MITRE ATT&CK - Техника Внедрение в пустой процесс

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Process Injection: Внедрение в пустой процесс

Other sub-techniques of Process Injection (12)

ID	Название
.001	Внедрение DLL-библиотек
.002	Внедрение PE-образа
.003	Перехват выполнения потока
.004	Асинхронный вызов процедур
.005	Локальная память потока
.008	Системные вызовы ptrace
.009	Внедрение через файловую систему /proc
.011	Внедрение в дополнительную память окна (EWM)
.012	Внедрение в пустой процесс
.013	Process Doppelgänging
.014	Перехват виртуального динамического общего объекта (VDSO)
.015	Внедрение списков

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017) This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.

ID: T1055.012

Относится к технике: T1055

Тактика(-и): Defense Evasion, Privilege Escalation

Платформы: Windows

Требуемые разрешения: User

Источники данных: Process: OS API Execution, Process: Process Access, Process: Process Modification

Версия: 1.2

Дата создания: 14 Jan 2020

Последнее изменение: 29 Nov 2021

Название	Описание
Примеры процедур
Gorgon Group	Gorgon Group malware can use process hollowing to inject one of its trojans into another process.(Citation: Unit 42 Gorgon Group Aug 2018)
Threat Group-3390	A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)
RCSession	RCSession can launch itself from a hollowed svchost.exe process.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Trend Micro DRBControl February 2020)(Citation: Profero APT27 December 2020)
Denis	Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.(Citation: Cybereason Cobalt Kitty 2017)
Azorult	Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.(Citation: Unit42 Azorult Nov 2018)
Patchwork	A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.(Citation: Cymmetria Patchwork)
QakBot	QakBot can use process hollowing to execute its main payload.(Citation: ATT QakBot April 2021)
Cobalt Strike	Cobalt Strike can use process hollowing for execution.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Cobalt Strike Manual 4.3 November 2020)
Lokibot	Lokibot has used process hollowing to inject itself into legitimate Windows process.(Citation: Infoblox Lokibot January 2019)(Citation: Talos Lokibot Jan 2021)
Bandook	Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.(Citation: Lookout Dark Caracal Jan 2018)(Citation: EFF Manul Aug 2016)(Citation: CheckPoint Bandook Nov 2020)
Cobalt Strike	Cobalt Strike can use process hollowing for execution.(Citation: Cobalt Strike TTPs Dec 2017)
Smoke Loader	Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.(Citation: Malwarebytes SmokeLoader 2016)(Citation: Microsoft Dofoil 2018)
Astaroth	Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.(Citation: Cybereason Astaroth Feb 2019)(Citation: Securelist Brazilian Banking Malware July 2020)
Dtrack	Dtrack has used process hollowing shellcode to target a predefined list of processes from `%SYSTEM32%`.(Citation: Securelist Dtrack)
WhisperGate	WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.(Citation: Cisco Ukraine Wipers January 2022)
BADNEWS	BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)
Clambling	Clambling can execute binaries through process hollowing.(Citation: Trend Micro DRBControl February 2020)
menuPass	menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.(Citation: Accenture Hogfish April 2018)
ISMInjector	ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.(Citation: OilRig New Delivery Oct 2017)
Saint Bot	The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
NETWIRE	The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.(Citation: FireEye NETWIRE March 2019)(Citation: Red Canary NETWIRE January 2020)
Agent Tesla	Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.(Citation: SentinelLabs Agent Tesla Aug 2020)
Orz	Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.(Citation: Proofpoint Leviathan Oct 2017)
TrickBot	TrickBot injects into the svchost.exe process.(Citation: S2 Grupo TrickBot June 2017)(Citation: Trend Micro Totbrick Oct 2016)(Citation: Microsoft Totbrick Oct 2017)(Citation: Cyberreason Anchor December 2019)
Ursnif	Ursnif has used process hollowing to inject into child processes.(Citation: FireEye Ursnif Nov 2017)
Kimsuky	Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.(Citation: Talos Kimsuky Nov 2021)
Bazar	Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
BBSRAT	BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.(Citation: Palo Alto Networks BBSRAT)
Duqu	Duqu is capable of loading executable code via process hollowing.(Citation: Symantec W32.Duqu)

Контрмера	Описание
Контрмеры
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Обнаружение

Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.(Citation: Elastic Process Injection July 2017) Processing hollowing commonly involves spawning an otherwise benign victim process. Consider correlating detections of processes created in a suspended state (ex: through API flags or process’ thread metadata) with other malicious activity such as attempts to modify a process' memory, especially by its parent process, or other abnormal process behavior.(Citation: Nviso Spoof Command Line 2020)(Citation: Mandiant Endpoint Evading 2019) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.