In-memory encryption of beacon

In-memory encryption of Beacon: Another method for evading detection in memory involves encrypting the executable memory regions of the implant while in a dormant state.

• Attackers can perform this type of attack by identifying a beacon sleep hook, such as Sleep() in the target system.
• During sleep, they locate the memory segment containing the shellcode.
• If it meets specific criteria such as MEM_PRIVATE and EXECUTABLE, it is encrypted using the XOR function.
• Now, the attackers invoke Sleep() which leads to a temporary pause in the execution.
• Upon Sleep() return, they decrypt a previously encrypted memory segment containing shellcode and restore the original shellcode.
• By obfuscating the shellcode during sleep and resuming its execution, attackers can effectively bypass security solutions.

beacon sleep hook

How Beacon Sleep Hook Works:

1. Beacon Dormancy:

   • When the beacon is not performing any active malicious tasks (such as communicating with a C2 server, spreading malware, or exfiltrating data), it enters a dormant state or “sleep mode.”
   • The sleep hook is essentially a function like Sleep() or any similar function (e.g., NtDelayExecution) in the target system, which pauses the execution of the malware for a defined period, usually in milliseconds or seconds.

2. Locating and Encrypting the Beacon Memory:

   • During sleep, the attacker can access the memory of the beacon and encrypt the malicious code (shellcode) that is injected into the system’s memory.
   • The memory segment containing the beacon’s shellcode, which is often marked as MEM_PRIVATE and EXECUTABLE, is encrypted using a simple technique, such as XOR encryption.
   • This makes the beacon’s presence less detectable by traditional security measures, as the encrypted code does not match signature-based or heuristic detection systems.

3. Decryption and Resumption:

   • When the beacon “wakes up” (i.e., when the sleep function finishes), the attacker decrypts the previously encrypted memory segment that contains the shellcode.
   • The shellcode is then restored to its original state and can continue its malicious actions, such as communicating with the C2 server or carrying out commands.

4. Bypassing Detection:

   • The sleep hook allows attackers to temporarily hide the malicious activity during periods of dormancy.
   • This technique can evade security solutions like Endpoint Detection and Response (EDR) or Antivirus software, which might only scan the memory or system for active malware during its wakeful state.