ID	E1055
Objective(s)	Defense Evasion, Privilege Escalation
Related ATT&CK Techniques	Process Injection (T1055, T1631)
Version	2.0
Created	1 August 2019
Last Modified	21 November 2022

Process Injection

Malware may execute code in the address space of a separate process.

See ATT&CK: Process Injection (T1055, T1631). Notes on ATT&CK's sub-techniques in the context of [1] are as follows:

ID	ATT&CK Sub-Technique	Notes
E1055.001	Dynamic-link Library Injection	Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called Classic DLL Injection via CreateRemoteThread and LoadLibrary in [1].
E1055.002	Portable Executable Injection	Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called Portable Executable Injection in [1].
E1055.003	Thread Execution Hijacking	Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called Thread Execution Hijacking in [1].
E1055.004	Asynchronous Procedure Call	Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [3]. Called APC Injection and AtomBombing in [1].
E1055.011	Extra Window Memory Injection	Malware may inject into Explorer tray window’s extra window memory. Called Extra Window Memory Injection in [1].
E1055.012	Process Hollowing	Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called Process Hollowing in [1].

Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the Hijack Execution Flow behavior.

Methods

Name	ID	Description
Hook Injection via SetWindowsHooksEx	E1055.m01	Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [1]
Injection and Persistence via Registry Modification	E1055.m02	Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [1]
Injection via Windows Fibers	E1055.m05	Malware executes shellcode via Windows fibers by converting a thread to a fiber. [5]
Injection using Shims	E1055.m03	Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [1]
Patch Process Command Line	E1055.m04	Malware patches the PEB of a process to spoof the arguments.

Use in Malware

Name	Date	Method	Description
TrickBot	2016	--	Trojan spyware program that has mainly been used for targeting banking sites. [11]
Poison-Ivy	2005	--	After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [2]
WebCobra	2018	--	Injects minor code into a running process. [12]
CryptoWall	2014	--	The malware injects code into a new svchost process [6]
Hupigon	2013	E1055, E1055.012	Please see the Hupigon malware page for details. [7]
BlackEnergy	2007	E1055.m05	Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution [8]
Stuxnet	2010	E1055.001, E1055.m05	Please see the Stuxnet malware page for details. [9]
Netwalker	2020	E1055.001	Netwalker uses reflective DLL loading to inject from memory [10]
UP007 Malware Family	2016	--	The malware loads multiple DLLs into memory [4]
DNSChanger	2011	--	Attach user process memory (This capa rule had 1 match) [13]
Redhip	2011	E1055.003	Inject thread (This capa rule had 1 match) [13]