Procedure examples

Sagerunex calls the `WaitForSingleObject` API function as part of time-check logic.

LP-Notes has used the `ImpersonateLoggedOnUser` API to impersonate the security context of the taskhostw.exe process. Additionally, LP-Notes has also used the `CredUIPromptForWindowsCredentialsW` API to obtain Windows credentials.

Royal can use multiple APIs for discovery, communication, and execution.

BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.

Uroburos can use native Windows APIs including `GetHostByName`.

Metamorfo has used native WINAPI calls.

Embargo has leveraged Windows Native API functions to execute its operations.

Bandook has used the ShellExecuteW() function call.

PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.

KONNI has hardcoded API calls within its functions to use on the victim's machine.

gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.

Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.

Attor's dispatcher has used CreateProcessW API for execution.

LitePower can use various API calls.

After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.

BoxCaon has used Windows API calls to obtain information about the compromised host.

NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.

QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.

BlackByte Ransomware uses the `SetThreadExecutionState` API to prevent the victim system from entering sleep.

SodaMaster can use RegOpenKeyW to access the Registry.

Grandoreiro can execute through the WinExec API.

ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.

Caminho can use `System.Net.WebClient.downloadString()` for file download.

Bazar can use various APIs to allocate memory and facilitate code execution/injection.

XLoader uses the native Windows API for functionality, including defense evasion.

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

Kapeka utilizes WinAPI calls to gather victim system information.

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe Cobalt Strike can also use `CreateThreadpoolWait`, `SetThreadpoolWait`, and `MessageBoxA` for sandbox evasion and execution of embedded payloads in memory.

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.

REvil can use Native API for execution and to retrieve active services.

Samurai has the ability to call Windows APIs.

Milan can use the API `DnsQuery_A` for DNS resolution.

OilBooster has used the `ShowWindow` and `CreateProcessW` APIs.

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.

CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.

Cyclops Blink can use various Linux API functions including those for execution and discovery.

PLEAD can use `ShellExecute` to execute applications.

TRAILBLAZE has leveraged raw syscalls to execute commands.

GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.

Pillowmint has used multiple native Windows APIs to execute and conduct process injections.

MacMa has used macOS API functions to perform tasks.

FunnyDream can use Native API for defense evasion, discovery, and collection.

SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.

SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.