Procedure examples

Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.

CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.

Pteranodon has used various API calls.

DarkTortilla can use a variety of API calls for persistence and defense evasion.

ROKRAT can use a variety of API calls to execute shellcode.

SplatDropper has utilized hashed Native Windows API calls.

Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.

Exbyte calls `ShellExecuteW` with the `IpOperation` parameter `RunAs` to launch `explorer.exe` with elevated privileges.

PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.

Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.

NOOPLDR can use native APIs `NtProtectVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateThreadEx` to aid process injection.

S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.

Explosive has a function to call the OpenClipboard wrapper.

LightNeuron is capable of starting a process using CreateProcess.

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution. DarkGate has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.

LockBit 3.0 has the ability to directly call native Windows API items during execution.

SVCReady can use Windows API calls to gather information from an infected host.

ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.

Netwalker can use Windows API functions to inject the ransomware DLL.

Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.

Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.

Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.

LODEINFO can use Windows APIs such as `VirtualAllocEx()`, `WriteProcessMemory()`, `CreateRemoteThread()`, `NtAllocateVirtualMemory()`, `NtWriteVirtualMemory()`, and `RtlCreateUserThread()` to enable memory injection of shellcode.

MuddyViper has the ability to relaunch itself using the `CreateProcessW` API.

Fooder has used the WinCrypt API for payload decryption, `DuplicateTokenEx` to duplicate the token of a specified process, and `CreateProcessAsUserA` for payload execution.

Sagerunex calls the `WaitForSingleObject` API function as part of time-check logic.

LP-Notes has used the `ImpersonateLoggedOnUser` API to impersonate the security context of the taskhostw.exe process. Additionally, LP-Notes has also used the `CredUIPromptForWindowsCredentialsW` API to obtain Windows credentials.

Royal can use multiple APIs for discovery, communication, and execution.

BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.

Uroburos can use native Windows APIs including `GetHostByName`.

Metamorfo has used native WINAPI calls.

Embargo has leveraged Windows Native API functions to execute its operations.

Bandook has used the ShellExecuteW() function call.

PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.

KONNI has hardcoded API calls within its functions to use on the victim's machine.

gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.

Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.

Attor's dispatcher has used CreateProcessW API for execution.

LitePower can use various API calls.

After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.

BoxCaon has used Windows API calls to obtain information about the compromised host.

NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.

QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.