Hello and welcome to a new session, this new session.
We are going to do process injection.
What is process injection?
It is injecting Beirut to another process, the mechanism of process injection.
On the left, you have a malware trillion with a shellcode, and on the right and you have a target
process, which could be any other running program, for example, Explorer, Microsoft Paint and so
on.
Now, military units going to allocate memory in the targeted process, as can be seen by the green
shaded area.
He will use the Windows API call, which he likes.
Next step is to write the sherkat.
So the medical unit will use the Windows API call to process memory to copy a Sherko into the newly
allocated memory.
Finally, the Maretto region will call the API, create and remote treck in order to run the Chalco,
which he has copy over to the allocated memory while processing Yashin.
Three reasons.
Reasons for processing Yashin.
Firstly, it is to pivot to a more longer lasting process.
For example, from Nakazawa to Explorer, or even to a vet browser.
This is because the initial program which launch the navigator region may be only temporary.
Perhaps the user was just opening what documentary?
Something to read the file, or perhaps opening a claim software somewhere for downloading files.
And then after finishing, she is going to close the program.
So that's why you need to move to another program.
And one program which is always opening will be your Windows Explorer.
So that's why you never want to pivot to a second process, which is running in memory so that you will
stay resident in memory.
So the second is you want to migrate to a more legitimate process for connecting to the Internet.
And the reason is because if you were to open the Microsoft Word and use Microsoft as a malware Trojan
to connect to the Internet, the firewall may block it.
Because Microsoft does not normally connect to the Internet.
So in such a case, it makes a lot of sense for the malware Trojan to pivot to that browser and from
the Web browser, connect to the Internet.
And it is more likely that the firewall or the Windows defense system will allow you no connection to
the Internet if it comes from a browser.
And the reason is has a backup back door connection.
And also, you might enjoy yourself into another process in order that shoot the first process, come
down for whatever reason.
The second process is still up and running as become very common.
You need this kind of secondary backup in order for the malware to reach out to the command and control
server.
So that's all for this video.
Thank you for watching.