RRE 4: Malware Process Injection for a Wealth of Stealth!

The first, real step in our journey to write real malware: process injection! Process injection is the act of taking code from one place, whether it be a DLL or code in another executable, and injecting it into another running process. Malware uses this for stealth, privilege escalation and lots more. We're going to talk about process memory, process memory rebasing and reallocation and creating remote threads in this one, so buckle up for a long and complicated video!

RRE is a series where I write malware so I can better learn how to fight it. If you liked this video or the series, be sure to leave me a like, subscribe to see more and follow me on Twitter for more updates!

-- Twitter -- https://twitter.com/viking_sec

-- Patreon -- https://www.patreon.com/Viking_Sec

-- Video Notes and Resources --

iredteam article that explains a lot of this and helped me learn a ton: https://www.ired.team/offensive-security/code-injection-process-injection/pe-injection-executing-pes-inside-remote-processes#code

MSDN article on process handles https://docs.microsoft.com/en-us/windows/win32/procthread/process-handles-and-identifiers

MSDN article on GetModuleHandle https://docs.microsoft.com/en-us/previous-versions/ms908443(v=msdn.10)

PE Header Explanation https://blog.kowalczyk.info/articles/pefileformat.html

MSDN article on VirtualAlloc() https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualalloc

MSDN article on OpenProcess() https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess

iredteam article on memory rebasing https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations#relocation

-- Table of Contents --

0:00 intro 0:30 demo, intro to process injection 6:00 GetModuleHandle 7:55 DOS Headers and NT Headers 11:20 Process Memory and Base Addresses 13:40 VirtualAlloc and Allocating Memory 17:30 OpenProcess to Access Target Process Memory 21:15 Memory Reallocation 32:07 CreateRemoteThread 33:40 Wrap-up

-- #malwaredevelopment #hacking #malware ... https://www.youtube.com/watch?v=2tgVEmgGjFo