Procedure examples

Cardinal RAT injects into a newly spawned process created from a native Windows executable.

Egregor can inject its payload into iexplore.exe process.

ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.

JPIN can inject content into lsass.exe to load a module.

metaMain can inject the loader file, Speech02.db, into a process.

Mis-Type has been injected directly into a running process, including `explorer.exe`.

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.

ShadowPad has injected an install module into a newly created process.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

DOWNIISSA can inject shellcode directly into process memory including WINWORD.exe and msiexec.exe.

BBK has the ability to inject shellcode into svchost.exe.

Waterbear can inject decrypted shellcode into the LanmanServer service.

Lizar can migrate the loader into another process.

WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.

SLOTHFULMEDIA can inject into running processes on a compromised host.

Sliver includes multiple methods to perform process injection to migrate the framework into other, potentially privileged processes on the victim machine.

SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.

Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.

The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.

PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.

Remcos has a command to hide itself by injecting into another process.

Donut includes a subproject DonutTest to inject shellcode into a target process.

IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.

HTRAN can inject into into running processes.

During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.

Kimsuky has the ability to load DLLs via reflective injection by allocating memory using `VirtualAllocEx()`, then decrypting a DLL with `WriteProcessMemory()` and invoking execution through `CreateRemoteThread()`.

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.

An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.

TA505 has been seen injecting a DLL into winword.exe.

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.

Malteiro has injected Mispadu’s DLL into a process.

A Lazarus Group malware sample performs reflective DLL injection.

Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.

The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.

Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Get2 has the ability to inject DLLs into processes.

Emissary injects its DLL file into a newly spawned Internet Explorer process.

PS1 can inject its payload DLL Into memory.

Havoc has DLL spawn and injection modules.

Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.

TONESHELL has used DLL injection to execute payloads received from the C2 server.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.

Emotet has been observed injecting in to Explorer.exe and other processes.

BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

Conti has loaded an encrypted DLL into memory and then executes it.

If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.

BlackEnergy injects its DLL component into svchost.exe.