Procedure examples

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.

ANELLDR can use the `ZwSetInformationThread` to enable debugger evasion.

DEADEYE can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.

Mango has the ability to use Native APIs.

InnaputRAT uses the API call ShellExecuteW for execution.

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.

Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.

Egregor has used the Windows API to make detection more difficult.

StealBit can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.

ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

build_downer has the ability to use the WinExec API to execute malware on a compromised host.

Winnti for Windows can use Native API to create a new process and to start services.

Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.

njRAT has used the ShellExecute() function within a script.

Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.

metaMain can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.

KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.

Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.

KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.

Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

Kevin can use the `ShowWindow` API to avoid detection.

StarProxy has used native windows API calls such as `GetLocalTime()` to retrieve system data.

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.

QakBot can use GetProcAddress to help delete malicious strings from memory.

DOWNIISSA can use the `URLDownloadToFileA()` API to download from remote resources.

Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.

Gelsemium has the ability to use various Windows API functions to perform tasks.

Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.

INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.

SplatCloak has utilized Native Windows API calls dynamically through `ZwQuerySystemInformation`.

Waterbear can leverage API functions for execution.

Lizar has used various Windows API functions on a victim's machine.

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

ADVSTORESHELL is capable of starting a process using CreateProcess.

StrifeWater can use a variety of APIs for execution.

WarzoneRAT can use a variety of API calls on a compromised host.

HermeticWizard can connect to remote shares using `WNetAddConnection2W`.

BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.

ShimRatReporter used several Windows API functions to gather information from the infected system.

SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.

PcShare has used a variety of Windows API functions.

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.

Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.