Procedure examples

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.

CLAIMLOADER has used various Windows API calls during execution, when establishing persistence and defense evasion. CLAIMLOADER has also leveraged the legitimate API functions to run its shellcode through the callback function, including `GetDC()` and `EnumFontsW()`. CLAIMLOADER established persistence by utilizing the API `SHSetValue()`. CLAIMLOADER has utilized APIs with callback functions such as `EnumpropsExW`, `EnumSystemLanguageGroupsA`, and `EnumCalendarInfoExW`.

Volgmer executes payloads using the Windows API call CreateProcessW().

WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.

Conti has used API calls during execution.

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.

Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.

Siloscape makes various native API calls.

RustyWater has used `CreateObject` to instantiate a WScript.Shell Component Object Model (COM) object.  Additionally, RustyWater has used `VirtualAllocEx` and `WriteProcessMemory` to inject shellcode into explorer.exe.

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.

HTTPTroy has leveraged Windows Native API calls, including `GetProcAddress` to execute functions in memory.

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.

CHIMNEYSWEEP can use Windows APIs including `LoadLibrary` and `GetProcAddress`.

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.

DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.

DRATzarus can use various API calls to see if it is running in a sandbox.

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.

ShimRat has used Windows API functions to install the service and shim.

Chrommme can use Windows API including `WinExec` for execution.

Avaddon has used the Windows Crypto API to generate an AES key.

Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.

CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.

Pteranodon has used various API calls.

DarkTortilla can use a variety of API calls for persistence and defense evasion.

ROKRAT can use a variety of API calls to execute shellcode.

SplatDropper has utilized hashed Native Windows API calls.

Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.

Exbyte calls `ShellExecuteW` with the `IpOperation` parameter `RunAs` to launch `explorer.exe` with elevated privileges.

PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.

Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.

NOOPLDR can use native APIs `NtProtectVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateThreadEx` to aid process injection.

S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.

Explosive has a function to call the OpenClipboard wrapper.

LightNeuron is capable of starting a process using CreateProcess.

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution. DarkGate has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.

LockBit 3.0 has the ability to directly call native Windows API items during execution.

SVCReady can use Windows API calls to gather information from an infected host.

ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.

Netwalker can use Windows API functions to inject the ransomware DLL.

Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.

Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.

Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.

LODEINFO can use Windows APIs such as `VirtualAllocEx()`, `WriteProcessMemory()`, `CreateRemoteThread()`, `NtAllocateVirtualMemory()`, `NtWriteVirtualMemory()`, and `RtlCreateUserThread()` to enable memory injection of shellcode.

MuddyViper has the ability to relaunch itself using the `CreateProcessW` API.

Fooder has used the WinCrypt API for payload decryption, `DuplicateTokenEx` to duplicate the token of a specified process, and `CreateProcessAsUserA` for payload execution.