Hello.
I can't do in U.S. decision, in fact, early, but ABC injection.
Achieving camouflage by hijacking a legitimate process before it hits entry point.
Camouflage is where it hides behind another process, taking on the icon of the target process.
Basic concepts a malware creates a legitimate process in a suspended state.
This is a first step.
Then injects charcoal into it.
And inserts a job into the threats, ABC Q.
And finally, resumes the threat they shall execute before the procession begins in order to avoid detection
by anti-malware house anti-malware folks.
There was A..
No way dots which are running in sight the software itself.
Mechanism of early, but by injection on the left is a malware trojan with an embedded shellcode on
the right, he's the target programmed, has not yet started running.
It is still on the file.
It will be started by the malware Trojan.
So once you start it, you will have the usual threat and also APC within it.
But at the moment it has not yet started.
So the first step is the malware Trojan will create a process in a suspended state.
The Mehretu General open the target program and run it, but.
Put it in a suspended state.
So at this point in time, the the target process is suspended as though he was a zombie.
And he has got threats and AQAP IQ inciting.
Second is to allocate memory.
It does that by which, yes, API.
And this is the educated memory in blue.
Then you copy the shellcode to the memory using the right process, memory API function.
And now this has been copied over.
Next, he will jump to the queue.
The APC queue using the queue user APC API function and now the shellcode has been added into the APC
queue.
Then he will resume the trip using the resume function.
And now the trick has been resume.
You will go to the APEC queue and they shall call in.
So once I shall go execute, this target process is camouflaged inside it, inside.
You have your jacket running.
But I'll say it takes on the application icon of the target process.
So this is the mechanism early, but hippity injection.
Advantages and disadvantages of early, but APC injection advantages.
Firstly, you camouflage the execution of the malicious code by hijacking a legitimate process before
it hits the entry point.
The remaining are the actual legitimate processes abandoned whilst the shark runs.
So coming back to this, once the process resumes, the checkout takes over, the remaining core of
that process never, never executes.
He never runs.
That he bypasses security products specifically for those functions, which are built into the software
in order to detect malicious behavior.
The shark executes before the process begins.
In order to avoid detection by anti-malware, who's?
So he runs the application icon of the commissioning process, so to a casual observer or even to antivirus,
it appears as a legitimate process.
The disadvantages.
Firstly, he uses ritual and process memory, which are usually detected by Avy unless they obfuscate
obfuscated.
He may also occasionally crash of one exit.
And this is quite common in this kind of APEC injection event in the Czech context injection, as well
as all the Abbi's injections of cash in the immigration.
Thank you for watching.
It's all for these theoretical background on early, but ABC injection.