本机API

ADVSTORESHELL is capable of starting a process using CreateProcess.^[1]

Akira executes native Windows functions such as GetFileAttributesW and GetSystemInfo.^[2]

Amadey has used a variety of Windows API calls, including GetComputerNameA, GetUserNameA, and CreateProcessA.^[3]

AppleSeed has the ability to use multiple dynamically resolved API calls.^[4]

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.^[5]

APT38 has used the Windows API to execute code within a victim's system.^[6]

Aria-body has the ability to launch files using ShellExecute.^[7]

AsyncRAT has the ability to use OS APIs including CheckRemoteDebuggerPresent.^[8]

Attor's dispatcher has used CreateProcessW API for execution.^[9]

Avaddon has used the Windows Crypto API to generate an AES key.^[10]

AvosLocker has used a variety of Windows API calls, including NtCurrentPeb and GetLogicalDrives.^[11]

Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.^[12][13][14]

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.^[15]

Bad Rabbit has used various Windows API calls.^[16]

BADHATCH can utilize Native API functions such as, ToolHelp32 and Rt1AdjustPrivilege to enable SeDebugPrivilege on a compromised machine.^[17]

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.^[18][19]

Bandook has used the ShellExecuteW() function call.^[20]

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().^[21]

Bazar can use various APIs to allocate memory and facilitate code execution/injection.^[22]

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.^[23]

BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.^[24]

Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.^[25]

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.^[26]

Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.^{[27][28][29][30]}

BlackTech has used built-in API functions.^[31]

BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.^[32]

BoxCaon has used Windows API calls to obtain information about the compromised host.^[33]

Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.^[34][35]

build_downer has the ability to use the WinExec API to execute malware on a compromised host.^[23]

Bumblebee can use multiple Native APIs.^[36][37]

CaddyWiper has the ability to dynamically resolve and use APIs, including SeTakeOwnershipPrivilege.^[38]

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.^[39]

Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.^[40]

Chimera has used direct Windows system calls by leveraging Dumpert.^[41]

CHIMNEYSWEEP can use Windows APIs including LoadLibrary and GetProcAddress.^[42]

Chrommme can use Windows API including WinExec for execution.^[43]

Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().^[44][45]

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe^[46][47][48]

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.^[49]

Conti has used API calls during execution.^[50][51]

CostaBricks has used a number of API calls, including VirtualAlloc, VirtualFree, LoadLibraryA, GetProcAddress, and ExitProcess.^[52]

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.^[53]

Cyclops Blink can use various Linux API functions including those for execution and discovery.^[54]

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution.^[55] DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution.^[56]

DarkTortilla can use a variety of API calls for persistence and defense evasion.^[57]

DCSrv has used various Windows API functions, including DeviceIoControl, as part of its encryption process.^[58]

DEADEYE can execute the GetComputerNameA and GetComputerNameExA WinAPI functions.^[59]

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.^[60]

Diavol has used several API calls like GetLogicalDriveStrings, SleepEx, SystemParametersInfoAPI, CryptEncrypt, and others to execute parts of its attack.^[61]

Donut code modules use various API functions to load and inject code.^[62]

DRATzarus can use various API calls to see if it is running in a sandbox.^[63]

Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.^[64]

Egregor has used the Windows API to make detection more difficult.^[65]

Emotet has used CreateProcess to create a new process to run its executable and WNetEnumResourceW to enumerate non-hidden shares.^[66]

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.^[67]

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.^[68]

Explosive has a function to call the OpenClipboard wrapper.^[69]

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.^[70]

Flagpro can use Native API to enable obfuscation including GetLastError and GetTickCount.^[71]

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.^[72]

FunnyDream can use Native API for defense evasion, discovery, and collection.^[73]

Gamaredon Group malware has used CreateProcess to launch additional malicious components.^[74]

Gelsemium has the ability to use various Windows API functions to perform tasks.^[43]

gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.^[75]

GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.^[76]

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.^[60]

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.^[77]

