To sum up process hollowing on Windows: basically, a legitimate PE binary (exe usually) is used to start a process in suspended state, after which process memory is replaced with code and data of a malicious/other binary, and the process is resumed. As far as the environment is concerned, the original legitimate binary is executing.

There is lots of information on this topic, but it all relates to Windows OS. Is this issue possible on other operating systems and how (for example, what sequence of system calls on Linux would indicate such behavior?).



A book, The Art of Memory Forensics, covers Linux-based process hollowing in chapter 25. You can see the module here -- https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/linux/process_hollow.py

Their technique looks at the main function and compares what is in-memory to what is on-disk. For Windows, using processhacker (or Process Explorer), you can compare the strings of the binary to the replaced process loaded into memory. It's the same set of techniques.

While unsure what system calls would be changed, it may be different depending on the Linux kernel, distro, and userland. You could use Sysdig Falco to determine characteristics about any Linux malware including and perhaps especially process hollowing and/or shared-library injection.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.