From 28f7d00269622183b715ff980c6a0a62292e9a72 Mon Sep 17 00:00:00 2001 From: MxExTxH Date: Fri, 3 Jan 2020 17:14:20 +0900 Subject: [PATCH] Update analysis_processhollowing.md --- Trickbot/analysis_processhollowing.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/Trickbot/analysis_processhollowing.md b/Trickbot/analysis_processhollowing.md index 92d8494..9e6fe6b 100644 --- a/Trickbot/analysis_processhollowing.md +++ b/Trickbot/analysis_processhollowing.md @@ -22,6 +22,24 @@ ## Analysis contents ### File copy +![](https://github.com/mether049/malware/blob/master/Trickbot/img/shellexecute_2_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/filecopy_1_940.png) +![]() բնութագրվում է.exe ### VirtualAlloc and Data transition +![](https://github.com/mether049/malware/blob/master/Trickbot/img/virtualalloc_3_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/datasection_4_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/datacopy_5_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/datacopy2_6_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/decode_7_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/decode2_8_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/copytext_9_940.png) ### Createting Process and Heaven's Gate (Process Hollowing) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/svchost_10_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/heavensgate_11_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/ntdll_12_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/crccalc_13_940.png) +![](https://github.com/mether049/malware/blob/master/Trickbot/img/crccmp_14_940.png) +![]() +![]() +