Shellcode Injection via CreateThreadpoolWait
Created the Sunday 19 June 2022. Updated 9 months, 1 week ago.
Shellcode injection is a technique used by malware to execute arbitrary code within the context of a targeted process. One method of achieving this is through the use of the
CreateThreadpoolWait function, which is a part of the Windows thread pool API.
In the context of shellcode injection,
CreateThreadpoolWait is used to create a wait object that is associated with a thread pool. The malware can then use this wait object to execute its shellcode within the context of the targeted process, by passing the shellcode as a callback function to the
Here is a summary of the steps:
The malware creates an event object with the
CreateEventfunction, and sets it to the Signaled state.
The malware allocates read-write-execute (RWX) memory for the shellcode using the
VirtualAllocfunction and writes the shellcode to this memory.
The malware creates a wait object using the
CreateThreadpoolWaitfunction and specifies the address of the shellcode as the callback function.
The malware sets the wait object using the
The malware waits for the wait object to become signaled using the
WaitForSingleObjectfunction. When the wait object is signaled, the callback function (which contains the shellcode) is executed.
Other techniques injection includes using APIs such as
Featured Windows API's
Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.