Process Enumeration

Introduction

Code and executables download: From GitHub

Process discovery is performed for a variety of reasons:

• Understanding whether the malware is running in a sandbox or a virtual machine by checking for standard VMware/VirtualBox processes
• Understanding whether the malware is being analyzed by checking for tools like Procmon, Wireshark, and similar applications
• Finding a process to attach to in order to execute a malicious payload

This section focuses on the first two points, as they are very similar to each other. The main focus is understanding how the enumeration can be done with different sets of Windows APIs. There are generally three methods:

1. Using CreateToolhelp32Snapshot 1, Process32First 2 and Process32Next 3
2. Using EnumProcesses 4, OpenProcess 5, EnumProcessModules 6 and GetModuleBaseNameA 7
3. Using NtQuerySystemInformation 8.

These three approaches are presented below.