Modern malware delivery mechanisms have largely graduated from noisy, cross-process memory manipulation techniques. Instead, sophisticated stagers increasingly abuse native operating system subsystems and execution boundaries to generate “ghost telemetry,” effectively misdirecting blue teams and blinding endpoint detection tools.

During a recent dynamic analysis detonation within my research sandbox, I isolated a highly evasive, fileless Formbook variant that successfully bypassed standard Sysmon endpoint monitoring. This write-up deconstructs how the sample manipulated Component Object Model (COM) boundaries to hide its network calling loop, how it abused an in-process .NET assembly wrapper to execute invisible intra-process self-hollowing, and the exact code-patching methodology I used to force the loader to dump its raw payload to disk.

The Sandbox Environment and the Initial Illusion

The analysis was performed within a hardened, custom-cloaked libvirt/QEMU hypervisor hosting an isolated Windows guest OS running a selective Sysmon ring 0 logging configuration profile.

Upon executing the initial stager, Sysmon generated definitive Event ID 22 (DNS Query) entries showing explorer.exe actively querying a massive array of multi-tiered decoy domains, alongside an active command and control (C2) node, facebutt.website.

However, cross-process logging remained completely dark. There were absolutely zero instances of Sysmon Event ID 8 (CreateRemoteThread) or Event ID 10 (ProcessAccess) targeting the Windows desktop shell.

This creates a deceptive forensic illusion. Because explorer.exe is the process physically putting the UDP packet on the wire, naive tracking logic flags Explorer as compromised. In reality, the malware was executing an in-process .NET assembly load combined with Windows Shell API abuse. By invoking native Windows Shell COM interfaces—such as IShellWindows or the Shell.Application object—the stager marshaled its network execution tasks across an Inter-Process Communication (IPC) boundary via Remote Procedure Call (RPC) straight to the desktop shell controller. The OS executed the DNS lookups on behalf of the COM request, effectively masking the true stager binary.

The Telemetry Gap: Intra-Process Self-Hollowing

Deep triage revealed that the core payload delivery was driven by a heavily obfuscated PowerShell-based .NET assembly unpacker. The script bypassed disk-backed signature scanners by staging its encrypted payload entirely inside volatile environmental buffers, concluding with a custom runtime execution wrapper named Set-ImageFrame.

To evaluate the injection mechanics, I deployed a highly targeted Sysmon patch tracking Event ID 25 (ProcessTampering), which monitors image replacement inconsistencies between disk-backed binaries and active memory space. Surprisingly, both Event ID 25 and Event ID 8 stayed completely dark during detonation.

The reason for this telemetry gap points to a significant blind spot in traditional endpoint event hooks: Intra-Process Self-Hollowing.

The Set-ImageFrame wrapper executes its memory hollowing loop completely within its own running process boundary. It manually defines P/Invoke signatures for native memory APIs, invokes NtUnmapViewOfSection to unmap its own local executable image view, and copies the decrypted Formbook payload directly over its own active base memory address. Finally, it manipulates its own thread context via SetThreadContext and ResumeThread.

Because a process maintains an implicit, absolute right to alter its own virtual memory allocations natively, no cross-process handles are generated. Furthermore, since the underlying powershell.exe disk binary is never physically swapped or substituted on the drive tracks with a conflicting PE file during execution, Sysmon’s file-system mini-filter drivers never register a process tampering exception.

The Interception: Turning the Unpacker Against Itself

When automated logging engines are blinded by runtime obfuscation and dynamic P/Invoke native call generation, the most reliable remediation strategy is to force the loader’s execution engine to handle the decryption for you.

By extracting the dropped .ps1 code from the volatile staging directories before its scheduled cleanup loop, I isolated the exact cryptographic boundary where the payload transitions from ciphertext to a raw binary memory array. The end of the loader featured the following sequence:

if (\$_ep.Trim().Length -lt 10) { return }

[byte[]]\(_db =\)null
try { \(_db = Read-PackedStream\)_ep } catch { return }
if (\$_db -eq null -or _db.Length -eq 0) { return }

\(_db = Expand-SecureBuffer\)_db \(_sk\)_si

Set-ImageFrame -_tgt \(_pt -_pl\)_db

Remove-Item 'C:\Users\Teal\AppData\Local\Temp\ujw5mqeq\clr_96705_dd6f.ps1' -Force -EA 0# PowerShell test file to determine AppLocker lockdown mode

The script utilizes Expand-SecureBuffer to apply an inline decryption matrix against the raw byte container ($_db). To intercept the payload prior to the un-hooked injection phase, I patched the script inside my isolated sandbox. I inserted a native .NET file-writing routine immediately after the buffer expansion, while simultaneously commenting out the live detonation hook and the anti-forensic self-deletion command:

\(_db = Expand-SecureBuffer\)_db \(_sk\)_si

# --- INTERCEPTION HOOK ---
[System.IO.File]::WriteAllBytes("C:\Users\Teal\Desktop\unpacked_formbook_payload.exe", \$_db)
# -------------------------

# Set-ImageFrame -_tgt \(_pt -_pl\)_db
# Remove-Item 'C:\Users\Teal\AppData\Local\Temp\ujw5mqeq\clr_96705_dd6f.ps1' -Force -EA 0

Conclusion and Takeaways

Executing the patched stager caused the PowerShell engine to perfectly expand the hidden binary, writing a clean, uncompressed, raw PE file (unpacked_formbook_payload.exe) straight to the desktop. Static analysis of the extracted artifact has revealed significant zero-day structural variations in its core C2 callback routines that deviate from traditional Formbook signatures.

For security operations teams and threat hunters, this research highlights a critical lesson: defender pipelines cannot rely solely on edge-case endpoint event logging like cross-process creation monitoring. When confronting advanced loaders that leverage intra-process self-hollowing and COM-based proxying, defenders must focus on comprehensive script block auditing (such as PowerShell Operational Event ID 4104) and robust memory-space inspection capabilities to expose threats that live entirely inside trusted system wrappers.

Here is the sample in question that was analyzed.