Malware API Reference

Malware API Reference & Analysis Guide

A comprehensive reference for Windows APIs commonly abused by malware, along with analysis techniques and detection strategies.

Quick Reference: Common Malware APIs

Networking APIs

Detection tip: Monitor for WSAStartup() followed by connect() to suspicious IPs/ports, especially from non-browser processes.

Persistence APIs

Detection tip: Alert on registry modifications to Run/RunOnce keys, especially from temporary directories.

Encryption APIs (WinCrypt)

• CryptAcquireContext() - Acquire cryptographic provider
• CryptGenKey() - Generate encryption key
• CryptDeriveKey() - Derive key from password
• CryptDecrypt() - Decrypt data
• CryptReleaseContext() - Release provider

Detection tip: Ransomware often calls these in sequence. Monitor for rapid encryption of many files.

Anti-Analysis / VM Detection APIs

Assembly-level checks:

• CPUID() - CPU identification
• IN() - Port I/O (often fails in VMs)

Detection tip: Flag processes that query multiple anti-VM APIs early in execution then exit with no observable activity.

Locale/Keyboard-Based Execution Guards

Malware often aborts on certain locales to evade researchers:

• GetKeyboardLayout() - Enumerate installed layouts
• GetLocaleInfoA/W() - Resolve country/region codes
• GetSystemDefaultLangID() / GetUserDefaultLangID() - Get language IDs

Common blocked regions: CIS countries (Russia, Ukraine, Belarus, etc.)

Detection tip: Correlate locale API calls with immediate process termination and no network IOCs.

Emulator API Fingerprinting

Malware searches for sandbox/emulator exports:

Defender Virtualization exports:

• MpVmp32Entry, MpVmp32FastEnter
• MpCallPreEntryPointCode, MpCallPostEntryPointCode
• MpFinalize, MpReportEvent*, MpSwitchToNextThread*

VFS family:

• VFS_Open, VFS_Read, VFS_MapViewOfFile
• VFS_UnmapViewOfFile, VFS_FindFirstFile/FindNextFile
• VFS_CopyFile, VFS_DeleteFile, VFS_MoveFile

ThrdMgr family:

• ThrdMgr_GetCurrentThreadHandle, ThrdMgr_SaveTEB, ThrdMgr_SwitchThreads

Typical evasion: Delay execution 10-30 minutes if emulator detected:

cmd /c timeout /t %RANDOM_IN_[600,1800]% > nul

Stealth & Injection APIs

Detection tip: Alert on CREATE_SUSPENDED processes that allocate RWX memory before creating GUI/console windows.

Execution APIs

• CreateProcessA/W() - Create new process
• ShellExecute() - Execute via shell
• WinExec() - Execute command
• ResumeThread() - Resume suspended thread
• NtResumeThread() - Native thread resume

Miscellaneous APIs

Malware Techniques Deep Dive

DLL Injection

Execute arbitrary DLL inside another process:

1. Locate target process: CreateToolhelp32Snapshot(), Process32First(), Process32Next()
2. Open process: GetModuleHandle(), GetProcAddress(), OpenProcess()
3. Write DLL path: VirtualAllocEx(), WriteProcessMemory()
4. Load DLL: CreateRemoteThread() with LoadLibrary()

Alternative APIs: NTCreateThreadEx(), RtlCreateUserThread()

Reflective DLL Injection

Load DLL without normal Windows API calls:

• DLL mapped directly into process memory
• Imports resolved manually
• Relocations fixed in-memory
• DllMain() called directly

Thread Hijacking

1. Find target thread: CreateToolhelp32Snapshot(), Thread32First(), Thread32Next()
2. Open thread: OpenThread()
3. Suspend thread: SuspendThread()
4. Write DLL path: VirtualAllocEx(), WriteProcessMemory()
5. Resume with payload: ResumeThread()

Process Hollowing (RunPE)

Launch legitimate process suspended, replace its memory with malicious PE:

Typical workflow:

1. Spawn suspended process:

STARTUPINFOA si = { sizeof(si) };
PROCESS_INFORMATION pi;
CreateProcessA("C:\\Windows\\Microsoft.NET\\Framework32\\v4.0.30319\\RegAsm.exe",
              NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

2. Parse malicious PE headers to get SizeOfImage, sections, EntryPoint

3. Unmap original image: NtUnmapViewOfSection() / ZwUnmapViewOfSection()

4. Allocate new memory: VirtualAllocEx() with RWX permissions

5. Copy payload: WriteProcessMemory() - headers first, then sections

6. Patch thread context: SetThreadContext() - set EIP/RIP to payload entry point

7. Resume execution: ResumeThread()

Common host processes:

• RegAsm.exe (signed .NET Framework binary)
• MSBuild.exe (developer tooling)
• rundll32.exe (system utility)

MSBuild path resolution:

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\System32\MSBuild.exe
C:\Windows\SysWOW64\MSBuild.exe

Hooking Techniques

Detection Strategies

Process Hollowing Detection

1. Alert on CREATE_SUSPENDED processes that:

   • Never create GUI/console windows
   • Allocate RWX memory regions
   • Make outbound connections

2. Monitor API sequence: NtUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory

3. Hunt for unusual hosts:

   • MSBuild.exe from user-writable paths
   • RegAsm.exe without .NET context
   • rundll32.exe parented by short-lived loaders

4. ATT&CK mapping:

   • T1127.001 (Trusted Developer Utilities Proxy Execution: MSBuild)
   • T1055.012 (Process Injection: Process Hollowing)

Anti-Analysis Detection

1. Flag processes that:

   • Query multiple locale/keyboard APIs early
   • Exit with no observable activity
   • Call anti-VM APIs (BIOS strings, PnP devices, disk model)

2. Monitor for emulator fingerprints:

   • Search for MpVmp*, VFS_*, ThrdMgr_* exports
   • Detect delayed execution (10-30 minute timeouts)

Network-Based Detection

1. TLS pinning indicators:

   • SslStream usage with certificate validation
   • Compressed traffic (GZip)
   • Chunked responses (~16KB segments)

2. Argument gatekeeping:

   • Benign-looking CLI switches (e.g., /i:--type=renderer)
   • Process exits if switch absent

Analysis Workflow

Static Analysis

1. Import analysis: Look for suspicious API combinations
2. String extraction: Find URLs, file paths, registry keys
3. PE header inspection: Check for packed/obfuscated sections
4. Resource section: Look for embedded payloads

Dynamic Analysis

1. API monitoring: Track suspicious API sequences
2. Memory scanning: Look for injected code, decrypted strings
3. Network capture: Monitor C2 communication
4. Process tree: Identify parent-child relationships

Memory Forensics

1. Scan for RWX regions in suspicious processes
2. Look for hollowed processes (mismatched PE headers)
3. Identify injected threads (unusual thread start addresses)
4. Extract decrypted strings from memory dumps

References

• Unit42 – DarkCloud Stealer Infection Chain
• Check Point – Under the Pure Curtain
• Unit42 – PhantomVAI Loader
• MITRE ATT&CK – T1127.001 MSBuild
• VMDetector – Open-source VM detection

Usage Tips

• For detection rules: Focus on API sequences rather than single calls
• For hunting: Correlate multiple indicators (API calls + network + file system)
• For analysis: Use both static and dynamic methods for comprehensive coverage
• For research: Check references for latest campaign details and TTPs