ID	B0003
Objective(s)	Anti-Behavioral Analysis
Related ATT&CK Techniques	Virtualization/Sandbox Evasion (T1497, T1633)
Anti-Analysis Type	Evasion
Version	2.0
Created	1 August 2019
Last Modified	21 November 2022

Dynamic Analysis Evasion

Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine.

See Emulator Evasion (B0004) for an emulator-specific evasion behavior, and see Conditional Execution (B0025) for a behavior that constrains dynamic execution based on environmental conditions.

The related Virtualization/Sandbox Evasion (T1497, T1633) ATT&CK techniques were defined subsequent to this MBC behavior.

Methods

Name	ID	Description
Alternative ntdll.dll	B0003.001	A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.
API Hammering	B0003.012	Uses of a huge number of calls to Windows APIs as a form of extended sleep to evade analysis in sandbox environments.
Code Integrity Check	B0003.011	Compares memory-based and disk-based versions of itself. If differences are detected, the malware alters its execution, possibly acting destructively.
Data Flood	B0003.002	Overloads a sandbox by generating a flood of meaningless behavioral data. [1]
Delayed Execution	B0003.003	Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's Virtualization/Sandbox Evasion: Time Based Evasion sub-technique.
Demo Mode	B0003.004	Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.
Drop Code	B0003.005	Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).
Encode File	B0003.006	Encode a file on disk, such as an implant's config file.
Hook File System	B0003.007	Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.
Hook Interrupt	B0003.008	Modification of interrupt vector or descriptor tables.
Illusion	B0003.009	Creates an illusion; makes the analyst think something happened when it didn't.
Restart	B0003.010	Restarts or shuts down system to bypass sandboxing.

Use in Malware

Name	Date	Method	Description
Ursnif	May 2016	--	Ursnif uses malware macros to evade sandbox detection. [2]
Terminator	October 2013	--	The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [3]
Nap	2013	--	Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [3]
Smokeloader	2019	--	Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [4]
WebCobra	2018	--	Evades dynamic analysis.)
Rombertik	2015	--	The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions [5]
TrickBot	2016	--	Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [6]