Malware Loader Goes Through Heaven's Gate to Avoid Detection

guest · Jul 1, 2019

Malware Loader Goes Through Heaven's Gate to Avoid Detection
July 1, 2019
https://www.bleepingcomputer.com/ne...goes-through-heavens-gate-to-avoid-detection/

Researchers discovered a malware loader specifically designed by its developers to hide in plain sight and allow the payload to evade detection by anti-malware solutions by injecting into the memory of compromised computers.
The malicious loader uses "the infamous 'Heaven's Gate' technique — a trick that allows 32-bit malware running on 64-bit systems to hide API calls by switching to a 64-bit environment," as described by Cisco Talos' Holger Unterbrink and Edmund Brumaghin.

As the Cisco Talos researchers found out, the malware payload is hidden within the packed and obfuscated loader which will unpack it and inject it a legitimate RegAsm.exe process using the process-hollowing.

RegAsm.exe will be created by the malware loader in a suspended state and, subsequently, its memory will be unmapped and replaced with the malicious payload. This means that the payload is never written to the compromised machine's disk making it that much harder for anti-malware software to detect it.

"This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of operating system design features," as per MITRE ATT&CK. "For example, mitigating specific API calls will likely have unintended side effects, such as preventing legitimate software (i.e., security products) from operating properly."
Click to expand...

Cisco Talos: RATs and stealers rush through “Heaven’s Gate” with new loader

Heaven's Gate technique [...] Some antivirus applications and debuggers are missing these calls as far as they are not expecting a 32-bit application running under the Microsoft WOW64 technology on a 64-bit system to use 64-bit calls directly.
Click to expand...

guest · Jul 2, 2019

More technical details about the 'Heaven's Gate' technique:

https://www.zdnet.com/article/malware-authors-are-still-abusing-the-heavens-gate-technique/

[...] write-ups by famous security researchers like Alex Ionescu and Marcus Hutchins [1, 2], but also others
Click to expand...

Log in or Sign up

Malware Loader Goes Through Heaven's Gate to Avoid Detection

guest Guest

guest Guest

Log in or Sign up

Malware Loader Goes Through Heaven's Gate to Avoid Detection

guest Guest

guest Guest

Useful Searches