Dissecting Windows Malware Series – Process Injections – Part 2

In the previous article,  we introduced the components of Malware Analysis: Basic Static, Advanced Static, Basic Dynamic, Advanced Dynamic – then, we delved into the analysis of a malware sample that was presented.

The analysis revealed the exploitation of the AppInitDLLs mechanism for persistence, the addition of the attacker’s email address to every outgoing email from the endpoint, and the use of a User-Space Rootkit to continue operating and evade detection.

We stand by our concluding …

addition address advanced analysis article attacker basic components dynamic email exploitation malware malware analysis mechanism persistence process sample series windows windows malware