Please enable JavaScript.

Coggle requires JavaScript to display documents.

malicious behaviours of commonly used API / functions - Coggle Diagram

- - - - LoadLibraryA() (K32) -> Load the malicious DLL into attacking process’s address space. This function call can load any DLL to process with in which it is running. It requires one parameter that designates as a string, the name of the DLL that needs to be loaded.
        GetProcAddress() (K32) -> Retrieve the address of the filter function on the remote process.
        GetWindowsThreadProcessId() -> Get ID of Target thread.
        SetWindowsHookEx() -> Install the filter function in the hook chain of the remote processWorks only for GUI application
        Inject to all application in single call
        BroadcastSystemMessage() -> This is used to send message by attacking process to victim process (internally).
        GetMessage()
        DispatchMessage()
    - - OpenProcess() (K32) -> With this the attacker process can talk with the targeted VICTIM process.
        VirtualAllocEx() (K32) -> Standard windows api call that allows one process to allocate memory space inside another process [used to store the string name of the malicious DLL].
        WriteProcessMemory() (K32) -> In windows one process can write in to the memory space of another process. [HIGHLY SUSPICIOUS] WITH THIS THE VICTIM PROCESS WILL BE INJECTED WITH A STRING THAT CAN LATER LOAD TO LoadLibraryA() (K32) FUNCTION CALLS.
        GetModuleHandle() (K32) -> Allows the process to determine how to access some dll that might be loaded into the memory space. locate kernal32.dll (used to implement loadlibrary function)
        GetProcAddress() (K32) -> Used to locate the address of the LoadLibrary() within kernel32.dll file
        CreateRemoteThread() (K32) -> This will Create a remote thread inside a remote process, One of the argument that function takes is the address of a function that the new thread should run. Once it’s been created this call will execute the following :-An new thread will be created in the remote process
        LoadLibraryA (K32) will be run in the newly created thread.
        LocadLibraryA (K32) will load the malicious DLL into the remote address space.Works on all application
        Only works on NT/XP based system
        LoadLibrary(“malware.dll”) (K32)