Procedure examples

Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.

Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.

HeartCrypt has the ability to use `NtQueueApcThread` as an alternate method for process injection.

BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.

InvisiMole can inject its code into a trusted process via the APC queue.

IcedID has used ZwQueueApcThread to inject itself into remote processes.

Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.

Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.

XLoader injects code into the APC queue using `NtQueueApcThread` API.

Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.

TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."