Systems and methods to scan memory for a threat

1. A computer-implemented method to scan memory for a threat, comprising:

monitoring, by a processor, at least one application programming interface (API);

performing, by the processor, a back-trace operation from the at least one API to identify a process that called the at least one API;

retrieving, by the processor, an address in memory for the identified process;

decrypting an encrypted form of shellcode or unpacking a packed form of malware;

storing the decrypted form of shellcode or the unpacked form of malware in a storage medium;

retrieving, by the processor, at least one signature from a database, wherein the retrieved signature comprises a signature of the decrypted shellcode or the unpacked malware;

scanning, by the processor, at least a portion of the memory;

upon determining that the scanned memory matches the at least one retrieved signature, blocking, by the processor, the execution of the identified process; and

upon determining that the scanned memory does not match the at least one retrieved signature, generating, by the processor, a signature based on the scanned portion of the memory associated with the address of the identified process.

2. The method of claim 1 , wherein the generated signature identifies the threat.

3. The method of claim 2 , wherein the threat comprises decrypted shellcode stored in memory.

4. The method of claim 2 , wherein the threat comprises unpacked malware stored in memory.

5. The method of claim 1 , further comprising creating a first set of rules associated with the at least one API.

6. The method of claim 1 , further comprising creating a second set of rules associated with a process used by the threat.

7. The method of claim 1 , further comprising setting a predetermined size of memory to scan based on the location of the address of the identified process.

8. The method of claim 1 , further comprising searching for predetermined operational code in the memory from the location of the address of the identified process.

9. The method of claim 1 , further comprising transmitting the generated signature to a server, wherein the server stores the generated signature in a database.

10. A computing device configured to scan memory for a threat, comprising:

a processor;

memory in electronic communication with the processor;

instructions stored in the memory, the instructions executable by the processor to:

monitor at least one application programming interface (API);

perform a back-trace operation from the at least one API to identify a process that called the at least one API;

retrieve an address in memory for the identified process;

decrypt an encrypted form of shellcode or unpack a packed form of malware;

store a decrypted form of shellcode or an unpacked form of malware in a storage medium;

retrieve at least one signature from a database, wherein the retrieved signature comprises a signature of the decrypted shellcode or the unpacked malware;

scan at least a portion of the memory;

upon determining that the scanned memory matches the at least one retrieved signature, block the execution of the identified process; and

upon determining that the scanned memory does not match the at least one retrieved signature, generate a signature based on the scanned portion of the memory associated with the address of the identified process.

11. The computing device of claim 10 , wherein the generated signature identifies the threat.

12. The computing device of claim 11 , wherein the threat comprises decrypted shellcode stored in memory.

13. The computing device of claim 11 , wherein the threat comprises unpacked malware stored in memory.

14. The computing device of claim 10 , wherein the instructions executable by the processor to:

create a first set of rules associated with the at least one API.

15. The computing device of claim 10 , wherein the instructions executable by the processor to:

create a second set of rules associated with a process used by the threat.

16. The computing device of claim 10 , wherein the instructions executable by the processor to:

set a predetermined size of memory to scan based on the location of the address of the identified process.

17. The computing device of claim 10 , wherein the instructions executable by the processor to:

search for predetermined operational code in the memory from the location of the address of the identified process.

18. The computing device of claim 10 , wherein the instructions executable by the processor to:

transmit the generated signature to a server, wherein the server stores the generated signature in a database.

19. A computer-program product to scan memory for a threat, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions being executable by a processor to:

monitor at least one application programming interface (API);

perform a back-trace operation from the at least one API to identify a process that called the at least one API;

retrieve an address in memory for the identified process;

decrypt an encrypted form of shellcode or unpack a packed form of malware;

store a decrypted form of shellcode or an unpacked form of malware in a storage medium;

retrieve at least one signature from a database, wherein the retrieved signature comprises a signature of the decrypted shellcode or the unpacked malware;

scan at least a portion of the memory;

upon determining that the scanned memory matches the at least one retrieved signature, block the execution of the identified process; and

upon determining that the scanned memory does not match the at least one retrieved signature, generate a signature based on the scanned portion of the memory associated with the address of the identified process.

20. The computer-program product of claim 19 , wherein the threat comprises decrypted shellcode stored in memory or unpacked malware stored in memory.