Advanced Process Injection V2

Attack & Detect Advance Process Injection Techniques

1. Process Injection Mindset
2. Classic Process Injection
3. APC Code Injection
4. Section Mapping
5. Module Stomping
6. Process Hollowing
7. Process Doppelganging
8. Transacted Hollowing
9. Process Herpaderping
10. Process Ghosting
PRE-REQUISITES
● Vmware/VirtualBox
● Windows 10 x64
○ Lab version: Windows 10 version 22H2 ( x64bit)
● Any IDE or Editor (Visual studio 2022 is preferred)
● System Informer, PE-bear, CFF Explorer, x64dbg
● Microsoft ATP for Event Analysis or any event analysis environment that you
prefer
○ Work Email is required to register in Microsoft ATP
● Programming Language:
○ C/C++
Basic Mindset for Process Injection (remote)
➔ Injecting PE/DLL/shellcode (malicious) into
another process’ address space
◆ To hide from the AV products
◆ To hide from the naked eye of the analyst
◆ Sometimes, to access the resources (network,
memory, files etc.) owned by another process
➔ When performing process injection, we need
to have the following queries in our mind
◆ How can we access the remote process?
◆ How can we send our malicious code to the
remote process?
◆ How can we execute our malicious code which is
inside the remote process?
Process Injection - Access Remote Process
➔ Getting Access to Remote Process
◆ Obtain a handle to the remote process
● Handle is value given to the user-mode processes when they try to access some object (process,
thread, file, etc) from user-land
➔ Obtaining the handle
◆ Opening a executing process
● Win32 API: OpenProcess
● NT API: NtOpenProcess
◆ Creating a new legitimate process
● Win32 API: CreateProcessA
● NT API: NtCreateProcessEx, NtCreateUserProcess
◆ Duplicating existing process handle from another process
● Win32 API: DuplicateHandle
● NT API: NtDuplicateObject
Process Injection - Sending Malicious Code
➔ Many ways to send malicious code to remote process, but few queries to
have in our mind
◆ Do we have enough privilege to write code into the remote process?
● PROCSS_VM_OPERATION, PROCESS_VM_WRITE
◆ Can we locate the address of the malicious code in the remote process that we just sent?
◆ Is the memory region in remote process has enough memory access rights to write &
execute code in that memory region?
● Commonly we look for writable (W) & executable (X) memory region
○ But in modern OS because of security reason memory region is usually either writable or executable (W^X).
Process Injection - Sending Malicious Code
➔ Usually sending/injecting malicious code in remote process involves
◆ Allocating new memory region with READ, WRITE & Execute access in remote process
● Win32 API: VirtualAllocEx
● NT API: NtAllocateVirtualMemory
● Access Rights: PAGE_READWRITE, (PAGE_READWRITE | PAGE_EXECUTE)
◆ Writing payload into the memory
● Win32 API: WriteProcessMemory
● NT API: NtWriteVirtualMemory

➔ Additionally, changing memory protection also involves in this stage

◆ Usually, memory protection PAGE_READWRITE is changed to PAGE_EXECUTE_READ and vice
versa.
