Procedure examples

Denis queries the Registry for keys and values.

Denis uses ipconfig to gather the IP address from the system.

Denis obfuscates its code and encrypts the API names.

Denis has encoded its PowerShell commands in Base64.

Denis enumerates and collects the username from the victim’s machine.

Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.

Denis has a version written in PowerShell.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

Denis has a command to delete files from the victim’s machine.

Denis has used DNS tunneling for C2 communications.

Denis collects OS information and the computer name from the victim’s machine.

Denis has several commands to search directories for files.

Denis deploys additional backdoors and hacking tools to the system.

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.

Denis encodes the data sent to the server in Base64.

Denis will decrypt important strings used for C&C communication.

Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.

Denis compressed collected data using zlib.

Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.

Denis exploits a security vulnerability to load a fake DLL and execute its code.