Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process. DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as <code>VirtualAllocEx</code> and <code>WriteProcessMemory</code>, then invoked with <code>CreateRemoteThread</code> (which calls the <code>LoadLibrary</code> API responsible for loading the DLL).1 Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into a process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually performing the function of <code>LoadLibrary</code>).23 Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's <code>AddressOfEntryPoint</code> before starting a new thread in the target process.4 This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.5 Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.
- Elastic Process Injection July 2017
- Elastic HuntingNMemory June 2017
- Elastic Process Injection July 2017
- Module Stomping for Shellcode Injection
- Hiding Malicious Code with Module Stomping
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0024 | Putter Panda | China |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g1026 | Malteiro | — |
| grp_g0135 | BackdoorDiplomacy | — |
| grp_g0102 | Wizard Spider | Russia |
| grp_g0081 | Tropic Trooper | — |
| grp_g0065 | Leviathan | China |
| grp_g0010 | Turla | Russia |
| grp_g0092 | TA505 | — |
| grp_g0094 | Kimsuky | DPRK |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.