What method could a white-box attacker use to track the deletion of memory / files?

Question

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory.

If recognized, the malware would copy parts, which are not deleted yet, to other locations, which already have been deleted and thus effectively reverse the deletion process.

My questions are: how could a malware notice that a delete operation was initiated. And could the malware somehow recognize the addresses of the deletion process?

Of one considers deletion in terms of overwriting existing memory with a constant value (0 or 1), deleting a big file should lower the entropy of the memory contents. However, I believe this is not a reasonable approach.

Answer 1

There have been more visible instances of "memory only malware" and I think from a practical perspective you would drive yourself bonkers trying to find that needled in the haystack. What could you possibly look for? Page_Execute_ReadWrite calls? Mutexes? Not only that problem (which calls to look for), but when malware begins hooking into other processes, you would be seeing a lot of conflicting issues with legit processes duped into doing something (false positives) along with trying to consistently analyze running (changing) memory calls, routines, subroutines, opens, closes, etc

So you ask: "how could a malware notice that a delete operation was initiated" and I pose: "this would vary, every malware writer is different, there could never be a static method to do this." An attacker could chain multiple variables to ensure they're always going to run without having to worry about whether someone is going to delete it. E.g.:

(pseudocode)

home=c:\Users\someone\appdata\hidden_folder\here

if [ $home >= 0 ]
   then
       call this other {app, dll, cab, zip, etc}
       run other
fi

"Check to see if I exist, if I don't open something to put me back home"

This would live outside of the active process in another minimal application/call. There would be no need to program it into the malware itself. Sort of like a dropper. A dropper isn't the malware itself, only a means to an end (go out and download the malicious file).