{"id":6199,"date":"2025-08-16T10:04:28","date_gmt":"2025-08-16T10:04:28","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/16\/palo-alto-networks-released-a-mega-malware-analysis-tutorials-useful-for-every-malware-analyst\/"},"modified":"2025-08-16T10:04:28","modified_gmt":"2025-08-16T10:04:28","slug":"palo-alto-networks-released-a-mega-malware-analysis-tutorials-useful-for-every-malware-analyst","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/16\/palo-alto-networks-released-a-mega-malware-analysis-tutorials-useful-for-every-malware-analyst\/","title":{"rendered":"Palo Alto Networks Released A Mega Malware Analysis Tutorials Useful for Every Malware Analyst"},"content":{"rendered":"

Palo Alto Networks Released A Mega Malware Analysis Tutorials Useful for Every Malware Analyst
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Palo Alto Networks has published an extensive malware analysis tutorial detailing the dissection of a sophisticated .NET-based threat that delivers the Remcos remote access trojan (RAT).<\/p>\n

The malware\u2019s emergence highlights a trend in which threat actors increasingly abuse legitimate development environments and tools\u2014such as the Microsoft .NET runtime\u2014to execute complex, multi-stage infection campaigns.<\/p>\n

This particular sample demonstrates an elevated level of evasion capability, including managed-to-unmanaged code transitions, runtime API resolution, and process injection against benign executables.<\/p>\n

The attack chain begins with a seemingly innocuous .NET executable, obfuscated to conceal its intent. This initial loader retrieves an online payload masquerading as a PDF from a compromised Bitbucket repository.<\/p>\n

Instead of document data, the file contains Donut-generated shellcode designed to execute directly in memory. By avoiding disk writes, the attackers significantly reduce the risk of detection by traditional antivirus engines that rely on static signature scanning.<\/p>\n

Palo Alto Networks analysts identified<\/a> the sample during a targeted threat hunting operation and noted its ability to transition execution between different runtime environments, a hallmark of advanced intrusion techniques.<\/p>\n

Once downloaded, the payload undergoes a simple ASCII-hexadecimal decoding routine to reconstruct the actual shellcode.<\/p>\n

The loader uses .NET\u2019s interop services to invoke native Windows API calls dynamically, allocating executable memory with VirtualAlloc before copying the decoded payload into it.<\/p>\n

This combination of obfuscated managed code and late-bound unmanaged calls complicates static analysis, while also bypassing many heuristics that flag suspicious imports.<\/p>\n

Palo Alto Networks researchers noted that this deliberate API resolution at runtime allowed the attacker to omit sensitive imports from the Portable Executable (PE) header, further evading static detection.<\/p>\n

From a technical standpoint, the payload\u2019s sophistication is evident when examining the in-memory AMSI and ETW bypass routines.<\/p>\n

\n
\"\"
In-memory AMSI and ETW bypass routines (Source \u2013 GitHub)<\/figcaption><\/figure>\n<\/div>\n

AMSI functions such as AmsiScanBuffer<\/code> are patched directly in memory with instructions that force them to always return AMSI_RESULT_CLEAN<\/code>.<\/p>\n

A representative snippet illustrates this patching mechanism:-<\/p>\n

byte[] patch = { 0x33, 0xC0, 0xC2, 0x18, 0x00 }; \/\/ xor eax,eax; ret 0x18\nMarshal.Copy(patch, 0, amsiScanBufferPtr, patch.Length);<\/code><\/pre>\n
This ensures that even if security tools hook these functions, malicious buffers will appear harmless.<\/p>\n
Similarly, calls to EtwEventWrite<\/code> are replaced with a single ret<\/code> instruction, effectively blinding Event Tracing for Windows, which many endpoint detection products use to correlate malicious behaviors.<\/p>\n
One of the most technically intriguing aspects of the infection mechanism is its creation of a Common Language Runtime (CLR) instance from unmanaged shellcode.<\/p>\n
\n
\"\"
CLRCreateInstance (Source \u2013 GitHub)<\/figcaption><\/figure>\n<\/div>\n
After disabling defensive hooks, the shellcode uses CLRCreateInstance<\/code> and ICLRMetaHost::GetRuntime<\/code> to spawn a new .NET runtime within the same process, then loads an obfuscated<\/a> .NET assembly into an AppDomain<\/code>.<\/p>\n
Persistence of this execution chain<\/strong><\/h2>\n
The final stage leverages the _Type.InvokeMember<\/code> method to execute a specific entry point method inside that assembly, which in turn spawns InstallUtil.exe<\/code> in a suspended state.<\/p>\n
The persistence of this execution chain relies heavily on process injection. The malicious assembly writes a decrypted Remcos payload into the suspended process\u2019s memory via multiple WriteProcessMemory<\/code> calls before changing the memory protection back to PAGE_EXECUTE_READ<\/code> with VirtualProtectEx<\/code> and resuming execution.<\/p>\n
This multi-chunk injection method may help evade memory scanners designed to detect large, contiguous malicious allocations.<\/p>\n
While the dynamic analysis, conclusively shows the Remcos RAT<\/a> ASCII banner embedded in the injected executable, confirming the campaign\u2019s end goal.<\/p>\n
\n
\"\"
Remcos RAT ASCII banner (Source \u2013 GitHub)<\/figcaption><\/figure>\n<\/div>\n
By walking readers through every stage from initial obfuscation to final payload activation, Palo Alto Networks\u2019 tutorial not only dissects a live threat but also arms analysts with repeatable techniques for dissecting complex, hybrid-runtime malware<\/a>.<\/p>\n
This release stands out as both a detailed forensic walkthrough and a practical lab guide, making it a valuable resource for reverse engineers confronting threats that blend managed code obfuscation with native API exploitation in modern attack chains.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post Palo Alto Networks Released A Mega Malware Analysis Tutorials Useful for Every Malware Analyst<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Palo Alto Networks Released A Mega Malware Analysis Tutorials Useful for Every Malware Analyst Palo Alto Networks has published an extensive malware analysis tutorial detailing the dissection of a sophisticated .NET-based threat that delivers the Remcos remote access trojan (RAT). The malware\u2019s emergence highlights a trend in which threat actors increasingly abuse legitimate development environments […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6199","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6199"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6199"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6199\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}