How Hackers Hide From Memory Scanners
Source: YouTube · John Hammond · published Nov 8, 2023 · 21:13
This video demonstrates the PE fluctuation technique that allows malware to evade memory scanners by dynamically encrypting and decrypting malicious payloads in computer memory 0:00-0:20.
Key Takeaways:
• Malware typically evades detection by embedding malicious payloads in "harness" executables, but traditional injection methods can still be detected by memory scanning tools like Moneta and PE-sieve 1:15-2:16.
• The PE fluctuation technique keeps malicious executables encrypted in memory when inactive, only decrypting them briefly during execution to minimize the detection window 9:49-10:29.
• This advanced technique uses Windows API functions including CreateTimerQueueTimer for scheduled encryption/decryption and vectored exception handlers as guardrails 11:41-12:26.
• The demonstration successfully runs Mimikatz through PE fluctuation while evading detection from both Moneta and PE-sieve memory scanners 18:00-19:36.
The PE fluctuation technique represents an advanced evasion strategy that allows malware to operate undetected even under memory analysis, expanding on earlier shell code fluctuation concepts 10:52-11:16.
Sources:
- 0:00-0:20 Introduction to malware evasion and memory hiding
- 1:15-2:16 Traditional payload injection and harnessing
- 9:49-10:29 PE fluctuation concept explanation
- 11:41-12:26 Technical implementation details
- 18:00-19:36 Demonstration of memory scanner
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
computer malware wants to run and execute undetected it wants to evade antivirus or AV and EDR and point detection response programs and we've showcased in a lot of different videos how you can circumvent that but we haven't talked about how malware might be able to get around one of the toughest places to hide computer memory so for the demonstration in this video our goal is not to buypass antivirus and for that reason I have Windows Defender actually turned off realtime protection is toggled off and we can talk more about that soon but let's just say that our objective our goal what we want to do is run some malicious tooling some offensive software like MIM cats as an example now of course we do have Defender turned off so I can just run mimic cats. exe and fire stuff up you might be f…