7

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust.

Would it be possible for a "process hollowing scanner" to enumerate all the executable pages in a process' memory, enumerate all the executable sections of the process' associated image file, and see if there were any pages in the memory that didn't have any corresponding pages in the image file, for example by fuzzy hashing the image file, hashing each memory page, and comparing the two sets?

This would seem to detect process hollowing very well -- any code injected into a process would not be present in the image file, and unless the attacker could find some collision attack against the hashing algorithm they wouldn't be able to fool the detector (and anyways multiple algorithms could be used). And because the detector relies on looking for anomalous extra segments in the process' memory instead of directly hashing the memory and comparing it to the file, it would work even if the entire image file isn't mapped into memory.

So is this a valid method of detecting process hollowing? I don't believe I've seen this method used anywhere to detect code injection (the closest I've seen is when rootkit scanners compare the hash of a process' entire memory section against the hash of the entire image file, which only works if the file is mapled entirely i memory).

Is this a feasible method to detect code injection/process hollowing?

exosphere
  • 71
  • 2

2 Answers2

2

Trustwave SpiderLabs wrote up a blog on analyzing malware with hollow processes -- https://www.trustwave.com/Resources/SpiderLabs-Blog/Analyzing-Malware-Hollow-Processes/

Cuckoo Sandbox, a popular and free, open-source software (FOSS) automated malware analysis engine can also be leveraged for working with hollowed processes -- http://journeyintoir.blogspot.com/2015/02/process-hollowing-meets-cuckoo-sandbox.html

and the mother-of-all articles on process hollowing has been summarized here -- http://marcoramilli.blogspot.com/2016/05/process-hollowing.html

atdre
  • 18,885
  • 6
  • 58
  • 107
1

To detect processing hollowing , you can use compare PE header disk vs memory since it will be executed on a normal thread

http://www.adlice.com/runpe-hide-code-behind-legit-process/

To detect dll injection you can do a vad walking, or stack tracing:

Look for article called : "Walking the VAD Tree" & "Scanning Process Memory for Injected Code"

Félix
  • 11
  • 1