Procedure examples

BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.

SystemBC has downloaded a text file into memory and set the area of memory via the VirtualProtect call. Then, SystemBC has executed the file via the CreateThread call.

WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.

LunarLoader can use reflective loading to decrypt and run malicious executables in a new thread.

PlugX has loaded its payload into memory.

Lumma Stealer has used reflective loading techniques to load content into memory during execution.

Cuba loaded the payload into memory using PowerShell.

ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.

MuddyViper has reflectively loaded the decrypted HackBrowserData tool in a new thread.

Fooder has reflectively loaded a payload into memory.

Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.

Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.

Lokibot has reflectively loaded the decoded DLL into memory.

IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.

BRUSHFIRE has executed its commands within memory and is not saved on disk.

Gelsemium can use custom shellcode to map embedded DLLs into memory.

Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.

SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.

PowerSploit reflectively loads a Windows PE file into a process.

Brute Ratel C4 has used reflective loading to execute malicious DLLs.

Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.

Pikabot features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.

Bumblebee can search for tools used in static analysis.

TONESHELL has leveraged custom exception handlers to hide code flow and stop execution of a debugger.

PUBLOAD has embedded debug strings with messages to distract analysts. PUBLOAD has leveraged `OutputDebugStringW` and `OutputDebugStringA` functions.

Mafalda can search for debugging tools on a compromised host.

Raspberry Robin leverages anti-debugging mechanisms through the use of ThreadHideFromDebugger.

RustyWater has registered a Vectored Exception Handler (VEH) to catch debugging efforts.

DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.

DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

ROKRAT can check for debugging tools.

PlugX has made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

Lumma Stealer has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.

PureCrypter has the ability to call `CheckRemoteDebuggerPresent`.

DarkGate checks the BeingDebugged flag in the PEB structure during execution to identify if the malware is being debugged.

LockBit 3.0 can check heap memory parameters for indications of a debugger and stop the flow of events to the attached debugger in order to hinder dynamic analysis.

ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.

Latrodectus has the ability to check for the presence of debuggers.

Saint Bot has used `is_debugger_present` as part of its environmental checks.

The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.

StrelaStealer variants include functionality to identify and evade debuggers.

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.

ANELLDR can call `ZwSetInformationThread` with the second argument set to `ThreadHideFromDebugger (0x11)` to evade being debugged.

StealBit can detect it is being run in the context of a debugger.

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.

Cuckoo Stealer can create and populate property list (plist) files to enable execution.

In older versions, XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system. In later versions, XCSSET leverages a third-party notarized `dockutil` tool to modify the `.plist` file responsible for presenting applications to the user in the Dock and LaunchPad to point to a malicious application.

Pacu can create malicious Lambda functions.