This technique uses the LoadLibrary API as a way to load a malicious library using Windows PE loader and execute its entry point. The main goal is to inject the path of the malicious DLL into the process using the VirtualAllocEx API and WriteProcessMemory. Then, it creates a thread into that process using CreateRemoteThread, with the address of the LoadLibrary API as the thread start address. When passing the DLL path as an argument to that thread (which is passed to the LoadLibrary API), the Windows PE loader will load that DLL into the process and execute its code flawlessly:
Figure 3. Simple DLL injection mechanism
The exact steps the malware generally follows are like so:
- Get the targeted process handle via its PID using the OpenProcess API. This handle will be used to access, read, and write to this process.
- Allocate a space in that process virtual memory using the VirtualAllocEx API. This space will be used to write the full path of the malicious...
