Procedure examples

IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.

ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.

BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.

Lumma Stealer has used process hollowing leveraging a legitimate program such as “BitLockerToGo.exe” to inject a malicious payload.

Clambling can execute binaries through process hollowing.

DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.

The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.

Caminho has launched and hollowed out MSBuild.exe to host malicious code.

Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.

XLoader uses process hollowing by injecting itself into the `explorer.exe` process and other files ithin the Windows `SysWOW64` directory.

Cobalt Strike can use process hollowing for execution.

TRAILBLAZE has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named `web`.

Lokibot has used process hollowing to inject itself into legitimate Windows process.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.

BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

QakBot can use process hollowing to execute its main payload.

Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.

Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.

Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.

Duqu is capable of loading executable code via process hollowing.

Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.

SynAck abuses NTFS transactions to launch and conceal malicious processes.

Bazar can inject into a target process using process doppelgänging.

InvisiMole has used ListPlanting to inject code into a trusted process.

Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.

Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.

Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.

APT39 has utilized tools to capture mouse movements.

APT42 has used credential harvesting websites.

InvisibleFerret has collected mouse and keyboard events using “pyWinhook”.

Mafalda can conduct mouse event logging.

FlawedAmmyy can collect mouse events.

Chaes has a module to perform any API hooking it desires.

Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.

metaMain can log mouse events.

NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.

During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin.

During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.

During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.

APT3 has used a keylogging tool that records keystrokes in encrypted files.

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes. Kimsuky has also leveraged Native Windows API functions such as `GetAsyncKeyState()` along with others to capture keystrokes every 50 milliseconds and stores data in a file stored in the temp directory.

Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.

APT41 used a keylogger called GEARSHIFT on a target system.

menuPass has used key loggers to steal usernames and passwords.

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

APT39 has used tools for capturing keystrokes.