This technique sounds very similar to DLL injection. The difference here is actually in the executed code inside the target process. In this technique, the malware injects a piece of assembly code (as an array of bytes) and executes it using the CreateRemoteThread API. This piece of code is position-independent and we can say it's PE-independent. It has the ability to load its own import table, access its own data, and execute all of the malicious activities inside the targeted process.
The steps that the malware follows for this code injection techniques are like so:
- Search for the targeted process using CreateToolhelp32Snapshot, Process32First, and Process32Next.
- Get the process handle using the OpenProcess API.
- Allocate memory inside this process using VirtualAllocEx (or CreateSectionEx, which can be used in pretty much the same way) with the size of the whole piece of the assembly code to be injected.
- Copy that code into the targeted process using WriteProcessMemory...
