Examples of process hollowing
This example is from the RunPE project. It can be found under the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; please refer to the complete source code to see all the details of the project.
This section illustrates how file mapping techniques can be maliciously exploited by hackers on the front line. This technique has been used by Ocean Lotus, a Vietnamese national cyber-army organization. This example has been adapted from the open source project RunPE (github.com/Zer0Mem0ry/RunPE) for demonstration purposes.
After understanding the whole process from static mapping to file mapping, you may have thought of the following question: if we run a program signed with digital signatures from known and valid companies (for example, a Microsoft update package, an installer in a large company, and so on), and replace the mounted PE module in the process with a...
