01 Briefing
Host-based defences — AMSI and EDR — are the controls most organisations lean on to catch malware at the moment it runs. Modern malware knows this, and the families doing real damage invest heavily in getting past exactly these layers.
The question this research set out to answer, in plain terms: how do current malware families actually evade the defences we rely on — not in theory, but observed sample by sample — and what should defenders change as a result?
02 Threat model
Three families were selected to cover three distinct adversary goals, so the evasion behaviours could be compared across motives rather than within one type of malware:
- Redline Stealer — commodity information stealer; harvests browser credentials, tokens, and wallet files, and exfiltrates them over its C2 channel.
- WannaCry — ransomware worm; mass file encryption plus shadow-copy deletion to inhibit recovery and force payment.
- SheetRAT — remote-access trojan; persistence, silent privilege escalation, and modular tooling pulled from C2 mid-run.
03 Method
All analysis ran in an isolated sandbox environment — no sample ever touched a production network. Each family went through the same pipeline, so the results are comparable:
- Static triage on REMnux — strings, imports, packing indicators, and obfuscation layers before any execution.
- Detonation in Any.Run — full behavioural capture: process tree, registry writes, file system activity, network beacons.
- Deobfuscation — peeling back staged loaders and runtime decoding to reach the behaviour underneath.
- ATT&CK mapping — every observed behaviour classified against MITRE ATT&CK Enterprise for industry-standard comparison.
- CTI reporting — findings written up as actionable threat-intelligence reports, IOC sets extracted and enriched.
04 Findings
amsi.dll in the loader's own process so every later scan call returns clean, before the real payload ever runs.
The headline finding is mapped as T1562.001 (Impair Defenses) in the coverage matrix below — but it was one of nine defense-evasion techniques observed. Evasion isn't a single trick; it's a layered posture: obfuscation to survive static analysis, sandbox fingerprinting to dodge automated detonation, and in-memory execution to stay off disk.
Every highlighted cell carries the analyst note from the original write-up — hover, tap, or focus a cell to read it.
Technique Coverage Map
30 techniques observed across Redline Stealer, WannaCry, and SheetRAT during sandbox analysis, mapped to 10 ATT&CK tactics. Hover, tap, or focus a highlighted cell for the analyst note.
05 Impact
- Detection guidance over signatures. The AMSI-patch finding argues for detecting the act of tampering (memory writes into
amsi.dll, suspiciousAmsiScanBufferpatches) rather than the payloads it hides — the payload changes weekly, the tamper technique doesn't. - An honest coverage picture. Mapping all 30 observed techniques to ATT&CK turned three sample reports into a reusable coverage map — the same method later applied to production detection engineering (see CF-002).
- Actionable CTI output. Each family produced a threat-intelligence report with extracted IOCs, written for the defenders who would consume them, not for the lab.