mirror of
https://github.com/nganhkhoa/malware.git
synced 2024-06-10 21:32:07 +07:00
28 lines
1.0 KiB
Markdown
28 lines
1.0 KiB
Markdown
|
# Process Hollowing(Trickbot)
|
||
|
|
- Sample/Environment
|
||
|
|
- Analysis contents
|
||
|
|
- File copy
|
||
|
|
- VirtualAlloc and Data transition
|
||
|
|
- Createting Process and Heaven's Gate (Process Hollowing)
|
||
|
|
|
||
|
|
## Sample/Environment
|
||
|
|
- Sample
|
||
|
|
|
||
|
|
|sha256|[3A6C3F7B99B2E76914FBC338C622B92F9825CB77729B8BF050BA64ECE1679818](https://www.virustotal.com/gui/file/3a6c3f7b99b2e76914fbc338c622b92f9825cb77729b8bf050ba64ece1679818/detection)|
|
||
|
|
|:-|:-|
|
||
|
|
|filetype|PE(exe,32bit)|
|
||
|
|
|sandbox|[ANYRUN](https://app.any.run/tasks/9f302b49-4585-4905-b466-9459ff88c558/)<br>[HYBRID ANALYSIS](https://www.hybrid-analysis.com/sample/3a6c3f7b99b2e76914fbc338c622b92f9825cb77729b8bf050ba64ece1679818?environmentId=100)<br>[Triage](https://tria.ge/reports/191018-jnffne1l7x/task2)<br>|
|
||
|
|
- Environment
|
||
|
|
|
||
|
|
|vm|VirtualBox5.2, Guest Addtions Installed|
|
||
|
|
|:-|:-|
|
||
|
|
|os|Windows10 Home 64bit, FLARE VM Installed|
|
||
|
|
|debugger|x32/x64dbg, WinDbg|
|
||
|
|
|
||
|
|
## Analysis contents
|
||
|
|
|
||
|
|
### File copy
|
||
|
|
բնութագրվում է.exe
|
||
|
|
### VirtualAlloc and Data transition
|
||
|
|
### Createting Process and Heaven's Gate (Process Hollowing)
|