Native API

ADVSTORESHELL is capable of starting a process using CreateProcess.^[22]

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.^[55]

Aria-body has the ability to launch files using ShellExecute.^[45]

Attor's dispatcher has used CreateProcessW API for execution.^[40]

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.^[53]

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.^[24][25]

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().^[27]

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.^[48]

build_downer has the ability to use the WinExec API to execute malware on a compromised host.^[48]

Cobalt Strike's "beacon" payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe^[18]

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.^[54]

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.^[50]

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.^[19]

Gamaredon Group malware has used CreateProcess to launch additional malicious components.^[61]

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.^[50]

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.^[56]

HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.^[35]

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.^[39]

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.^[37]

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.^[20]

InnaputRAT uses the API call ShellExecuteW for execution.^[29]

LightNeuron is capable of starting a process using CreateProcess.^[36]

MAZE has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.^[43]

Metamorfo has used native WINAPI calls.^[51]

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.^[30]

Netwalker can use Windows API functions to inject the ransomware DLL.^[46]

PlugX can use the Windows API function CreateProcess to execute another process.^[23]

Pony has used several Windows functions for various purposes.^[44]

Ramsay can use the Windows COM API to schedule tasks and maintain persistence as well as the WriteFile, CloseHandle, and GetCurrentHwProfile functions during collection.^[47]

RDFSNIFFER has used several Win32 API functions to interact with the victim machine.^[38]

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().^[42]

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.^[49]

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.^[41]

Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().^[42]

ShimRat has used Windows API functions to install the service and shim.^[21]

ShimRatReporter used several Windows API functions to gather information from the infected system.^[21]

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.^[57][58]

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.^[32][33]

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow.^[28]

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.^[60]

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.^[59]

Ursnif has used CreateProcessW to create child processes.^[34]

Volgmer executes payloads using the Windows API call CreateProcessW().^[26]

WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.^[52]

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.^[31]

Identify and block potentially malicious software executed that may be executed through this technique by using application control ^[12] tools, like Windows Defender Application Control^[13], AppLocker, ^{[14] [15]} or Software Restriction Policies ^[16] where appropriate. ^[17]