Procedure examples

TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.

APT37 injects its malware variant, ROKRAT, into the cmd.exe process.

Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.

Cobalt Group has injected code into trusted processes.

Wizard Spider has used process injection to execute payloads to escalate privileges.

Velvet Ant initial execution included launching multiple `svchost` processes and injecting code into them.

PLATINUM has used various methods of process injection including hot patching.

Kimsuky has the ability to load DLLs via reflective injection by allocating memory using `VirtualAllocEx()`, then decrypting a DLL with `WriteProcessMemory()` and invoking execution through `CreateRemoteThread()`.

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.

An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.

TA505 has been seen injecting a DLL into winword.exe.

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.

Malteiro has injected Mispadu’s DLL into a process.

A Lazarus Group malware sample performs reflective DLL injection.

Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.

Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.

Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.

FIN8 has injected malicious code into a new svchost.exe process.

BlackByte used process hollowing for defense evasion purposes.

Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.

A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.

menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.

TA2541 has used process hollowing to execute CyberGate malware.

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.

A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.

Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.

Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.

APT39 has utilized tools to capture mouse movements.

APT42 has used credential harvesting websites.

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.

APT3 has used a keylogging tool that records keystrokes in encrypted files.

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes. Kimsuky has also leveraged Native Windows API functions such as `GetAsyncKeyState()` along with others to capture keystrokes every 50 milliseconds and stores data in a file stored in the temp directory.

Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.

APT41 used a keylogger called GEARSHIFT on a target system.

menuPass has used key loggers to steal usernames and passwords.

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

APT39 has used tools for capturing keystrokes.

OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.

Ke3chang has used keyloggers.

Malware used by Group5 is capable of capturing keystrokes.

Darkhotel has used a keylogger.

APT28 has used tools to perform keylogging.

APT42 has used custom malware to log keystrokes.

APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.