value:  Cobalt Strike can use process hollowing for execution. ;; Denis performed process hollowing through the API calls CreateRemoteThread ResumeThread and Wow64SetThreadContext. ;; Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%. ;; Duqu is capable of loading executable code via process hollowing. ;; Gorgon Group malware can use process hollowing to inject one of its trojans into another process. ;; ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process. ;; Lokibot has used process hollowing to inject into legitimate Windows process vbc.exe. ;; menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant. ;; The NETWIRE payload has been injected into benign Microsoft executables via process hollowing. ;; Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload. ;; A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe. ;; Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware. ;; A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process. ;; TrickBot injects into the svchost.exe process. ;; Ursnif has used process hollowing to inject into child processes.
name: Process Injection: Process Hollowing