● Win32 API: VirtualProtectEx
● NtAPI: NtProtectVirtualMemory
Process Injection - Execute the Malicious code
➔ Common ways to perform execution
◆ Create a new thread in target process
● Win32 API: CreateRemoteThread
● NT API: NtCreateThreadEx, RtlCreateUserThread
◆ Queuing APC in alertable thread
● Win32 API: QueueUserAPC
● NT API: NtQueueUserAPC
◆ Hijacking the executing thread
● Win32 API: SetThreadContext
● NT API: NtSetContextThread
➔ Last phase of the injection
◆ Some APIs that are used in this stage are heavily monitored by the AV/EDR products
Process Injection - Common APIs
Classic Process Injection - steps
● Obtain Handle to a target process
○ CreateToolHelp32Snapshot, OpenProcess, NtQuerySystemInformation
● Allocate new memory region at target process
○ VirtualAllocEx, NtAllocateVirtualMemory
● Write payload into newly allocated memory
○ WriteProcessMemory, NtWriteVirtualMemory
● Create new remote thread
○ CreateRemoteThread, NtCreateThreadEx
Classic Process Injection
Classic Process Injection
Classic Process Injection
Classic Process Injection - API calls
➔ [Link] :
◆ CreateToolHelp32Snapshot, Process32First, Process32Next, Thread32First,
Thread32Next, OpenProcess, WriteProcessMemory, VirtualProtectEx, OpenThread
➔ [Link]:
◆ NtQuerySystemInformation,NtAllocateVirtualMemory, NtWriteVirtualMemory
APC Code Injection
➔ APC stands for Asynchronous Procedure Call
➔ APC functions execute asynchronously in context of a particular thread
➔ In this techniques our shellcode is placed in APC Queue of the thread.
➔ The payload will get executed when the thread goes to alertable state
➔ Wait routines puts thread in alertable state, such as:
◆ SleepEx()
◆ WaitForSingleObjectEx()
◆ WaitForMultipleObjectEx()
APC Code Injection - Steps
➔ Find the process to inject our payload
◆ CreateToolHelp32Snapshot, NtQuerySystemInformation
➔ Find all the threads in that process
◆ Thread32First, Thread32Next
➔ Allocate memory in that process
◆ VirtualAllocEx, NtAllocateVirtualMemory
➔ Write the payload into that allocated memory
◆ WriteProcessMemory, NtWriteVirtualMemory
➔ Put the APC function in the queue for all threads
◆ QueueUserAPC, NtQueueUserAPC
➔ APC function here points to our shellcode
APC Code Injection
APC Code Injection
APC Code Injection - API calls
➔ [Link] :
◆ CreateToolHelp32Snapshot, Process32First, Process32Next, Thread32First,
Thread32Next, OpenProcess, WriteProcessMemory, VirtualProtectEx, OpenThread,
QueueUserAPC
➔ [Link]:
◆ NtQuerySystemInformation,NtAllocateVirtualMemory, NtWriteVirtualMemory
Section Mapping
● Block of memory that can be shared between multiple processes [1]
● In memory, each section has corresponding views, which are parts of the
section that are visible to processes.
○ Act of creating a view for a section is known as mapping a view of the section [1]
● In this technique a section is created and view of section is mapped to
both local & target process with different page protection
Section Mapping - Steps
➔ Create a new section with full RWX page protection
◆ NtCreateSection
➔ Map a view of section to local process (injector) with RW page protection
◆ NtMapViewOfSection
➔ Map a view of section to target process with RX page protection
◆ NtMapViewOfSection
➔ Write a payload to a view mapped to a local process
◆ memcpy
➔ Create a remote thread with a base address of view mapped to remote
process
◆ CreateRemoteThread, NtCreateThreadEx, RtlCreateUserThread
Section Mapping
Section Mapping
Section Mapping
Section Mapping
Section Mapping - API calls
● [Link] :
○ OpenProcess, CreateRemoteThread
● [Link]:
○ NtCreateSection, NtMapViewOfSection, NtCreateThreadEx
Module Stomping
➔ This is the technique to load fresh dll into the target process and inject
the shellcode into it
➔ No need to change memory protection in target process memory
➔ Shellcode gets executed from the legitimate dll
Module Stomping - Steps
➔ Open a target process and get handle to the target process
◆ OpenProcess, NtOpenProcess
➔ Load the target module in the target process
◆ VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
➔ Write the payload at the entrypoint address of the loaded module
◆ WriteProcessMemory
➔ Create a thread to execute the payload
◆ CreateRemoteThread
Module Stomping
Module Stomping
Module Stomping - API calls
➔ [Link] :
◆ OpenProcess, ReadProcessMemory, WriteProcessMemory, VirtualAllocEx,
VirtualProtectEx, CreateRemoteThread
➔ [Link]:
◆ EnumProcessModules, GetModuleFileNameEx
➔ [Link]:
◆ NtAllocateVirtualMemory
Process Hollowing
➔ Replace executable section of the legitimate process with malicious
executable.
