It was 03:14 AM. The blue light of the screen was already stinging my eyes when a critical 'Process Injection' alert from a server in testCompany’s main data center was enough to blow away any sleepiness. The scene on the EDR (Endpoint Detection and Response) console wasn't pretty: a standard notepad.exe process was generating way more network traffic than it ever should, attempting to leak data to a suspicious IP address (127.0.0.1 - defanged). That’s when I knew we were dealing with yet another 'fileless' malware case, and coffee was about to become my best friend for the next few hours.
In the cybersecurity world, we Red Teamers are usually on the offensive side, but honestly, it’s impossible to build a solid defense without knowing the 'kitchen'—how the malware actually ticks. Today, I’m going to walk you through the anatomy of the 'beast' we analyzed that night and what goes through the mind of a malware analyst. Our goal here is to understand how these threats hide so we can armor our systems accordingly.
First Contact: The Limits of Static Analysis
All we had was a suspicious binary dumped from memory. The first thing I did was take the file's fingerprint (hash) and run it through known databases. The result? A big fat zero. The attacker had packed the file specifically for that moment (FUD - Fully Undetectable). When we looked inside using the strings command during the static analysis phase—examining the file without running it—we saw nothing but meaningless character strings and high entropy (complexity).
If a binary's entropy is very high, you can bet that file is either packed or encrypted. Attackers hide their true intentions this way to evade analysis tools.
# Simple pseudo-code to measure a file's entropy
import math
def calculate_entropy(data):
if not data:
return 0
entropy = 0
for x in range(256):
p_x = float(data.count(chr(x))) / len(data)
if p_x > 0:
entropy += - p_x * math.log(p_x, 2)
return entropy
# If the result is above 7.0, we can say there's a 'packer' involved.
Dynamic Analysis: Running in the Labyrinth
Since static analysis led us nowhere, we moved to our safe and isolated 'sandbox' environment. The goal here is to let the malware run in a controlled space and watch its every move. After injecting itself into notepad.exe, the first thing the malware did was call the VirtualAllocEx and WriteProcessMemory functions via kernel32.dll. This is one of the oldest but most effective tricks in the book: Process Hollowing.
The attacker hollows out a legitimate process and replaces its core with their own malicious code. To a sysadmin looking from the outside, it’s just a notepad running, but in the background, that notepad might be harvesting your Active Directory hashes.
During this stage, while monitoring network traffic, we observed the malware sending HTTP POST requests to example-c2-server.com (defanged). However, the requests were...