Procedure examples

Kimsuky has the ability to load DLLs via reflective injection by allocating memory using `VirtualAllocEx()`, then decrypting a DLL with `WriteProcessMemory()` and invoking execution through `CreateRemoteThread()`.

Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.

An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.

TA505 has been seen injecting a DLL into winword.exe.

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.

Malteiro has injected Mispadu’s DLL into a process.

A Lazarus Group malware sample performs reflective DLL injection.

Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.