➔ Replacement takes place in memory.
➔ Malicious code executes from inside of the legitimate process thus, it
conceals its presence.
➔ The path of the hollowed process still points to the legitimate executable
path.
Process Hollowing - Steps
➔ Create target process in suspended mode
◆ CreateProcessA
➔ Get Image Base Address of the target process
◆ NtQueryInformationProcess, ReadProcessMemory
➔ Hollow/Unmap target image
◆ ZwUnmapViewOfSection
➔ Allocate new memory in target process for the payload
◆ VirtualAllocEx
➔ Copy all the payload section to the allocated memory in target process
◆ WriteProcessMemory
➔ Get Context of target process
◆ GetThreadContext
➔ Set the entrypoint of payload in respective context
◆ EAX for x86, RCX for x64
➔ Apply the Context of target process
◆ SetThreadContext
➔ Resume main thread of target process
◆ ResumeThread
Process Hollowing
Process Hollowing
Process Hollowing
Process Hollowing
Process Hollowing - API Calls
➔ [Link]:
◆ CreateProcessA, ReadProcessMemory, WriteProcessMemory, GetThreadContext,
SetThreadContext, ResumeThread
➔ [Link]:
◆ NtQueryInformationProcess, NtUnmapViewOfSection/ZwUnmapViewOfSection
Process Doppelganging
➔ Process Doppelganging utilizes the Windows API calls related to the
NTFS transactions.
➔ Transactional NTFS brings the concept of atomic transactions to NTFS
file system, which allows app developers and administrators to handle
mistakes and maintain data integrity more easily.
➔ Transactional NTFS allows for files and directories to be created,
modified, renamed and deleted atomically.
➔ In a series of file operations (performed in a transaction), when all
operations complete successfully, the operation is committed. If an error
occurs, the entire operation is rolled back and fails. This is to preserve
integrity of data on disk.
Process Doppelganging - Steps
➔ Steps of Doppelganging can be broken down into 4 steps:
1. Transact : process a legitimate file into the NTFS transaction and then overwrite it with
a malicious payload file
● CreateTransaction, CreateFileTransactedA
2. Load: Create a memory section from the payload and load the malicious code
● NtCreateSection
3. Rollback: Rollback the transaction i.e., removing malicious code so that no data left on the
disk
● RollbackTransaction
4. Animate: Bringing Doppelganging to life. Create a process from the previously created
memory section (step 2). The memory section contains malicious code and never written
to the disk.
● NtCreateProcessEx, NtCreateThreadEx
Process Doppelganging
Process Doppelganging
Process Doppelganging
Process Doppelganging
Process Doppelganging
Process Doppelganging
Process Doppelganging - API Calls
➔ [Link]:
◆ CreateTransaction, RollbackTransaction
➔ [Link]:
◆ CreateFileTransactedA, WriteFile
➔ [Link]:
◆ NtCreateSection, NtCreateProcessEx, NtCreateThreadEx
Process Doppelganging - Issue
➔ Microsoft Windows Defender is monitoring the creation of remote thread using the
routine PsSetCreateThreadNotifyRoutine.
➔ Disable Microsoft Windows Defender from Group policy.
