+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Process Injection Methods (/showthread.php?tid=6084117)
Pages: Pages
1
2
Process Injection Methods - TheBrokenWasp - Jun 2, 2020
I know that there are a lot of different process injection methods, such as RunPE, and I would like your opinions on the different types. I know RunPE is very common and looking into it, it seems like AV programs detect it very easily, so I want to know if anybody here uses alternatives. If so, which ones? Why?
Basically I just want people to talk about process injection as it's a very interesting topic to me. Thanks.
RE: Process Injection Methods - VisualSoft - Jun 2, 2020
its not that all runpe are detected, if you mode a bit the same runpe then it will be fud on scantime + runtime.
RE: Process Injection Methods - TheBrokenWasp - Jun 2, 2020
(Jun 2, 2020 09:19 PM)VisualSoft Wrote: its not that all runpe are detected, if you mode a bit the same runpe then it will be fud on scantime + runtime.
Alright, well I just based my knowledge off of this article
RE: Process Injection Methods - VisualSoft - Jun 2, 2020
(Jun 2, 2020 09:28 PM)TheBrokenWasp Wrote: Alright, well I just based my knowledge off of this article
it looks to be an old article.
RE: Process Injection Methods - TheBrokenWasp - Jun 2, 2020
(Jun 2, 2020 09:31 PM)VisualSoft Wrote: it looks to be an old article.
probably :/
RE: Process Injection Methods - VisualSoft - Jun 3, 2020
(Jun 2, 2020 09:37 PM)TheBrokenWasp Wrote: probably :/
There are some other Private methods but they are not yet public.
RE: Process Injection Methods - Jean-Jacques Rousseau - Jun 9, 2020
There are loads of things you can do, overwrite callbacks, use APC, map a transacted section, etc etc, to map a bootstrap + shellcode + malware. It is just that crypter developers use RunPE because they don’t know any better. Either way, a crypter should not use code injection to begin with, that is the work of bot.
RE: Process Injection Methods - TheBrokenWasp - Jun 9, 2020
(Jun 9, 2020 04:32 AM)Supercut Wrote: There are loads of things you can do, overwrite callbacks, use APC, map a transacted section, etc etc, to map a bootstrap + shellcode + malware. It is just that crypter developers use RunPE because they don’t know any better. Either way, a crypter should not use code injection to begin with, that is the work of bot.
Why? What's the difference?
RE: Process Injection Methods - Jean-Jacques Rousseau - Jun 9, 2020
(Jun 9, 2020 07:09 AM)TheBrokenWasp Wrote: Why? What's the difference?
Any decent bot will use its own process injection into a trusted process. Better let the bot do the work by itself, you should just map the executable and execute it.
RE: Process Injection Methods - 3DES - Jun 10, 2020
(Jun 9, 2020 08:35 AM)Supercut Wrote: Any decent bot will use its own process injection into a trusted process. Better let the bot do the work by itself, you should just map the executable and execute it.More commonly known as pe loader / LoadPE.
RE: Process Injection Methods - Jean-Jacques Rousseau - Jun 10, 2020
(Jun 10, 2020 05:22 AM)3DES Wrote: More commonly known as pe loader / LoadPE.
Exactly, map the PE according to its standard, and execute. No API.
RE: Process Injection Methods - TheBrokenWasp - Jun 10, 2020
(Jun 10, 2020 07:17 AM)Supercut Wrote: Exactly, map the PE according to its standard, and execute. No API.
So a quick lookup leads me to another HF post where it's explained that it executes it within its own process (I might be misunderstanding that) but if that leaves the malware running within the same process, would it not be a bit ineffective against AV as they would scan the process as an unknown process anyways, unlike where RunPE hides the malware in a remote process which is trusted and won't be scanned?
RE: Process Injection Methods - Jean-Jacques Rousseau - Jun 10, 2020
(Jun 10, 2020 07:22 AM)TheBrokenWasp Wrote: So a quick lookup leads me to another HF post where it's explained that it executes it within its own process (I might be misunderstanding that) but if that leaves the malware running within the same process, would it not be a bit ineffective against AV as they would scan the process as an unknown process anyways, unlike where RunPE hides the malware in a remote process which is trusted and won't be scanned?
Depends on what type of malware. Malware with bad footprint will be better off injected, more sophisticated malware should be mapped in current process. When AVs conduct memory scanning, they scan commonly injected processes as well. Also remember that some RunPEs inject to itself, which is completely useless.
RE: Process Injection Methods - TheBrokenWasp - Jun 10, 2020
(Jun 10, 2020 07:39 AM)Supercut Wrote: Depends on what type of malware. Malware with bad footprint will be better off injected, more sophisticated malware should be mapped in current process. When AVs conduct memory scanning, they scan commonly injected processes as well. Also remember that some RunPEs inject to itself, which is completely useless.
What if you look for a bunch of user-downloaded software, like chrome, discord, firefox, steam, etc, which are likely to be running most of the time while the user is on their PC and inject into those?
RE: Process Injection Methods - Jean-Jacques Rousseau - Jun 10, 2020
(Jun 10, 2020 07:40 AM)TheBrokenWasp Wrote: What if you look for a bunch of user-downloaded software, like chrome, discord, firefox, steam, etc, which are likely to be running most of the time while the user is on their PC and inject into those?
I don’t have that knowledge on top off my head, might do tests later. But that defeats the purpose, to hide the code in a trusted process. But i know that AVs will scan other processes.