The Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM
summary
Microsoft COM usage appears in 20% of samples and causes missed behavior, so small C test programs — five 10–20 line C test cases (auto-start, IE browser download, firewall disable, file copy, new-process via WMI) expose failures in common sandboxes that hook at ntdll/kernel or rely on parent‑process tracking. The practical fix is inter-modular transition monitoring: a hypervisor MMU execute-switching approach that traps execution at the COM/first API layer, parses marshalled parameters, emits complete COM call logs and greatly reduces noise without modifying the guest.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:51Cyber Threat Trends
- 5:00Comprehensive Threat Detection with Sandboxing
- 12:24Some statistics from internal sharing programs
- 14:05Let's see how well sandboxes perform with COM samples.
- 22:47Approach #1: Hooking based
- 44:551. Use VT MMU to partition memory
related talks
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
25mCommSec D1 - A Deep Dive Into Malicious Documents
45mD2T1 - Expanding Your WMI Lateral Movement Arsenal
43mHunting for Bugs, Catching Dragons
40mCommSec D1 - The Life & Death of Kernel Object Abuse
55mThe Beast is in Your Memory
45m"Advanced Malware Threat: handling obfuscated code using..."