Saad AHLA
@d1rkmtr • 7,815 subscribers
Instructor @AlteredSecurity || Author of Evasion Lab (CETP) || Learner
Videos
![Very stealthy way of dumping LSASS, is done from the kernel, doesn't matter if LSASS is LSA Protected. Once loaded, the rootkit creates a system thread (PsCreateSystemThread) for dumping LSASS, iterates over all processes gets its EPROCESS (PsLookupProcessByProcessId ), then its name (PsGetProcessImageFileName), attaches to LSASS with (KeStackAttachProcess), once attached a file on disk (C:\dump.dmp) to receive memory pages dump, then the memory dumping process starts with (ZwQueryVirtualMemory) to query each virtual memory page info, including its base address and size, then (ZwWriteFile) is used to write that page to the dump file on disk. ====== For Professional Inquiries, freelance, contact on LinkedIn or Gmail (saaad.ahla@gmail[.]com), looking forward to new opportunities.](https://image.24vids.com/tw-1933208962741960874/amplify_video_thumb/1933208834576723968/img/YHpJfKh_9NavtA6y.jpg)
Very stealthy way of dumping LSASS, is done from the kernel, doesn't matter if LSASS is LSA Protected. Once loaded, the rootkit creates a system thread (PsCreateSystemThread) for dumping LSASS, iterates over all processes gets its EPROCESS (PsLookupProcessByProcessId ), then its name (PsGetProcessImageFileName), attaches to LSASS with (KeStackAttachProcess), once attached a file on disk (C:\dump.dmp) to receive memory pages dump, then the memory dumping process starts with (ZwQueryVirtualMemory) to query each virtual memory page info, including its base address and size, then (ZwWriteFile) is used to write that page to the dump file on disk. ====== For Professional Inquiries, freelance, contact on LinkedIn or Gmail (saaad.ahla@gmail[.]com), looking forward to new opportunities.
d1rkmtr22,041 views • 11 months ago
Detecting AnyRun sandbox more sandbox detection coming out in the future. Link :
d1rkmtr13,573 views • 6 months ago
🚨 I'm looking for a Job🚨 A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess. Project : =========== Looking for roles in User/Kernel mode Malware Dev, Evasion, Reverse Eng, Kernel Exploit Weaponization, Red Team dev/operation, APT Emulation (Ransomware/Stealer/C2 tooling Emulation) ... Can do Blue Team also.
Saad AHLA17,113 views • 1 year ago
No more content to load