Systems and methods for locating malware

A system for locating malware based on recent additions of executable objects, the system comprising:

• a conviction software module programmed to:
• identify a malicious behavior in a computing system;
• determine that the malicious behavior arises from a set of interrelated executable objects;
• a monitoring software module programmed to:
• identify an executable object recently added to the set of interrelated executable objects that is behaviorally opaque such that the set of interrelated executable objects obscures which executable object in the set is responsible for the malicious behavior, wherein the set of interrelated executable objects comprises an executable program and each executable object within the set of interrelated executable objects comprises an executable module used by the executable program such that the set of interrelated executable objects runs as a single process where each executable object in the set of interrelated executable objects is a component of the single process that loads into the single process;
• an attribution software module programmed to:
• attribute the malicious behavior to the recently added executable object based on when the recently added executable object was added to the set of interrelated executable objects;
• a remediation software module programmed to:
• perform a security action on the recently added executable object;
• one or more hardware processors configured to execute the conviction, monitoring, attribution, and remediation software modules.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:

• identify a malicious behavior in a computing system;
• determine that the malicious behavior arises from a set of interrelated executable objects that is behaviorally opaque such that the set of interrelated executable objects obscures which executable object in the set is responsible for the malicious behavior, wherein the set of interrelated executable objects comprises an executable program and each executable object within the set of interrelated executable objects comprises an executable module used by the executable program such that the set of interrelated executable objects runs as a single process where each executable object in the set of interrelated executable objects is a component of the single process that loads into the single process;
• identify an executable object recently added to the set of interrelated executable objects;
• attribute the malicious behavior to the recently added executable object based on when the recently added executable object was added to the set of interrelated executable objects;
• perform a security action on the recently added executable object.