Skip to content
λmaldev wiki/
pagesSleep Obfuscation
T1027.007Windowsx64C / C++

Sleep Obfuscation

updated 2026-07-197 min readthehackersbrain
Authorized use only. This material is published for detection engineering, malware analysis and authorized red-team engagements. Running these techniques against systems you do not own or have written permission to test is illegal.

Overview

An implant spends almost all of its life asleep. That idle window is exactly when a memory scanner runs, and a beacon sitting in plaintext RX memory is the easiest thing in the world to signature. Sleep obfuscation closes the window: before parking, the implant encrypts its own image, drops the pages to RW or NA, sleeps, then reverses the process.

The published families — Ekko, Foliage, Cronos and their descendants — differ mainly in how they get code to run while the main thread is parked. Timer queues, APCs and fibers all end up executing a short ROP chain that performs the mask, the wait and the unmask.

Note.

The mask is only as good as its timing. Scanners that sample on a randomised interval, rather than a fixed one, catch the unmasked window that every implementation still has to open to do work.

The call chain

  1. 1
    CreateTimerQueueTimer
    Queue a chain of timers that will run while the beacon thread is parked.
  2. 2
    RtlCaptureContext
    Snapshot the thread context so it can be restored after the mask/unmask cycle.
  3. 3
    VirtualProtect(RW) + SystemFunction032
    Flip the beacon's own pages to RW and RC4-encrypt them in place.
  4. 4
    WaitForSingleObject
    The actual sleep, during which the payload exists only as ciphertext.
  5. 5
    decrypt + VirtualProtect(RX)
    Reverse the cycle and NtContinue back into the beacon loop.

Detection

YARA
The queued RtlCaptureContext + NtContinue gadget sequence used by timer-based sleep masks.
ETW-TI
Repeating RX to RW to RX protection cycles on the same private region at a fixed interval.
MEMORY SCAN
A region with very high entropy that becomes readable code moments later — scan on a jitter offset.
BEHAVIOURAL
Timer-queue callbacks whose target address is private memory rather than a mapped module.

The protection-cycle signal is the durable one. Encryption defeats content matching by design, but a private region that oscillates between RW and RX on a regular cadence is behaviourally distinctive and survives every re-implementation of the mask itself.

Variants & related

T1106Direct & Indirect SyscallsThe primitives most sleep masks use to hide their own protection changes.→T1620Reflective DLL LoadingWhat the sleep mask is usually protecting from a memory scan.→
Was this page useful?edit this page ↗