Source: itamarhall.github.io
Author: unknown
URL: https://itamarhall.github.io/Tracepoint/blog/writeups/dissecting-process-hollowing-rogue-lsass-with-injected-shellcode/
ONE SENTENCE SUMMARY:
This forensic investigation examines process hollowing in Windows memory, revealing malicious activities involving lsass.exe and Metasploit-like shellcode.
MAIN POINTS:
- Analysis focuses on identifying process hollowing using Volatility 3.
- Multiple tools used: MemProcFS, YARA, Eric Zimermman tools, PEstudio.
- Memory image reveals dual lsass.exe processes, indicating malicious activity.
- Suspicious processes involve rogue lsass.exe and related cmd.exe executions.
- Handle investigations highlight unusual file and network interactions.
- Memory injections detected using ldrmodules, malfind, ProcSentinel.
- In-memory module linked to Metasploit-style API hashing, reflecting injection.
- Disk artifacts like Prefetch, Amcache, PCA confirm file execution.
- Timeline correlates defense impairments with malicious execution activities.
- Metasploit YARA matches suggest network-capable shellcode operation.
TAKEAWAYS:
- Process hollowing detected via memory analysis shows disguised malicious processes.
- Volatility 3 and complementary tools enrich memory forensics investigation.
- Dual lsass.exe presence reveals process manipulation and shellcode execution.
- Timeline analysis correlates defensive changes with malicious actions.
- Comprehensive analysis ties network activity to injected shellcode behavior.