Grandoreiro can execute through the WinExec API.^[78]

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.^[79]

GuLoader can use a number of different APIs for discovery and execution.^[80]

Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.^[81]

HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.^[82]

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.^{[83][84][85][86]}

HermeticWizard can connect to remote shares using WNetAddConnection2W.^[85]

Higaisa has called various native OS APIs.^[87]

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.^[88]

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.^[89]

HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.^[90]

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.^[91]

IMAPLoader imports native Windows APIs such as GetConsoleWindow and ShowWindow.^[92]

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.^[93]

INC Ransomware can use the API DeviceIoControl to resize the allocated space for and cause the deletion of volume shadow copy snapshots.^[94]

InnaputRAT uses the API call ShellExecuteW for execution.^[95]

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.^[96]

Kevin can use the ShowWindow API to avoid detection.^[97]

KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.^[98]

KOCTOPUS can use the LoadResource and CreateProcessW APIs for execution.^[99]

KONNI has hardcoded API calls within its functions to use on the victim's machine.^[100]

Latrodectus has used multiple Windows API post exploitation including GetAdaptersInfo, CreateToolhelp32Snapshot, and CreateProcessW.^[101][102]

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server.^[103] Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.^[104][105]

LightNeuron is capable of starting a process using CreateProcess.^[106]

LitePower can use various API calls.^[107]

Lizar has used various Windows API functions on a victim's machine.^[108]

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.^[109]

MacMa has used macOS API functions to perform tasks.^[110][111]

Mafalda can use a variety of API calls.^[112]

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.^[113]

Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.^[114]

After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.^[115]

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.^[116]

metaMain can execute an operator-provided Windows command by leveraging functions such as WinExec, WriteFile, and ReadFile.^[112][117]

Metamorfo has used native WINAPI calls.^[118][119]

Meteor can use WinAPI to remove a victim machine from an Active Directory domain.^[120]

Milan can use the API DnsQuery_A for DNS resolution.^[97]

Mis-Type has used Windows API calls, including NetUserAdd and NetUserDel.^[121]

Misdat has used Windows APIs, including ExitWindowsEx and GetKeyboardType.^[121]

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.^[122][123]

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.^[124]

Nebulae has the ability to use CreateProcess to execute a process.^[125]

Netwalker can use Windows API functions to inject the ransomware DLL.^[126]

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.^[127]

NightClub can use multiple native APIs including GetKeyState, GetForegroundWindow, GetWindowThreadProcessId, and GetKeyboardLayout.^[128]

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.^[129][130]

njRAT has used the ShellExecute() function within a script.^[131]

During Operation Dream Job, Lazarus Group used Windows API ObtainUserAgentString to obtain the victim's User-Agent and used the value to connect to their C2 server.^[103]

During Operation Honeybee, the threat actors deployed malware that used API calls, including CreateProcessAsUser.^[132]

During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().^[133]

During Operation Wocao, threat actors used the CreateProcessA and ShellExecute API functions to launch commands after being injected into a selected process.^[134]

PcShare has used a variety of Windows API functions.^[73]

Pikabot uses native Windows APIs to determine if the process is being debugged and analyzed, such as CheckRemoteDebuggerPresent, NtQueryInformationProcess, ProcessDebugPort, and ProcessDebugFlags.^[135] Other Pikabot variants populate a global list of Windows API addresses from the NTDLL and KERNEL32 libraries, and references these items instead of calling the API items to obfuscate execution.^[136]

Pillowmint has used multiple native Windows APIs to execute and conduct process injections.^[137]

PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.^[138]

PLEAD can use ShellExecute to execute applications.^[139]

PlugX can use the Windows API functions GetProcAddress, LoadLibrary, and CreateProcess to execute another process.^[140][141]

PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.^[70]

Pony has used several Windows functions for various purposes.^[142]

Prestige has used the Wow64DisableWow64FsRedirection() and Wow64RevertWow64FsRedirection() functions to disable and restore file system redirection.^[143]

Pteranodon has used various API calls.^[144]

