Procedure examples

metaMain can inject the loader file, Speech02.db, into a process.

Mis-Type has been injected directly into a running process, including `explorer.exe`.

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.

ShadowPad has injected an install module into a newly created process.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

DOWNIISSA can inject shellcode directly into process memory including WINWORD.exe and msiexec.exe.

BBK has the ability to inject shellcode into svchost.exe.

Waterbear can inject decrypted shellcode into the LanmanServer service.

Lizar can migrate the loader into another process.

WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.

SLOTHFULMEDIA can inject into running processes on a compromised host.

Sliver includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.

SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.

Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.

The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.

PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.

Remcos has a command to hide itself by injecting into another process.

Donut includes a subproject DonutTest to inject shellcode into a target process.

IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.

HTRAN can inject into into running processes.

The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.

Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Get2 has the ability to inject DLLs into processes.

Emissary injects its DLL file into a newly spawned Internet Explorer process.

PS1 can inject its payload DLL Into memory.

Havoc has DLL spawn and injection modules.

Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.

TONESHELL has used DLL injection to execute payloads received from the C2 server.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.

Emotet has been observed injecting in to Explorer.exe and other processes.

BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

Conti has loaded an encrypted DLL into memory and then executes it.

If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.

BlackEnergy injects its DLL component into svchost.exe.

DarkTortilla can use a .NET-based DLL named `RunPe6` for process injection.

Dyre injects into other processes to load modules.

Remsec can perform DLL injection.

Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.

Mongall can inject a DLL into `rundll32.exe` for execution.

The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

Elise injects DLL files into iexplore.exe.

Saint Bot has injected its DLL component into `EhStorAurhn.exe`.

Sagerunex is designed to be dynamic link library (DLL) injected into an infected endpoint and executed directly in memory.

Uroburos can use DLL injection to load embedded files and modules.

Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).

PipeMon can inject its modules into various processes using reflective DLL loading.

After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.

MegaCortex loads injecthelper.dll into a newly created rundll32.exe process.

SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.