PROCESS INJECTION
Comprehensive overview of process injection techniques including DLL injection, process hollowing, APC injection, and thread execution hijacking.
Contents
Process injection = the #1 most common technique used by modern Windows malware to hide itself inside a legitimate process.
Instead of running as its own obvious malicious evil.exe, the attacker forces a trusted process (e.g. explorer.exe, svchost.exe, msedge.exe, lsass.exe, etc.) to execute the malicious code. From the outside, everything looks normal — Task Manager, EDR, antivirus only see a legitimate process using a bit more memory or network.
Why attackers do it (the real reasons in 2025)
| Goal | How injection helps |
|---|---|
| Evade AV/EDR | Legitimate process → often whitelisted |
| Steal tokens & escalate privileges | Inject into lsass → dump credentials |
| Survive reboots & hide | Live only in memory, nothing on disk |
| Bypass allow-lists | notepad.exe or Microsoft-signed binary now runs evil code |
| Hide network traffic | C2 comes from chrome.exe or svchost.exe |
Top 8 Process Injection Techniques You Will See Daily (2025 ranking)
| # | Technique | How it works (very short) | Most common malware using it (2025) | Difficulty to detect |
|---|---|---|---|---|
| 1 | Classic DLL Injection | VirtualAllocEx → WriteProcessMemory → CreateRemoteThread (LoadLibrary) | Lumma, RedLine, SmokeLoader, most stealers | Low–Medium |
| 2 | Process Hollowing (RunPE) | Start legitimate exe suspended → unmap → write malicious PE → resume | Qakbot, TrickBot, Bumblebee, Dridex forks | Medium |
| 3 | Reflective DLL Injection | Malicious DLL has no LoadLibrary, it injects & executes itself in memory | Cobalt Strike, Brute Ratel, most red-team tools | High |
| 4 | Process Doppelgänging | Abuse NTFS transactions to load malicious PE without touching disk | Rare in commodity, some APT | Very High |
| 5 | Thread Execution Hijacking | Suspend legitimate thread → hollow its context → resume with malicious code | Emotet (old), some private crypters | High |
| 6 | APC Injection | Queue APC (asynchronous procedure call) to thread in target process | AsyncRAT, many .NET stealers | Medium |
| 7 | EarlyBird APC Injection | Queue APC while process is still suspended (before main thread runs) | Newer stealers & loaders | High |
| 8 | Direct Syscalls + NtMapViewOfSection | Map malicious section into another process (bypasses most EDR hooks) | Sliver, modern Cobalt forks, high-end malware | Very High |
The Classic DLL Injection Step-by-Step (the one you see 50× per week)
- Open target process (OpenProcess or NtOpenProcess)
- Allocate memory in target (VirtualAllocEx)
- Write malicious DLL path or shellcode (WriteProcessMemory)
- Force target to load/run it (CreateRemoteThread → LoadLibrary or shellcode address)
- Malicious code now runs inside explorer.exe, svchost.exe, etc.
How to spot it instantly in your lab (2025)
| Tool | What you look for |
|---|---|
| PE-bear / CFF | Imports: VirtualAllocEx, WriteProcessMemory, CreateRemoteThread |
| x64dbg | Breakpoints on those APIs → see if process handle ≠ itself |
| ProcMon | Process = explorer.exe doing WriteProcessMemory or LoadImage on weird DLL |
| Process Hacker | Right-click process → “Memory” tab → look for RX + W pages (shellcode) or weird DLLs |
| HollowsHunter / PE-sieve | Automatically flags hollowed processes & injected sections |
| Moneta / Hunt | Sysmon Event ID 8 (CreateRemoteThread) + Event ID 10 (memory access) |
Quick verdict checklist (when you see a new sample)
| You see these imports → | Verdict |
|---|---|
| VirtualAllocEx + WriteProcessMemory + CreateRemoteThread | 99% injection |
| Only Nt* versions of the above | Advanced injection (direct syscalls) |
| No suspicious imports but high network from svchost.exe | Reflective / memory-only injection |