RUDE AWAKENING: UNMASKING SLEEP OBFUSCATION WITH TTTRACER

Summary from the TLDR InfoSec newsletter

Modern C2 implants will use sleep obfuscation where the implant encrypts itself and stays dormant for a period of time before decrypting itself, fetching and performing operations, and then repeating the cycle by encrypting itself again. This makes detection difficult because it is unlikely that an EDR will scan the system while the implant is decrypted. This author explores how to utilize Time Travel Debugging to detect when an implant decrypts itself and makes network calls. They note that this method is very successful but can be bypassed by malware authors by extending the sleep period to make the manual analysis untenable or by unloading the attached debugging DLL.