Memory Dump Evasion
May 1, 2024 · View on GitHub
| ID | B0006 |
| Objective(s) | Anti-Behavioral Analysis |
| Related ATT&CK Techniques | None |
| Anti-Analysis Type | Evasion |
| Version | 2.1 |
| Created | 1 August 2019 |
| Last Modified | 29 April 2024 |
Memory Dump Evasion
Memory dump evasion is an anti-forensic technique in which malware hinders retrieval and/or discovery of the contents of the physical memory of the system on which the malware instance is executing [1]. Tools enabling capture of malware code from memory can be software-based or hardware-based. Malicious code thwarts software-based tools by relying on such methods as resolving API addresses before each use (on-the-fly APIs method) and erasing or corrupting specific file parts to prevent rebuilding (tampering method) [2],[3].
Methods
| Name | ID | Description |
|---|---|---|
| Code Encryption in Memory | B0006.001 | Encrypt the executing malware instance code in memory. |
| Erase the PE header | B0006.002 | Erase PE header from memory. |
| Feed Misinformation | B0006.008 | API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See Hijack Execution Flow. |
| Flow Opcode Obstruction | B0006.009 | Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [6]. |
| Guard Pages | B0006.006 | Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102. |
| Hide virtual memory | B0006.003 | Hide arbitrary segments of virtual memory. |
| On-the-Fly APIs | B0006.007 | Resolve API addresses before each use to prevent complete dumping. |
| SizeOfImage | B0006.004 | Set the SizeOfImage field of PEB.LoaderData to be huge. |
| Tampering | B0006.005 | Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.). |
| Hook memory mapping APIs | B0006.010 | Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [1] |
| Patch MmGetPhysicalMemoryRanges | B0006.011 | Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [1] |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Kraken | 2008 | -- | Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [4] |
Code Snippets
B0006.011 Snippet
Memory Dump::Code Encryption in Memory
SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03asm mov cl, 65h ; 'e' mov al, 70h ; 'p' mov [ebp+var_23], cl mov [ebp+var_1F], cl mov [ebp+String], bl mov [ebp+var_12], bl mov [ebp+var_2E], al mov [ebp+var_2D], al lea ecx, [ebp+String] mov al, 74h ; 't' mov bl, 2Eh ; '.' push ecx mov [ebp+var_13], 30h mov [ebp+var_11], 30h mov [ebp+var_10], 0 mov [ebp+cp] mov [ebp+var_2F], 75h mov [ebp+var_2C], 6Fh mov [ebp+var_2B], 72h mov [ebp+var_2A], al mov [ebp+var_29], bl mov [ebp+var_28], 62h mov [ebp+var_27], 79h mov [ebp+var_26], 69h mov [ebp+var_25], dl mov [ebp+var_24], al mov [ebp+var_22], 72h mov [ebp+var_21], bl mov [ebp+var_20], dl mov [ebp+var_1E], al mov [ebp+var_1D], 0 call ds:atoi add esp, 4 mov dword ptr [ebp+hostshort], eax jmp short loc_401326
References
[1] J. Stüttgen and M. Cohen,"Anti-Forensic Resilient Memory Acquisition," in DFRWS USA 2013 Conference, 2013. [Online]. Available: https://dfrws.org/presentation/anti-forensic-resilient-memory-acquisition/.
[2] L. Maffia, D. Nisi, P. Kotzias, G. Lagorio, S. Aonzo, and D. Balzarotti, "Longitudinal Study of the Prevalence of Malware Evasive Techniques," arXiv:2112.11289 , 21 Dec 2021. [Online]. Available: https://arxiv.org/pdf/2112.11289.pdf.
[3] "PlugX: Memory Forensics Lifecycle with Volatility," Volatility Labs, blog, 6 Nov. 2015. [Online]. Available: https://volatility-labs.blogspot.com/2015/11/plugx-memory-forensics-lifecycle-with.html.
[4] http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html