Внедрение кода в процессы

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.(Citation: SentinelLabs Agent Tesla Aug 2020)

Lizar can migrate the loader into another process.(Citation: BiZone Lizar May 2021)

SLOTHFULMEDIA can inject into running processes on a compromised host.(Citation: CISA MAR SLOTHFULMEDIA October 2020)

IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.(Citation: Unit 42 IronNetInjector February 2021 )

DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.(Citation: Google Cloud APT41 2024)

BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)

HyperBro can run shellcode it injects into a newly created process.(Citation: Unit42 Emissary Panda May 2019)

Sliver can inject code into local and remote processes.(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)

Bazar can inject code through calling VirtualAllocExNuma.(Citation: Cybereason Bazar July 2020)

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)

TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.(Citation: JPCert BlackTech Malware September 2019)

REvil can inject itself into running processes on a compromised host.(Citation: McAfee REvil October 2019)

Donut includes a subproject DonutTest to inject shellcode into a target process.(Citation: Donut Github)

BBK has the ability to inject shellcode into svchost.exe.(Citation: Trend Micro Tick November 2019)

During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.(Citation: Mandiant Cutting Edge Part 3 February 2024)

GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.(Citation: Medium Eli Salem GuLoader April 2021)

Honeybee uses a batch file to load a DLL into the svchost.exe process.(Citation: McAfee Honeybee)

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)

Wizard Spider has used process injection to execute payloads to escalate privileges.(Citation: Mandiant FIN12 Oct 2021)

ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.(Citation: Mandiant Suspected Turla Campaign February 2023)

COATHANGER includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.(Citation: NCSC-NL COATHANGER Feb 2024)

AuditCred can inject code from files to other running processes.(Citation: TrendMicro Lazarus Nov 2018)

gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.(Citation: Gh0stRAT ATT March 2019)

NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.(Citation: Red Canary NETWIRE January 2020)

Backdoor.Oldrea injects itself into explorer.exe.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)

Remcos has a command to hide itself through injecting