Asynchronous Procedure Call (APC) is a function that gets executed asynchronously in the context of another thread. When a thread enters an alertable state (that is, when it executes the SleepEx, SignalObjectAndWait, MsgWaitForMultipleObjectsEx, WaitForMultipleObjectsEx, or WaitForSingleObjectEx APIs) and before it gets resumed, all the queued user-mode APC functions and kernel-mode APC functions are executed in the context of that thread, allowing the malware to execute user-mode code inside that process before returning control back to it.
For a malware sample to queue an APC function, it needs to perform the following steps:
- Get the ETHREAD object of the thread it wants to queue an APC function by providing its Thread ID (TID). This can be done by using the PsLookupThreadByThreadId API.
-
Attach the user-mode function to this thread using the KeInitializeApc API.
- Add this function to the queue of the APC functions to be executed in this...
