Procedure examples

InvisiMole can inject its backdoor as a portable executable into a target process.

RustyWater has injected its shellcode into explorer.exe by allocating memory via `VirtualAllocEx`, then by writing the payload via `WriteProcessMemory`.

Carbanak downloads an executable and injects it directly into a new process.

SPAWNCHIMERA has executed only in memory and hooked itself into existing processes on the victim device to include the web process.

Lizar can execute PE files in the address space of the specified process.

Brute Ratel C4 has injected Latrodectus into the Explorer.exe process on comrpomised hosts.

Pikabot can create a suspended instance of a legitimate process (e.g., ctfmon.exe), allocate memory within the suspended process corresponding to Pikabot's core module, then redirect execution flow via `SetContextThread` API so that when the thread resumes the Pikabot core module is executed.

Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.

Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.

Waterbear can use thread injection to inject shellcode into the process of security software.

FIN8 has injected malicious code into a new svchost.exe process.

Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.

Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.

HeartCrypt has the ability to use `NtQueueApcThread` as an alternate method for process injection.

BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.

InvisiMole can inject its code into a trusted process via the APC queue.

IcedID has used ZwQueueApcThread to inject itself into remote processes.

Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.

Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.

XLoader injects code into the APC queue using `NtQueueApcThread` API.

Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.

TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."

Ursnif has injected code into target processes via thread local storage callbacks.

CANONSTAGER uses the Thread Local Storage (TLS) array data structure to store function addresses resolved by its custom API hashing algorithm. The function addresses are later called throughout the binary from offsets into the TLS array.

PACEMAKER can use PTRACE to attach to a targeted process to read process memory.

KV Botnet Activity final payload installation includes mounting and binding to the \/proc\/ filepath on the victim system to enable subsequent operation in memory while also removing on-disk artifacts.

Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.

Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.

BlackByte used process hollowing for defense evasion purposes.

Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.

A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.

menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.

TA2541 has used process hollowing to execute CyberGate malware.

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.

A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.

TrickBot injects into the svchost.exe process.

RCSession can launch itself from a hollowed svchost.exe process.

Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.

Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.

For .NET payloads, HeartCrypt can use process hollowing to inject into processes spawned by csc.exe or AppLaunch.exe.

Ursnif has used process hollowing to inject into child processes.

The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

Emotet uses a copy of `certutil.exe` stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code.

Gootloader can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.

Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.

Snip3 can use RunPE to execute malicious payloads within a hollowed Windows process.

WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.

Raspberry Robin will execute a legitimate process, then suspend it to inject code for a Tor client into the process, followed by resumption of the process to enable Tor client execution.