Skip to content

T1497 Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.1

Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.2

Item Value
ID T1497
Sub-techniques T1497.001, T1497.002, T1497.003
Tactics TA0005, TA0007
Platforms Linux, Windows, macOS
Version 1.3
Created 17 April 2019
Last Modified 18 October 2021

Procedure Examples

ID Name Description
S0331 Agent Tesla Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.8
S0534 Bazar Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.17
S0268 Bisonal Bisonal can check to determine if the compromised system is running on VMware.12
S1070 Black Basta Black Basta can make a random number of calls to the kernel32.beep function to hinder log analysis.4
S1039 Bumblebee Bumblebee has the ability to perform anti-virtualization checks.14
S0484 Carberp Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.18
S0023 CHOPSTICK CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.7
S0046 CozyCar Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.15
G0012 Darkhotel Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.22
S0554 Egregor Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.56
S0666 Gelsemium Gelsemium can use junk code to generate random activity to obscure malware behavior.20
S0499 Hancitor Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.16
S1020 Kevin Kevin can sleep for a time interval between C2 communication attempts.21
S0455 Metamorfo Metamorfo has embedded a “vmdetect.exe” executable to identify virtual machines at the beginning of execution.13
C0005 Operation Spalax During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.23
S0147 Pteranodon Pteranodon has the ability to use anti-detection functions to identify sandbox environments.19
S0148 RTM RTM can detect if it is running within a sandbox or other virtualized analysis environment.3
S1030 Squirrelwaffle Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.1011
S0380 StoneDrill StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.9

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process OS API Execution

References

  1. Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021. ↩

  2. Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April 23, 2019. ↩

  3. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. ↩

  4. Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023. ↩

  5. Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020. ↩

  6. NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020. ↩

  7. FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. ↩

  8. Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020. ↩

  9. Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019. ↩

  10. Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022. ↩

  11. Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022. ↩

  12. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. ↩

  13. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. ↩

  14. Merriman, K. and Trouerbach, P. (2022, April 28). This isn’t Optimus Prime’s Bumblebee but it’s Still Transforming. Retrieved August 22, 2022. ↩

  15. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015. ↩

  16. Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020. ↩

  17. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020. ↩

  18. Matrosov, A., Rodionov, E., Volkov, D., Harley, D. (2012, March 2). Win32/Carberp When You’re in a Black Hole, Stop Digging. Retrieved July 15, 2020. ↩

  19. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022. ↩

  20. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021. ↩

  21. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  22. Arunpreet Singh, Clemens Kolbitsch. (2015, November 5). Defeating Darkhotel Just-In-Time Decryption. Retrieved April 15, 2021. ↩

  23. M. Porolli. (2021, January 21). Operation Spalax: Targeted malware attacks in Colombia. Retrieved September 16, 2022. ↩