{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/20","repository_url":"https://api.github.com/repos/cuckoosandbox/monitor","labels_url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/20/comments","events_url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/20/events","html_url":"https://github.com/cuckoosandbox/monitor/issues/20","id":140484017,"number":20,"title":"Avoid escaping the hooks through fresh LoadLibrary or MemoryModule?","user":{"login":"danielgindi","id":366926,"avatar_url":"https://avatars.githubusercontent.com/u/366926?v=3","gravatar_id":"","url":"https://api.github.com/users/danielgindi","html_url":"https://github.com/danielgindi","followers_url":"https://api.github.com/users/danielgindi/followers","following_url":"https://api.github.com/users/danielgindi/following{/other_user}","gists_url":"https://api.github.com/users/danielgindi/gists{/gist_id}","starred_url":"https://api.github.com/users/danielgindi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielgindi/subscriptions","organizations_url":"https://api.github.com/users/danielgindi/orgs","repos_url":"https://api.github.com/users/danielgindi/repos","events_url":"https://api.github.com/users/danielgindi/events{/privacy}","received_events_url":"https://api.github.com/users/danielgindi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-13T13:08:05Z","updated_at":"2016-03-20T09:53:10Z","closed_at":null,"body":"I bumped into this article:\r\nhttp://www.malwaretech.com/2013/09/fighting-hooks-with-hooks-sandbox-escape.html\r\n\r\nThis guy show a way (with example code) to escape hook, by making `LoadLibrary` load a fresh copy of a specific dll.\r\nHe also mentions that there's no available code that replicated `LoadLibrary` behaviour and that this is very complex - but now there's also https://github.com/fancycode/MemoryModule, so it makes it real easy to load a library without going through `LoadLibrary`.\r\n\r\nThis makes the cuckoo monitor unreliable for the next gen malware... Are there other known methods to trace the API calls?"},"comment":{"url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/comments/198887658","html_url":"https://github.com/cuckoosandbox/monitor/issues/20#issuecomment-198887658","issue_url":"https://api.github.com/repos/cuckoosandbox/monitor/issues/20","id":198887658,"user":{"login":"jbremer","id":1148773,"avatar_url":"https://avatars.githubusercontent.com/u/1148773?v=3","gravatar_id":"","url":"https://api.github.com/users/jbremer","html_url":"https://github.com/jbremer","followers_url":"https://api.github.com/users/jbremer/followers","following_url":"https://api.github.com/users/jbremer/following{/other_user}","gists_url":"https://api.github.com/users/jbremer/gists{/gist_id}","starred_url":"https://api.github.com/users/jbremer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbremer/subscriptions","organizations_url":"https://api.github.com/users/jbremer/orgs","repos_url":"https://api.github.com/users/jbremer/repos","events_url":"https://api.github.com/users/jbremer/events{/privacy}","received_events_url":"https://api.github.com/users/jbremer/received_events","type":"User","site_admin":false},"created_at":"2016-03-20T09:53:10Z","updated_at":"2016-03-20T09:53:10Z","body":"You'll still be able to intercept the system calls, if just from a kernel context :)"}}