Shellcode Injection via CreateThreadpoolWait
Created the Sunday 19 June 2022. Updated 3 months ago.
Shellcode injection is a technique used by malware to execute arbitrary code within the context of a targeted process. One method of achieving this is through the use of the
CreateThreadpoolWait function, which is a part of the Windows thread pool API.
In the context of shellcode injection,
CreateThreadpoolWait is used to create a wait object that is associated with a thread pool. The malware can then use this wait object to execute its shellcode within the context of the targeted process, by passing the shellcode as a callback function to the
Here is a summary of the steps:
The malware creates an event object with the
CreateEventfunction, and sets it to the Signaled state.
The malware allocates read-write-execute (RWX) memory for the shellcode using the
VirtualAllocfunction and writes the shellcode to this memory.
The malware creates a wait object using the
CreateThreadpoolWaitfunction and specifies the address of the shellcode as the callback function.
The malware sets the wait object using the
The malware waits for the wait object to become signaled using the
WaitForSingleObjectfunction. When the wait object is signaled, the callback function (which contains the shellcode) is executed.
Other techniques injection includes using APIs such as
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.