Learning Malware Analysis

3.5 Remote Executable/Shellcode Injection

In this technique, the malicious code is injected into the target process memory directly, without dropping the component on the disk. The malicious code can be a shellcode or an executable whose import address table is configured for the target process. The injected malicious code is forced to execute by creating a remote thread via CreateRemoteThread(), and the start of the thread is made to point to the code/function within the injected block of code. The advantage of this method is that the malware process does not have to drop the malicious DLL on the disk; it can extract the code to inject from the resource section of the binary, or get it over the network and perform code injection directly. ...