Research Article
A Measurement Study on Interprocess Code Propagation of Malicious Software
@INPROCEEDINGS{10.1007/978-3-031-56583-0_18, author={Thorsten Jenke and Simon Liessem and Elmar Padilla and Lilli Bruckschen}, title={A Measurement Study on Interprocess Code Propagation of Malicious Software}, proceedings={Digital Forensics and Cyber Crime. 14th EAI International Conference, ICDF2C 2023, New York City, NY, USA, November 30, 2023, Proceedings, Part II}, proceedings_a={ICDF2C PART 2}, year={2024}, month={4}, keywords={Malware Code Injections Code Propagation}, doi={10.1007/978-3-031-56583-0_18} }- Thorsten Jenke
Simon Liessem
Elmar Padilla
Lilli Bruckschen
Year: 2024
A Measurement Study on Interprocess Code Propagation of Malicious Software
ICDF2C PART 2
Springer
DOI: 10.1007/978-3-031-56583-0_18
Abstract
The propagation of code from one process to another is an important aspect of many malware families and can be achieved, for example, through code injections or the launch of new instances. An in-depth understanding of how and when malware uses interprocess code propagations would be a valuable aid in the analysis of this threat, since many dynamic malware analysis and unpacking schemes rely on finding running instances of malicious code. However, despite the prevalence of such propagations, there is little research on this topic. Therefore, in this work, we aim to extend the state-of-the-art by measuring both the behavior and the prevalence of interprocess code propagations of malicious software. We developed a method based on API-tracing for measuring code propagations in dynamic malware analysis. Subsequently, we implemented this method into a proof-of-concept implementation as a basis for further research. To gain more knowledge on the prevalence of code propagations and the code propagation techniques used, we conducted a study using our implementation on a real-world data set of 4853 malware samples from 1747 families. Our results show that more than a third (38.13%) of the executables use code propagation, which can be further classified into four different topologies and 24 different code propagation techniques. We also provide a list of the most significant representative malware samples for each of these topologies and techniques as a starting point for researchers aiming to develop countermeasures against code propagation.
