Procedure examples

BlackByte Ransomware uses the `SetThreadExecutionState` API to prevent the victim system from entering sleep.

SodaMaster can use RegOpenKeyW to access the Registry.

Grandoreiro can execute through the WinExec API.

ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.

Caminho can use `System.Net.WebClient.downloadString()` for file download.

Bazar can use various APIs to allocate memory and facilitate code execution/injection.

XLoader uses the native Windows API for functionality, including defense evasion.

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

Kapeka utilizes WinAPI calls to gather victim system information.

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe Cobalt Strike can also use `CreateThreadpoolWait`, `SetThreadpoolWait`, and `MessageBoxA` for sandbox evasion and execution of embedded payloads in memory.

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.

REvil can use Native API for execution and to retrieve active services.

Samurai has the ability to call Windows APIs.

Milan can use the API `DnsQuery_A` for DNS resolution.

OilBooster has used the `ShowWindow` and `CreateProcessW` APIs.

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.

CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.

Cyclops Blink can use various Linux API functions including those for execution and discovery.

PLEAD can use `ShellExecute` to execute applications.

TRAILBLAZE has leveraged raw syscalls to execute commands.

GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.

Pillowmint has used multiple native Windows APIs to execute and conduct process injections.

MacMa has used macOS API functions to perform tasks.

FunnyDream can use Native API for defense evasion, discovery, and collection.

SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.

SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.

ANELLDR can use the `ZwSetInformationThread` to enable debugger evasion.

DEADEYE can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.

Mango has the ability to use Native APIs.

InnaputRAT uses the API call ShellExecuteW for execution.

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.

Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.

Egregor has used the Windows API to make detection more difficult.

StealBit can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.

ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

build_downer has the ability to use the WinExec API to execute malware on a compromised host.

Winnti for Windows can use Native API to create a new process and to start services.

Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.

njRAT has used the ShellExecute() function within a script.

Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.

KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.