Debugging malicious services
While loading individual executables and DLLs for debugging is generally a pretty straightforward task, things get a little bit more complicated when we talk about debugging Windows services.
What is a service?
Services are tasks that are generally supposed to execute certain logic in the background, similar to daemons on Linux. So, it comes as no surprise that malware authors commonly use them to achieve reliable persistence.
Services are controlled by the Service Control Manager (SCM), which is implemented in %SystemRoot%\System32\services.exe. All services have the corresponding HKLM\SYSTEM\CurrentControlSet\services\<service_name> registry key. It contains multiple values that describe the service, including the following:
ImagePath: A file path to the corresponding executable with optional arguments.Type: TheREG_DWORDvalue specifies the type of the service. Let’s look at some examples of such supported values:0x00000001...
