Threat Hunting Exercise: Analyzing EDR Reflective DLL Injection / Process Hollowing Dataset

This hunt uses a simulated EDR/Sysmon dataset (edr_reflective_dll_hollow_2022-07-30T110000.json) capturing T1055.001: Dynamic-link Library Injection and T1055.012: Process Hollowing, where an adversary's loader creates a legitimate-looking process in a suspended state, replaces its memory image with malicious code, and resumes it - evading detections that rely solely on disk-based file scanning.

Step 1: Hypothesis Formation

Hypothesis: A process is created with CREATE_SUSPENDED, followed by memory operations (WriteProcessMemory, NtUnmapViewOfSection, SetThreadContext) targeting its own primary module region, then resumed - with the resulting process's memory-mapped image diverging from its on-disk file (a strong hollowing indicator), and a DLL reported as loaded without a corresponding Image Load event referencing that path on disk. Indicators:

Sysmon Event 8 (CreateRemoteThread) or Event 25 (Process Tampering) flags divergence between the process's on-disk image and in-memory image.
Sysmon Event 10 (ProcessAccess) shows a process (often the loader/dropper) requesting PROCESS_VM_WRITE/PROCESS_VM_OPERATION access to a newly-created, suspended child process of a common legitimate binary (e.g., svchost.exe, RegAsm.exe).
The "legitimate" process (e.g., svchost.exe) subsequently makes network connections or file writes inconsistent with its normal behavior profile.
No corresponding Sysmon Event 7 (Image Load) for the malicious module - reflective DLL loading intentionally avoids the standard loader path to evade image-load-based detection.

Null Hypothesis: The behavior is legitimate - some security/monitoring/updater tools use similar process-creation patterns (e.g., certain application virtualization or anti-cheat/DRM software) for legitimate protection purposes. Invalidate via hash/signature verification of the parent loader process against known-good vendor binaries.

Rationale: Process hollowing and reflective DLL injection are specifically designed to defeat disk-based AV and naive process-listing defenses by making malicious code appear to run "inside" a trusted, signed binary; this hunt validates memory-behavior-based EDR telemetry as the necessary detection layer.

Step 2: Data Sources and Scope

Sources: EDR/Sysmon (Event 1 process create, 7 image load, 8 CreateRemoteThread, 10 ProcessAccess, 25 ProcessTampering); Process memory-image hash comparison (EDR feature).
Scope: ~2022-07-30T11:00:00-11:10:00 UTC; Host: WKS-FIN-027 (10.140.8.14); Loader: invoice_report.exe (delivered via phishing attachment); Target process: RegAsm.exe.
SIEM Queries (Splunk/ELK):
Suspended-process + memory write chain: index=sysmon EventID=10 GrantedAccess="0x1F0FFF" OR GrantedAccess="0x1FFFFF" TargetImage="RegAsm.exe"
Process tampering: index=sysmon EventID=25
Missing image-load for known-injected DLL: index=sysmon EventID=8 SourceImage="invoice_report.exe" TargetImage="RegAsm.exe"

Step 3: Key Findings

Parsed events (7 shown) confirm a phishing-delivered loader hollowed out a legitimate RegAsm.exe process to run injected code undetected by disk-based scanning.

Timestamp (UTC)	Host	Process	Event	IOC/Why Suspicious?
2022-07-30 11:00:14	WKS-FIN-027	invoice_report.exe	Sysmon 1 (Process Create)	Loader executed from a Downloads folder after being opened from an email attachment - initial execution.
2022-07-30 11:00:20	WKS-FIN-027	invoice_report.exe → RegAsm.exe	Sysmon 1 (Process Create), CREATE_SUSPENDED flag set	Suspended-creation IOC: `RegAsm.exe` (a legitimate .NET utility, rarely launched by a document-viewer-style app) started in a suspended state - the first stage of hollowing.
2022-07-30 11:00:21	WKS-FIN-027	invoice_report.exe → RegAsm.exe	Sysmon 10 (ProcessAccess), GrantedAccess=0x1FFFFF (PROCESS_ALL_ACCESS)	Memory-access IOC: full-access handle opened by the loader against its own freshly-spawned child - required for the subsequent unmap/write/resume sequence.
2022-07-30 11:00:22	WKS-FIN-027	RegAsm.exe	Sysmon 25 (Process Tampering) - Type: "Image is replaced"	Core hollowing IOC: EDR's memory-image comparison flags that RegAsm.exe's in-memory image no longer matches its on-disk file - direct confirmation of hollowing.
2022-07-30 11:00:23	WKS-FIN-027	RegAsm.exe	Thread resumed; no Sysmon 7 (Image Load) for any new module	Reflective-load IOC: the malicious code is now executing inside RegAsm.exe's memory space, but no standard module-load event was generated - consistent with manual/reflective mapping rather than `LoadLibrary`.
2022-07-30 11:01:05	WKS-FIN-027	RegAsm.exe	Sysmon 3 (Network Connection) to 91.219.238.12:443	Behavioral IOC: RegAsm.exe (normally a local-only .NET registration utility) initiates an external network connection - activity entirely inconsistent with its legitimate purpose.
-	-	(binary verification)	invoice_report.exe: unsigned, hash not present in any vendor catalog	Legitimacy check IOC: the loader itself has no legitimate signature or vendor association, ruling out a benign application-protection tool explanation.

Validation:

Timeline: Suspended process creation → memory access → tampering flag → resume → immediate external network connection, all within 10 seconds - the complete, fast-executing hollowing chain.
False Positives: Loader binary is unsigned and unrecognized, ruling out legitimate DRM/anti-cheat software explanations; the tampering-flag directly confirms memory-image divergence.
Correlation: Single loader, single target process, single host - a contained, high-confidence injection event tied to a specific phishing delivery.

Step 4: Recommendations & Next Steps

Immediate Response: Isolate WKS-FIN-027; terminate the hollowed RegAsm.exe process and kill invoice_report.exe; capture full memory image before termination if possible for malware analysis; identify and block 91.219.238.12; trace the phishing email to identify other potential recipients across the organization.
Detection: Sigma-style rule: title: Process Hollowing via Suspended Creation and Image Tampering → selection1: EventID=1 with CREATE_SUSPENDED | selection2: EventID=25 (Process Tampering) on the same target PID within a short window - this pairing is one of the highest-confidence EDR-native detections available for this technique class.
Pro Tip: Legitimate software very rarely launches utility binaries like RegAsm.exe, InstallUtil.exe, or MSBuild.exe in a suspended state - build a watchlist of commonly-abused "LOLBIN-as-hollowing-target" processes and alert on any suspended-creation + full-access-handle pattern against them, regardless of the parent process's reputation.

Hypothesis confirmed - a phishing-delivered loader used classic process hollowing to inject malicious code into a legitimate RegAsm.exe process, evading disk-based detection!