Detecting hollow process injection using memory forensic with Volatility

Key point to remember

PEB (Process environment block): Process environment block is data structure in Windows NT
system. PEB can be used by other applications to get information like heap address, memory offsets
or if the program is being debugged.

Process hollowing or Hollow process injection is in memory code injection technique where a
malware creates a process in suspended form, then rewrite the code with it’s malicious content
inside memory then continues the execution.

Malware authors use this technique because in this method, there’s nothing written on hard drive and it’s a good way to bypass most antivirus and signature base detection.

How does hollow process work?

Suppose there are two process x and y, here y is legit process which is also called a remote process
and x is the malicious process.

X creates a legit process in suspended state and the executable section of y loaded inside the
memory.

The malware gets the base address of this legit process by reading Process environment block this
help the malware to get the address where the legitimate process is loaded.

Malware’s process X get the malicious code to inject in the legit process.

Malware’s process X deallocate the executable section of legit process.

It allocate the memory to the remote process with read write and executable permission.

Malware writes PE header and PE section of executable to inject in payload memory.

Malware then changes the start address (PEB Base address) of the remote process with the entry
point of the injected executable.

Process now resume and the malware can execute it’s malicious code. 

Detecting Process hollow injection using memory forensic

Hollow process can be detected using memory forensic technique with volatility.

First we will get the memory dump image info using imageinfo string

Above we can see it’s WinddowsXPSP3

Now we will list of running process using pslist command

Above we can see there are more than one lsass process running , and below we can see lsass usualy
has only one process and it’s parent process should be wininit.exe and service.exe on pre-vista
machine (image from sans.org Find-evil poster).

On investigating parent process number it show that this process is associated with winlogon.exe
which is not service.exe as this is windows xp machine this process was suppose to be launch by
service.exe

This technique is useful for finding this kind of malicious process as said above on a clean system
lsass usualy has only one process and it’s parent process should be wininit.exe and service.exe on
pre-vista machine.