In-memory scan for threat detection with binary instrumentation backed generic unpacking, decryption, and deobfuscation
Systems and methods for in-memory malware unpacking and deobfuscation in a sandbox include, responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code; responsive to detecting the packed, obfuscated, or encrypted code performing steps of unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code; executing the unpacked, deobfuscated, or decrypted code; monitoring execution of the unpacked, deobfuscated, or decrypted code; obtaining events during the scanning and the execution; and providing the obtained events to the sandbox for use in a sandbox analysis for classifying the content as one of malware and clean.
1 . A non-transitory computer-readable medium having instructions stored thereon for programming one or more processors, associated with a sandbox, to perform steps of:
responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code;
responsive to detecting the packed, obfuscated, or encrypted code performing steps of:
unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code in memory using an in-memory unpacking and deobfuscation scanner configured to defeat anti-sandbox evasion techniques;
executing the unpacked, deobfuscated, or decrypted code;
monitoring execution of the unpacked, deobfuscated, or decrypted code including monitoring memory allocations, permission changes, spawned child process, process injections, and associated system calls;
obtaining events comprising behavioral evens, system calls, and memory events, the events including artifacts collected prior to cleanup of allocated memory regions; and
providing the obtained events to the sandbox for use in a sandbox analysis, wherein the sandbox analysis includes adjusting a malware classification score based on the obtained events to classify the unknown content as one of malware and clean.
2 . The non-transitory computer-readable medium of claim 1 , wherein the steps further include:
responsive to not detecting the packed, obfuscated, or encrypted code, performing the sandbox analysis.
3 . The non-transitory computer-readable medium of claim 1 , wherein the unpacked, deobfuscated, or decrypted code is configured to execute on a time delay to avoid the classifying by the sandbox.
4 . The non-transitory computer-readable medium of claim 1 , wherein the monitoring includes detecting any spawned child processes and capturing the associated command-line arguments.
5 . The non-transitory computer-readable medium of claim 1 , wherein the monitoring includes detecting any process injection and generating a memory dump of injected payloads.
6 . The non-transitory computer-readable medium of claim 1 , wherein the monitoring includes detecting any system calls and Application Programming Interface (API) calls.
7 . The non-transitory computer-readable medium of claim 1 , wherein the events include a plurality of behavior based events, system calls, and memory events.
8 . The non-transitory computer-readable medium of claim 1 , wherein the events include (TTP) events and behavior events.
9 . The non-transitory computer-readable medium of claim 1 , wherein the steps further include:
running one or more rules on the events; and
providing results of the one or more rules to the sandbox.
10 . The non-transitory computer-readable medium of claim 1 , wherein the adjusting the malware classification score is based on artifacts collected by the in-memory unpacking and deobfuscation scanner, the artifacts comprising freed memory regions, command in-line arguments of spawned child processes, and memory dumps of injected payloads.
11 . A method comprising steps of:
responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code;
responsive to detecting the packed, obfuscated, or encrypted code performing steps of:
unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code in memory using an in-memory unpacking and deobfuscation scanner configured to defeat anti-sandbox evasion techniques;
executing the unpacked, deobfuscated, or decrypted code;
monitoring execution of the unpacked, deobfuscated, or decrypted code including monitoring memory allocations, permission changes, spawned child process, process injections, and associated system calls;
obtaining events comprising behavioral evens, system calls, and memory events, the events including artifacts collected prior to cleanup of allocated memory regions; and
providing the obtained events to the sandbox for use in a sandbox analysis, wherein the sandbox analysis includes adjusting a malware classification score based on the obtained events to classify the unknown content as one of malware and clean.
12 . The method of claim 11 , wherein the steps further include:
responsive to not detecting the packed, obfuscated, or encrypted code, performing the sandbox analysis.
13 . The method of claim 11 , wherein the unpacked, deobfuscated, or decrypted code is configured to execute on a time delay to avoid the classifying by the sandbox.
14 . The method of claim 11 , wherein the monitoring includes detecting any spawned child processes and capturing the associated command-line argument.
15 . The method of claim 11 , wherein the monitoring includes detecting any process injection and generating a memory dump of injected payloads.
16 . The method of claim 11 , wherein the monitoring includes detecting any system calls and Application Programming Interface (API) calls.
17 . The method of claim 11 , wherein the events include a plurality of behavior based events, system calls, and memory events.
18 . The method of claim 11 , wherein the events include (TTP) events and behavior events.
19 . The method of claim 11 , wherein the steps further include:
running one or more rules on the events; and
providing results of the one or more rules to the sandbox.
20 . The method of claim 11 , wherein the adjusting the malware classification score is based on artifacts collected by the in-memory unpacking and deobfuscation scanner, the artifacts comprising freed memory regions, command-line arguments of spawned child processes and memory dumps of injected payloads.