Procedure examples

XLoader injects code into the APC queue using `NtQueueApcThread` API.

Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.

TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."

Ursnif has injected code into target processes via thread local storage callbacks.

CANONSTAGER uses the Thread Local Storage (TLS) array data structure to store function addresses resolved by its custom API hashing algorithm. The function addresses are later called throughout the binary from offsets into the TLS array.

PACEMAKER can use PTRACE to attach to a targeted process to read process memory.

Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.

Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.

TrickBot injects into the svchost.exe process.

RCSession can launch itself from a hollowed svchost.exe process.

Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.

Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.

For .NET payloads, HeartCrypt can use process hollowing to inject into processes spawned by csc.exe or AppLaunch.exe.

Ursnif has used process hollowing to inject into child processes.

The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

Emotet uses a copy of `certutil.exe` stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code.

Gootloader can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.

Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.

WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.

Raspberry Robin will execute a legitimate process, then suspend it to inject code for a Tor client into the process, followed by resumption of the process to enable Tor client execution.

IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.

ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.

BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.

Lumma Stealer has used process hollowing leveraging a legitimate program such as “BitLockerToGo.exe” to inject a malicious payload.

Clambling can execute binaries through process hollowing.

DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.

The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.

Caminho has launched and hollowed out MSBuild.exe to host malicious code.

Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.

XLoader uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.

Cobalt Strike can use process hollowing for execution.

TRAILBLAZE has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named `web`.

Lokibot has used process hollowing to inject itself into legitimate Windows process.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.

BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

QakBot can use process hollowing to execute its main payload.

Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.

Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.

Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.

Duqu is capable of loading executable code via process hollowing.

SynAck abuses NTFS transactions to launch and conceal malicious processes.

Bazar can inject into a target process using process doppelgänging.

InvisiMole has used ListPlanting to inject code into a trusted process.

InvisibleFerret has collected mouse and keyboard events using “pyWinhook”.

Mafalda can conduct mouse event logging.

FlawedAmmyy can collect mouse events.