QakBot can use GetProcAddress to help delete malicious strings from memory.^[145]

QUIETCANARY can call System.Net.HttpWebRequest to identify the default proxy configured on the victim computer.^[146]

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.^[125]

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.^[147]

RCSession can use WinSock API for communication including WSASend and WSARecv.^[148]

RDFSNIFFER has used several Win32 API functions to interact with the victim machine.^[149]

REvil can use Native API for execution and to retrieve active services.^[150][151]

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().^[133]

ROKRAT can use a variety of API calls to execute shellcode.^[152]

When executing with non-root permissions, RotaJakiro uses the the shmget API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the execvp API to help its dead process "resurrect".^[153]

Royal can use multiple APIs for discovery, communication, and execution.^[154]

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.^[155]

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.^[156]

S-Type has used Windows APIs, including GetKeyboardType, NetUserAdd, and NetUserDel.^[121]

Saint Bot has used different API calls, including GetProcAddress, VirtualAllocEx, WriteProcessMemory, CreateProcessA, and SetThreadContext.^[157][158]

Samurai has the ability to call Windows APIs.^[129]

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: Wow64DisableWow64FsRedirection() and Wow64RevertWow64FsRedirection().^[143]

Sardonic has the ability to call Win32 API functions to determine if powershell.exe is running.^[159]

SharpDisco can leverage Native APIs through plugins including GetLogicalDrives.^[128]

ShimRat has used Windows API functions to install the service and shim.^[160]

ShimRatReporter used several Windows API functions to gather information from the infected system.^[160]

SideCopy has executed malware by calling the API function CreateProcessW.^[161]

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.^[162]

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.^[163][164]

SILENTTRINITY has the ability to leverage API including GetProcAddress and LoadLibrary.^[165]

Siloscape makes various native API calls.^[166]

SodaMaster can use RegOpenKeyW to access the Registry.^[167]

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.^[52]

StrifeWater can use a variety of APIs for execution.^[168]

Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.^[169]

SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.^[170]

SVCReady can use Windows API calls to gather information from an infected host.^[171]

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.^[172][173]

SysUpdate can call the GetNetworkParams API as part of its C2 establishment process.^[174]

TA505 has deployed payloads that use Windows API calls on a compromised host.^[175]

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.^[176][177]

ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.^[178]

TinyTurla has used WinHTTP, CreateProcess, and other APIs for C2 communications and other functions.^[179]

ToddyCat has used WinExec to execute commands received from C2 on compromised hosts.^[130]

Torisma has used various Windows API calls.^[180]

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow.^[181] TrickBot has also used Nt* API functions to perform Process Injection.^[182]

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.^[183]

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.^[184]

Uroburos can use native Windows APIs including GetHostByName.^[185]

Ursnif has used CreateProcessW to create child processes.^[186]

Volgmer executes payloads using the Windows API call CreateProcessW().^[187]

WarzoneRAT can use a variety of API calls on a compromised host.^[188]

WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.^[189]

Waterbear can leverage API functions for execution.^[190]

WhisperGate has used the ExitWindowsEx to flush file buffers to disk and stop running processes and other API calls.^[191][192]

WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.^[193]

Winnti for Windows can use Native API to create a new process and to start services.^[194]

Woody RAT can use multiple native APIs, including WriteProcessMemory, CreateProcess, and CreateRemoteThread for process injection.^[195]

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.^[196]

xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.^[33]

ZeroCleare can call the GetSystemDirectoryW API to locate the system directory.^[42]

ZxShell can leverage native API including RegisterServiceCtrlHandler to register a service.RegisterServiceCtrlHandler

ZxxZ has used API functions such as Process32First, Process32Next, and ShellExecuteA.^[197]

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs. ^[198]

Identify and block potentially malicious software executed that may be executed through this technique by using application control ^[199] tools, like Windows Defender Application Control^[200], AppLocker, ^{[201] [202]} or Software Restriction Policies ^[203] where appropriate. ^[204]