve to unexpected code
|
|
- Distinguish from process hollowing: the host process is not suspended — the stomped DLL simply runs attacker code under a legitimate module name
|
|
|
|
### Persistence Techniques
|
|
- Registry Run key modification
|
|
- Scheduled task creation
|
|
- Service installation
|
|
- WMI event subscriptions
|
|
- DLL hijacking/search order hijacking
|
|
- AppInit_DLLs registry key
|
|
- Startup folder files
|
|
- Browser extension installation
|
|
|
|
### Network Patterns
|
|
- Beaconing (regular C2 communication)
|
|
- HTTP with suspicious User-Agents
|
|
- Raw socket connections
|
|
- IRC protocols
|
|
- DNS tunneling (unusual DNS queries)
|
|
- TOR usage
|
|
- Fast flux domains
|
|
|
|
### Data Exfiltration
|
|
- Unusual outbound data volumes
|
|
- Screenshots being taken
|
|
- Credential harvesting
|
|
- Browser data collection
|
|
- Keylogger output transmission
|
|
- File upload to external servers
|
|
|
|
## Red Flags by File Type
|
|
|
|
### Executable Files (.exe, .dll, .scr)
|
|
- No digital signature or invalid signature
|
|
- Packed/protected
|
|
- Very few imports (possibly resolved at runtime)
|
|
- Unusual compilation timestamp
|
|
- Suspicious filename mimicking system files
|
|
|
|
### Script Files (.ps1, .vbs, .js, .bat)
|
|
- Heavy obfuscation
|
|
- Base64 encoded sections
|
|
- Download and execute patterns
|
|
- WMI usage for execution
|
|
- Registry manipulation
|
|
|
|
### Office Documents (.doc, .xls, .docx, .xlsx)
|
|
- Macros enabled
|
|
- Auto-execute macro names (AutoOpen, Auto_Open, Workbook_Open)
|
|
- External template references
|
|
- Embedded objects
|
|
- Suspicious OLE streams
|
|
|
|
### Archive Files (.zip, .rar, .7z)
|
|
- Executable files with misleading extensions
|
|
- Multi-layer nested archives
|
|
- Password-protected archives (especially with generic passwords)
|
|
- Suspicious filenames inside
|
|
|
|
## Quick Classification Patterns
|
|
|
|
### Ransomware
|
|
- File encryption APIs
|
|
- Many file I/O operations
|
|
- File extension changes
|
|
- Ransom note creation
|
|
- Cryptocurrency addresses
|
|
- File deletion after encryption
|
|
|
|
### Trojan/RAT
|
|
- Network communication APIs
|
|
- Remote control capabilities
|
|
- Screen capture
|
|
- File transfer
|
|
- Command execution
|
|
- Persistence mechanisms
|
|
|
|
### Infostealer
|
|
- Browser data access
|
|
- Credential harvesting
|
|
- Clipboard monitoring
|
|
- Form grabbing
|
|
- Cookie stealing
|
|
- Cryptocurrency wallet targeting
|
|
|
|
### Dropper/Loader
|
|
- Embedded resources
|
|
- Creates and executes files
|
|
- Downloads additional payloads
|
|
- Process injection
|
|
- Minimal visible functionality
|
|
|
|
### Cryptominer
|
|
- High CPU usage
|
|
- Mining pool connections
|
|
- Cryptocurrency-related strings
|
|
- GPU access APIs
|
|
- Persistence with hidden processes
|
|
|
|
## Tool Detection Strings
|
|
|
|
Malware often checks for these analysis tools:
|
|
|
|
**Debuggers:**
|
|
- OllyDbg, x64dbg, IDA Pro, WinDbg
|
|
- Immunity Debugger
|
|
|
|
**Monitors:**
|
|
- Process Monitor (procmon), Process Explorer
|
|
- Wireshark, Fiddler
|
|
- TCPView, RegShot
|
|
|
|
**Sandboxes:**
|
|
- Cuckoo, Joe Sandbox
|
|
- Any.Run, Hybrid Analysis
|
|
- VMRay, FireEye
|
|
|
|
**VM Artifacts:**
|
|
- "VMware", "VirtualBox", "QEMU", "Hyper-V"
|
|
- "vmmouse", "vmhgfs", "vboxguest"
|
|
- Registry keys related to VMs
|
|
|
|
**Analysis Artifacts:**
|
|
- Username: "sandbox", "malware", "virus", "sample"
|
|
- Hostname: "VIRUS-PC", "MALWARE-ANALYSIS"
|
|
- Limited resources (low RAM, CPU count)
|