Procedure examples

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.

Pikabot uses native Windows APIs to determine if the process is being debugged and analyzed, such as `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, `ProcessDebugPort`, and `ProcessDebugFlags`. Other Pikabot variants populate a global list of Windows API addresses from the `NTDLL` and `KERNEL32` libraries, and references these items instead of calling the API items to obfuscate execution.

RCSession can use WinSock API for communication including WSASend and WSARecv.

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.

Bumblebee can use multiple Native APIs.

Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.

RDFSNIFFER has used several Win32 API functions to interact with the victim machine.

Torisma has used various Windows API calls.

Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.

When executing with non-root permissions, RotaJakiro uses the the `shmget` API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the `execvp` API to help its dead process "resurrect".

AvosLocker has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.

PAKLOG has used Windows API `SetWindowsHookExW` with `idHook` set to `WH_KEYBOARD_LL` and a custom hook procedure to support its keylogging functions.

Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.

WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.

Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.

HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.

HeartCrypt can use Windows API functions to modify the Registry and `FindResourceW`, `LoadResource`, and `LockResource` to acquire a pointer to corresponding code resources.

Ursnif has used CreateProcessW to create child processes.

Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.

Prestige has used the `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()` functions to disable and restore file system redirection.

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().

SharpDisco can leverage Native APIs through plugins including `GetLogicalDrives`.

xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.

Pony has used several Windows functions for various purposes.

Nebulae has the ability to use CreateProcess to execute a process.

TONESHELL has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`. TONESHELL has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`. TONESHELL has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.

Medusa Ransomware has leveraged Windows Native API functions to execute payloads.

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.

AppleSeed has the ability to use multiple dynamically resolved API calls.

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.

TinyTurla has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.

BOOKWORM has used various Windows API calls during execution and defense evasion. BOOKWORM has created a buffer on the heap using `HeapCreate` and `HeapAlloc` which allows for copying of shell code and then execution on the heap is initiated through callback function of legitimate API functions such as `EnumChildWindows` or `EnumSystemLanguageGroupsA`.

HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.

Bad Rabbit has used various Windows API calls.

IMAPLoader imports native Windows APIs such as `GetConsoleWindow` and `ShowWindow`.

Aria-body has the ability to launch files using ShellExecute.

Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.

DynoWiper has used multiple native Windows functions, such as `GetLogicalDrives` and `FindNextFile` for discovery and file deletion.

BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.

PUBLOAD has used various Windows API calls during execution, when establishing persistence and defense evasion. PUBLOAD stager leveraged Windows API functions with callback including `GrayStringW`, `EnumDateFormatsA`, and `LineDDA` to bypass anti-virus monitoring. PUBLOAD has also utilized other native windows API functions with callback functions such as `EnumChildWindows` and `EnumSystemLanguageGroupsA`.

SystemBC has utilized native Windows API functions such as `EnumWindows`and `GetVolumeInformationA` during discovery activities.

Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.

Mafalda can use a variety of API calls.

CANONSTAGER has leveraged Native API calls to execute code within the victim’s system including `GetCurrentDirectoryW`, `RegisterClassW` and `CreateWindowExW`. CANONSTAGER also created a new overlapped window that initiates callback functions to a windows procedure that processes Windows messages until a designated message type of 0x0018 WM_SHOWWINDOW is observed which then initiates the deployment of a subsequent malicious payload.

PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.

ODAgent can pass commands using native APIs.

GuLoader can use a number of different APIs for discovery and execution.

WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.