Hello, welcome to a new section, this time we are going to study a new injection technique.
It is called a synchronous procedure called injection, where we'll be injecting a callback function
or remote processes basic concepts.
It is a kind of callback function mechanism by putting instructions in memory cue of a running track
when you enter southern state.
You will notice the Q and execute instructions in the queue.
The term asynchronous means not executing immediately.
It can execute any time in the future.
A sample of ABC.
For example, if a process wants to read a file, it will make a request to the operating system.
But opening a fire is slow, so the process will not stop in a week, but allows the US to open the
file while the process continues to do other things.
Once the file is ready, the operating system will inform the process that upon the process, who execute
the instruction in the queue.
Mechanism or APC injection on the left, we have a malware Trojan.
We have an embedded.
On the right, we have a target process, we attract more.
Inside the target process is Typekit.
Every Iranian trained who have been executed.
The first step is to search for the trip.
So the malware search for the process, and once he finds it, he was searched for the trip within the
process.
And this we're of before.
The second step is after having found the process and the target threat.
He will then allocate memory.
In the target process, if you do that by using the API function, call virtual help.
He asks.
If you ask me for.
So in here, the blue shaded box shows the newly allocated memory.
Next, the malware in the shark could do this newly allocated memory.
He does that by using the API function call right process memory.
So both of these APIs have been used before in previous lessons.
So now the shellcode has been copied over to the newly allocated memory over here.
Nice.
The American Legion had this drop to the queue.
ABC queue.
He does that by using the API function, call Cue user ABC.
So now the shark has been added into the queue.
The ABC queue.
Then the next step is to wait for the trek, to enter a little more state.
Eligible states, one of these states here, when the track calls any of these functions, you can tell
the eligible state, for example, a signal of getting with message reach for multiple objects, wait
for multiple projects recording objects.
So these states can be entered into, usually by some kind of task involving funnel operations, for
example.
Once the threat enters energy state, you notice essential Sharkawy instruction in the Q and so you
will go there and then you will execute the good.
Advantages and disadvantages of asynchronous procedure, call injection advantages, delay execution
or shortcut truth of causation between Norway and target.
A little girl state history, not by no way, but by Taggert process user will not suspect that the
never process is responsible.
Disadvantages it needs to reach for track to enter in editable state and is therefore slow and uncertain
uses which are in right process memory API functions, which are usually detected by antivirus unless
obfuscated.
That is all for the theoretical background on APC injection.
Thank you for watching.