Briefing
AMSI and EDR are the host-based defences most organisations lean on to catch malware at the moment it runs. Modern malware knows this, and the families doing real damage invest heavily in getting past exactly these layers.
The question this research set out to answer, in plain terms: how do current malware families actually evade the defences we rely on, not in theory, but observed sample by sample, and what should defenders change as a result?
Threat model
Three families were selected to cover three distinct adversary goals, so the evasion behaviours could be compared across motives rather than within one type of malware:
- Redline Stealer: commodity information stealer. Harvests browser credentials, tokens, and wallet files, and exfiltrates them over its C2 channel.
- WannaCry: ransomware worm. Mass file encryption plus shadow-copy deletion to inhibit recovery and force payment.
- SheetRAT: remote-access trojan. Persistence, silent privilege escalation, and modular tooling pulled from C2 mid-run.
Method
All analysis ran in an isolated sandbox environment: no sample ever touched a production network. Each family went through the same five stages, so the results are comparable.
- Static triage on REMnux: strings, imports, packing indicators, and obfuscation layers before any execution.
- Detonation in Any.Run: full behavioural capture covering process tree, registry writes, file system activity, and network beacons.
- Deobfuscation: peeling back staged loaders and runtime decoding to reach the behaviour underneath.
- ATT&CK mapping: every observed behaviour classified against MITRE ATT&CK Enterprise for industry-standard comparison.
- CTI reporting: findings written up as actionable threat-intelligence reports, IOC sets extracted and enriched.
The same five stages ran for each of the three samples. 30 techniques across 10 tactics came out the other side.
Findings
Key finding
An obfuscated script used memory patching to disable AMSI tracing at
runtime: patching amsi.dll in the loader's own process so every
later scan call returns clean, before the real payload ever runs.
That finding is mapped as T1562.001, impair defenses, and it was one of nine defence-evasion techniques observed. Evasion is not a single trick; it is a layered posture: obfuscation to survive static analysis, sandbox fingerprinting to dodge automated detonation, and in-memory execution to stay off disk.
All 30 observed techniques are below, grouped by the ATT&CK tactic they serve, each with the analyst note from the original write-up and the samples it came from. Techniques that were in scope for a tactic but never produced by these samples are listed under the group.
Execution TA0002, 4 mapped
- T1059.001PowerShellReversed the PowerShell loader that stages the AMSI bypass before dropping the payload. Seen in Redline and SheetRAT.
- T1059.003Windows Command ShellFollowed cmd.exe spawns used to launch second-stage components inside the sandbox. Seen in SheetRAT.
- T1204.002Malicious FileDocumented user-detonated binaries as the initial execution trigger for each sample. Seen in all three samples.
- T1106Native APIIdentified direct native API calls used to run code off the monitored execution path. Seen in SheetRAT.
Not observedT1569.002 service execution.
Persistence TA0003, 2 mapped
- T1547.001Registry Run KeysConfirmed a Run key written to relaunch the stealer at each user logon. Seen in Redline.
- T1053.005Scheduled Task or JobRecovered a scheduled task the RAT registered for periodic re-execution. Seen in SheetRAT.
Not observedT1543.003 Windows service, T1574.002 DLL side-loading.
Privilege escalation TA0004, 1 mapped
- T1548.002Bypass User Account ControlObserved a UAC bypass used to elevate silently, with no consent prompt shown. Seen in SheetRAT.
Not observedT1134 access token manipulation.
Defense evasion TA0005, 9 mapped
- T1562.001Impair Defenses: Disable or Modify ToolsHeadline finding: decoded a script that memory-patches amsi.dll to kill AMSI tracing at runtime. Seen in the obfuscated loader.
- T1055Process InjectionTraced injection into a benign process so the stealer ran inside trusted memory. Seen in Redline.
- T1055.012Process HollowingConfirmed RunPE-style hollowing of a legitimate host process to mask execution. Seen in Redline.
- T1027Obfuscated Files or InformationPeeled back multi-layer string and payload obfuscation across all three families. Seen in all three samples.
- T1027.007Dynamic API ResolutionFound APIs resolved at runtime by hash to defeat static import analysis. Seen in SheetRAT.
- T1140Deobfuscate or Decode Files or InformationCaptured the runtime XOR/base64 decode of the staged payload in memory. Seen in all three samples.
- T1112Modify RegistryLogged registry edits that weaken host defenses and store configuration. Seen in Redline and SheetRAT.
- T1497Virtualization or Sandbox EvasionNoted sandbox fingerprinting and execution delays used to dodge automated analysis. Seen in SheetRAT.
- T1620Reflective Code LoadingWatched a reflective in-memory assembly load that never touched disk. Seen in Redline.
Not observedT1070.004 file deletion, T1218 system binary proxy execution.
Credential access TA0006, 2 mapped
- T1555.003Credentials from Web BrowsersExtracted Redline's routine for lifting saved browser passwords and cookies. Seen in Redline.
- T1552.001Credentials In FilesMapped its sweep for stored secrets, tokens, and cryptocurrency wallet files. Seen in Redline.
Not observedT1003 OS credential dumping.
Discovery TA0007, 4 mapped
- T1082System Information DiscoveryRecorded host, OS, and hardware fingerprinting used to profile the victim. Seen in all three samples.
- T1057Process DiscoverySaw process enumeration used to spot AV/EDR agents before acting. Seen in Redline and SheetRAT.
- T1518.001Security Software DiscoveryConfirmed checks for installed security products prior to payload execution. Seen in SheetRAT.
- T1083File and Directory DiscoveryTraced filesystem walks locating credential stores and document targets. Seen in Redline.
Not observedT1016 system network configuration discovery.
Collection TA0009, 2 mapped
- T1005Data from Local SystemCatalogued the documents and stealer loot pulled straight from local disk. Seen in Redline.
- T1560Archive Collected DataObserved harvested data bundled and staged before exfiltration. Seen in Redline.
Not observedT1113 screen capture.
Command and control TA0011, 3 mapped
- T1071.001Web ProtocolsCaptured HTTP(S) C2 beaconing back to attacker infrastructure. Seen in Redline and SheetRAT.
- T1573Encrypted ChannelVerified encrypted C2 traffic used to hide loot inside normal-looking TLS. Seen in Redline.
- T1105Ingress Tool TransferLogged additional modules being pulled from C2 mid-run. Seen in SheetRAT.
Not observedT1095 non-application layer protocol.
Exfiltration TA0010, 1 mapped
- T1041Exfiltration Over C2 ChannelFollowed stolen credentials and files sent back over the same C2 channel. Seen in Redline.
Not observedT1567.002 exfiltration to cloud storage.
Impact TA0040, 2 mapped
- T1486Data Encrypted for ImpactDetonated WannaCry to observe mass file encryption and the ransom-note drop. Seen in WannaCry.
- T1490Inhibit System RecoveryConfirmed shadow-copy deletion that blocks recovery to force ransom payment. Seen in WannaCry.
Not observedT1489 service stop.
Impact
- Detection guidance over signatures. The AMSI-patch finding argues for detecting the act of tampering (memory writes into
amsi.dll, suspiciousAmsiScanBufferpatches) rather than the payloads it hides: the payload changes weekly, the tamper technique does not. - An honest coverage picture. Mapping all 30 observed techniques to ATT&CK turned three sample reports into a reusable coverage map, the same method later applied to production detection engineering (see CF-002).
- Actionable CTI output. Each family produced a threat-intelligence report with extracted IOCs, written for the defenders who would consume them, not for the lab.