Process Injection: Dynamic-link Library Injection

Other sub-techniques of Process Injection (11)

ID	Name
T1055.001	Dynamic-link Library Injection
T1055.002	Portable Executable Injection
T1055.003	Thread Execution Hijacking
T1055.004	Asynchronous Procedure Call
T1055.005	Thread Local Storage
T1055.008	Ptrace System Calls
T1055.009	Proc Memory
T1055.011	Extra Window Memory Injection
T1055.012	Process Hollowing
T1055.013	Process Doppelgänging
T1055.014	VDSO Hijacking

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.

DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). ^[1]

Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).^[2]^[1]

Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.

ID: T1055.001

Sub-technique of: T1055

Tactics: Defense Evasion, Privilege Escalation

Platforms: Windows

Permissions Required: User

Data Sources: API monitoring, DLL monitoring, File monitoring, Process monitoring

Defense Bypassed: Anti-virus, Application control

Version: 1.0

Created: 14 January 2020

Last Modified: 20 June 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
Aria-body	Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.^[3]
BlackEnergy	BlackEnergy injects its DLL component into svchost.exe.^[4]
Carberp	Carberp's bootkit can inject a malicious DLL into the address space of running processes.^[5]
Carbon	Carbon has a command to inject code into a process.^[6]
ComRAT	ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.^[7]
Derusbi	Derusbi injects itself into the secure shell (SSH) process.^[8]
Duqu	Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).^[9]
Dyre	Dyre injects into other processes to load modules.^[10]
Elise	Elise injects DLL files into iexplore.exe.^[11]^[12]
Emissary	Emissary injects its DLL file into a newly spawned Internet Explorer process.^[13]
Emotet	Emotet has been observed injecting in to Explorer.exe and other processes. ^[14]^[15]^[16]
FinFisher	FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.^[17]^[18]
Get2	Get2 has the ability to inject DLLs into processes.^[19]
HIDEDRV	HIDEDRV injects a DLL for Downdelph into the explorer.exe process.^[20]
Kazuar	If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.^[21]
Koadic	Koadic can perform process injection by using a reflective DLL.^[22]
Lazarus Group	A Lazarus Group malware sample performs reflective DLL injection.^[23]
Matroyshka	Matroyshka uses reflective DLL injection to inject the malicious library and execute the RAT.^[24]
Maze	Maze has injected the malware DLL into a target process.^[25]^[26]
Metamorfo	Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).^[27]
Netwalker	The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.^[28]
PipeMon	PipeMon can inject its modules into various processes using reflective DLL loading.^[29]
PoisonIvy	PoisonIvy can inject a malicious DLL into a process.^[30]^[31]
PowerSploit	PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.^[32]^[33]
Pupy	Pupy can migrate into another process using reflective DLL injection.^[34]
Putter Panda	An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).^[35]
Ramsay	Ramsay can use `ImprovedReflectiveDLLInjection` to deploy components.^[36]
RARSTONE	After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This "downloaded" file is actually not dropped onto the system.^[37]
RATANKBA	RATANKBA performs a reflective DLL injection using a given pid.^[38]^[39]
Remsec	Remsec can perform DLL injection.^[40]
SDBot	SDBot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.^[19]
Socksbot	Socksbot creates a suspended svchost process and injects its DLL into it.^[41]
Sykipot	Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.^[42]
TA505	TA505 has been seen injecting a DLL into winword.exe.^[43]
TajMahal	TajMahal has the ability to inject DLLs for malicious plugins into running processes.^[44]
Tropic Trooper	Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.^[45]^[46]
Turla	Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.^[47]^[48]
Wizard Spider	Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.^[49]^[50]
ZxShell	ZxShell is injected into a shared SVCHOST process.^[51]

Mitigations

Mitigation	Description
Behavior Prevention on Endpoint	Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

Detection

Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as CreateRemoteThread and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.^[1]

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Process Injection: Dynamic-link Library Injection

Other sub-techniques of Process Injection (11)

Procedure Examples

Mitigations

Detection

References