➔ Computer Configuration > Administrative Templates > Windows Components >
Windows Defender Antivirus > Turn off Microsoft Defender Antivirus (Enabled)
Transacted Hollowing
➔ Hybrid of Process Hollowing and Process Doppelganging
➔ This technique solves the issues of both techniques

Process Hollowing
Normal/ Process Doppelganging
Transacted Hollowing - Steps
➔ Create NTFS transaction object
◆ CreateTransaction
➔ Open/Create target file for transaction
◆ CreateFileTransactedA
➔ Create an image section from transacted file
◆ NtCreateSection
➔ Rollback the transaction
◆ RollbackTransaction
➔ Create a new target process in suspended mode
◆ CreateProcessA
➔ Map an image section into the target process
◆ NtMapViewOfSection
➔ Update entrypoint in target process with payload entrypoint
◆ GetThreadContext, SetThreadContext
➔ Update image base address at target process PEB with newly mapped image base address
◆ NtQueryInformationProcess, WriteProcessMemory
➔ Resume the thread
◆ NtResumeThread
Transacted Hollowing
Transacted Hollowing
Transacted Hollowing
Transacted Hollowing
Transacted Hollowing
Transacted Hollowing - API Calls
➔ [Link]:
◆ CreateFileTransactedW, WriteFile, CreateProcessW, ResumeThread, GetThreadContext,
SetThreadContext, ResumeThread
➔ [Link]:
◆ NtQueryInformationProcess, NtCreateTransaction, NtCreateSection,
NtRollbackTransaction, NtMapViewOfSection
Process Herpaderping
➔ In this technique the file on-disk is modified after the image has been
mapped
➔ The modification is done before creating an initial thread
➔ Temporary file on-disk act as a decoy
➔ At this point the file on-disk is different from the one executed
in-memory
Process Herpaderping - Steps
➔ Create a temp/decoy file
◆ CreateFileA
➔ Write payload into that file (do not close the temp file handle after writing payload into it)
◆ WriteFile
➔ Create an image section from that file
◆ NtCreateSection
➔ Create a process using the newly created section
◆ NtCreateProcessEx
➔ Modify the temp file
◆ SetFilePointer, WriteFile
➔ Setup process parameters
◆ RtlCreateProcessParametersEx
➔ Create new thread
◆ NtCreateThreadEx
➔ Close temp file handle
◆ CloseHandle
Process Herpaderping
Process Herpaderping
Process Herpaderping
Process Herpaderping
Process Herpaderping
Process Herpaderping
Process Herpaderping
Process Herpaderping - API Calls
➔ [Link]:
◆ CreateFileW, WriteFile, SetFilePointer,CloseHandle
➔ [Link]:
◆ NtOpenFile, NtSetInformationFile, NtCreateSection, NtCreateProcessEx,
NtCreateProcessParametersEx,NtCreateThreadEx
Process Ghosting
➔ Similar to process doppelganging
➔ However, the section is created using delete-pending file instead of
transaction.
➔ Puts a file in delete-pending state which makes antivirus tools difficult to
scan or delete it.
➔ Before creating the process the file is completely vanished and we’re left
out with file-less section.
Process Ghosting - Steps
➔ Open/Create new dummy file
◆ CreateFileA
➔ Put the file into delete-pending state using API NtSetinformationFile
◆ FileDispositionInformation information class is used here
➔ Write payload buffer into delete-pending file
◆ WriteFile
➔ Create an image section with the delete-pending file
◆ NtCreateSection
➔ Close delete-pending file handle
◆ CloseHandle
➔ Create a process with newly created image section using API NtCreateProcessEx
➔ Update/fix process parameters
◆ RtlCreateProcessParametersEx
➔ Create a new thread
◆ NtCreateThreadEx
Process Ghosting
Process Ghosting
Process Ghosting
Process Ghosting
Process Ghosting
Process Ghosting
Process Ghosting
Process Ghosting - API Calls
➔ [Link]:
◆ WriteFile, CloseHandle
➔ [Link]:
◆ NtOpenFile, NtSetInformationFile, NtCreateSection, NtCreateProcessEx,
NtCreateProcessParametersEx,NtCreateThreadEx
Why Process Doppelganging was detected?
References

1. [Link]
rnel/section-objects-and-views
2. [Link]
3. [Link]
mping/
4. [Link]
5. [Link]
6. [Link]
7. [Link]
8. [Link]