Cuckoomon evasion tactic
Closed this issue · 6 comments
MD5: ffbb763b95ea8f9ea44e786c0ff43bf5
Creates a child process, then injects a PE image into its virtual address space:
The child process evades analysis by repeatedly calling Sleep(0):
Carving out the injected PE image and loading it into IDA Pro clearly shows the 1 million iteration loop with the Sleep calls:
This evasion tactic seem to work only because it is performed by a child process, which is treated differently by Cuckoomon than the main target process.
I can write something for this, but in general there are many more cases of this same idea, particularly with VB loaders. Sometimes it'll be necessary to run the sample for a longer duration.
-Brad
Is there any reason why child processes are treated differently in this context than the main target process?
Because there's code to skip the sleeps happening in the first 5 seconds of execution in the initial process -- this isn't such a good idea anyway really and I'll probably replace it at some point.
-Brad
To clarify, are you saying that sleep skipping in the target process is a bad idea, or that NOT sleep skipping in the child processes is a bad idea?
The indiscriminate skipping of sleeps (as in, not calling the real API at all) for the first 5 seconds is a bad idea.
-Brad
It's an interesting problem. I guess at minimum the sandbox should be able to reliably detect long sleeps and related tricks.