ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
WhacAMole is a program that analyzes processes in memory in an integral way, detecting and alerting of anomalies related to malware and presenting and saving in files all the relevant information for verification, correlation or analysis, as well as dumping memory regions, processes and suspicious modules. To achieve this, it analyzes not only the anomalies of the memory regions of the processes and the modules they load, but it also analyzes in depth all the memory space in use by the process. At this moment, WhacAMole is capable of identifying 67 alerts related to malicious behavior or that can only be due to malware. It shows more than 70 properties of the processes, memory and modules, comparing many of their attributes read in memory with those that appear in the corresponding file on disk, partially disassembles suspicious memory regions and partially disassembles exported functions that have been modified in memory for analysts to conduct their own investigations.
Unlike other similar programs, it makes all the relevant information on the processes available to analysts, labeling those characteristics that are related to malware with different alerts, so that they can carry out their own analysis or look for other signs of the existence of malicious processes. Alerts are classified, according to their danger and the number of processes in which the same behavior appears, according to a scale of six values, reflected in the html document with a color scale, with 6 (black color) being an indicator of the probability higher than that the detected characteristic is due to malware and 1 (gray color) that, although the behavior is abnormal, there are many system processes where the same behavior has been observed:
To facilitate the work of the analysts, the information is presented on screen, in an HTML file with a navigation panel of the processes analyzed and in csv text files. In the side panel of the html document, the process tree is shown, with the color corresponding to the highest alert detected in them, with the hyperlink to its location in the document, and with the blue color in its PID if it is a 32 bits process or green if it is a .NET process. Processes that have Control Flow Guard (CFG) enabled are shown in italics.
Information about remote RDP sessions is displayed at the beginning of the process information:
Networking capacity is displayed in two ways: if a TCP connection has been detected it is displayed with the Earth globe symbol, and if a connected socket has been detected, it is displayed with an empty globe symbol. Added symbol (white circle) for processes with http navigation libraries in memory: wininet.dll and winhttp.dll.
Network detail:
Connected socket:
There is a special symbol (a key) when Mimikatz-like activity is detected.
At the bottom of the navigation panel of the html document, all the alerts are shown, with their color, with the PIDs of the processes in which they have been detected in the form of a hyperlink to the position of the document where the process is shown.
If there are no processes detected with an alert, their name is displayed on a white background.
The main panel displays all processes with its information in collapsibles sections that by default are hidden. All the alerts are visible always.
Saved memory regions are xored with key 0x0E to prevent antivirus from deleting them.
Analyze, compare and present information from:
1. Processes:
• Warnings:
[Admin Privs]
[Alternate credentials]
[Alternate network credentials]
[Delphi 4 – Delphi 2006]
[Entry Point]
[LogonType]
[Managed code but no Assemblies detected - .NET ETW disabled]
[Mismatching Path]
[Name of the module hidden in memory]
[NTLM Authentication]
[PE anomalies]
[PEB ImageBaseAddress forgery]
[Possible .NET in memory loaded as Assembly.Load(byte[])]
[Process checkSum is 0]
[Process checkSum mismatch]
[Process Ghosting]
[Process Hollowing]
[Process Memory region hash mismatch]
[Process Memory region Protection value modified]
[Process Memory region WX]
[Process Name != Internal Name]
[PROCESS NOT SIGNED]
[Process Private memory region]
[Process Unknown executable memory region]
[Section Table]
[Shared memory subversion]
[SizeOfInitializedData is 0]
[SUSPENDED PROCESS]
[Suspicious Commandline]
[Suspicious Environment Variable]
[TimeDateStamp Inequality]
[Transaction detected: TxF/TxR]
[Unmanaged process/managed code execution detected]
[Unusual CWD]
2. Modules:
What you would expect to see in a normal module is LMIVH:
L = InLoadOrderModuleList(PEB).
M = InMemoryOrderModuleList (PEB).
I = InInitializationOrderModuleList (PEB).
V = Detected in the virtual memory of the process.
H = Detected in the PEB hash list.
If it has been unlinked from the three PEB linked lists you would see:
---VH
If the module is loaded manually by the malware it would not appear in any of the PEB lists but it could be detected by scanning the memory,
so It would appear as:
−−−V−
With the DLL Hollowing with Moat technique (see https://github.com/forrest-orr/artifacts-kit for a POC) the result would be:
-----
• Warnings:
[Abnormal PE Header]
[Delphi 4 – Delphi 2006]
[DLL Hiding]
[DLL Hollowing]
[Mismatching Path]
[Module checkSum is 0]
[Module checkSum mismatch]
[Module Name != OriginalFileName]
[MODULE NOT SIGNED]
[Module PE anomalies]
[Module SizeOfInitializedData is 0]
[Module TimeDateStamp Inequality]
[Name of the module hidden in memory]
[Phantom DLL Hollowing TxF]
[Private memory region]
[Section Table]
[Signed PE NOT MEM_IMAGE]
[Unsigned PE NOT MEM_IMAGE]
[Unusual module]
3. Handles: All process handles of the File, Key, Mutant, Process, Thread, Token and Section types are displayed. Depending on the type of handle, the following information is displayed:
• Warnings:
[Handle-Section Phantom DLL Hollowing TxF]
[Handle-Section Suspicious: Injection]
[Pipe Handle to another process]
[Process Handle to another process]
[ShadowMove Lateral Movement]
4. Tokens: In threads where a token is detected, the following is displayed:
• Warnings:
[Thread with TOKEN]
5. Threads:
• Warnings:
[Thread-Memory NOT MEM_IMAGE]
[Thread-Possible Ekko technique]
[Thread-Possible Foliage technique]
[Thread-Unknown module in Stack]
6. .NET assemblies
• Warnings:
[.NET Assembly w/o ILPath]
7. Memory address space. Shows from all memory regions of the process the values of:
• Warnings:
[Executable memory region not MEM_IMAGE]
[Hidden PE]
[Lagos Island Method]
[Mapped Image]
[Memory region hash]
[Memory region Protection value modified]
[Memory region WX]
[Memory/File values mismatch]
[Moat detected]
[MZ/PE Not Present]
[Shellcode]
[Unknown executable memory region]
