Malware

Prolaco

Prolaco is a worm analyzed via Windows memory forensics using a memory image named prolaco.vmem. The content states that it is not a rootkit, but it has rootkit-like functionality: it can manipulate Windows kernel objects and hide its own processes by unlinking itself from kernel process structures, causing common live-response and memory-forensics tools such as Volatility/Rekall pslist and psview, Process Explorer, Process Hacker, and Windows Kernel Explorer to miss it. In the cited analysis, standard process enumeration with Volatility pslist and pstree did not show the hidden process, while psscan revealed it. One walkthrough associates a suspicious remote connection to an external IP with hidden PID 1336, which psscan identifies as process name 1_doc_RCData_61; another walkthrough highlights an unlinked process with PID 1136 in MemProcFS-assisted analysis. The content suggests the executable may be embedded in a file resource section based on the RCData-like process name, but this remains a hypothesis. The malware is discussed in the context of incident response and malware investigation on Windows XP x86 memory images, with analysts using Volatility and MemProcFS to recover process, process-tree, and command-line artifacts such as win_cmdline. High-confidence indicators from the content include the sample/memory image name prolaco.vmem, hidden process names/PIDs observed during analysis (notably 1_doc_RCData_61 / PID 1336, and PID 1136 in a separate example), and behavior involving hidden processes and suspicious outbound network connectivity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

3 techniques

T1014RootkitEvidence2

Prolaco is not a rootkit, but it does have the ability to manipulate kernel objects and hide its own processes.

T1564Hide ArtifactsEvidence1

We can’t simply say that any malware capable of manipulating kernel objects to hide processes is a rootkit... Prolaco is not a rootkit, but it does have the ability to manipulate kernel objects and hide its own processes.

T1564.001Hidden Files and DirectoriesEvidence1

tools like the Volatility framework and Rekall, using plugins such as pslist and psview, often fail to detect hidden processes that manipulate kernel objects... This type of malware simply unlinks itself from the EPROCESS structure

Discovery

2 techniques

T1046Network Service DiscoveryEvidence1

Next, let’s check for network connections specifically, any remote connections that a process may have established with an external IP address on various port numbers. It appears that a remote connection has been made to a suspicious IP address.

T1057Process DiscoveryEvidence1

The next commands I would like to use are pslist and pstree to view a list of processes... Fortunately, Volatility has another command, psscan, which can help reveal hidden processes.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

reversethemalware blogNews

Aug 1, 2025

Detecting and Identifying Hidden Processes (Volatility Edition)

A worm discussed as having rootkit-like stealth functionality, specifically the ability to manipulate kernel objects and hide its own processes.

reversethemalware blogNews

Aug 1, 2025

Detecting and Identifying Hidden Processes (MemProcFs Edition)

Referenced as the malware sample used for the memory dump analysis example involving hidden/unlinked processes in memory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Prolaco