Skills · learning

Malware Essentials for Windows Payloads

Malware Essentials for Windows Payloads

The practical mental model

Many Windows implants and agents are delivered as executable files, DLLs, shellcode, or scripts. There is no single format used by every command-and- control framework.

A loader is a program or component that prepares another payload for execution. Depending on the design, it may load a DLL through normal Windows loading mechanisms, map a PE image itself, or copy position-independent machine code into memory. A loader plus a DLL is not automatically shellcode.

Shellcode usually means position-independent machine code intended to be placed in a process and executed, often without the normal file-loading path. The exact meaning varies by context, so the format and execution method should be stated precisely.

Writing a payload to disk can create useful forensic evidence and may be detected by security products. Loading from memory can reduce some disk artifacts, but it does not make the activity invisible. Memory, process, thread, image-load, and network telemetry may still reveal it.

Portable Executable format

PE is the Windows executable image format used by files such as .exe and .dll. The format describes how Windows should interpret and load an image; it does not mean that every PE is loaded identically or that execution happens without file-backed activity.

Other platforms use different executable formats, including ELF on Linux and Mach-O on macOS. Text, image, PDF, and JSON files are not executable image formats merely because an application can open them.

A useful simplified PE structure is:

DOS header and stub
PE signature and COFF file header
Optional header
Data directories
Section table and sections
  .text   code
  .data   writable data
  .rdata  read-only data and constants
  .rsrc   resources
  .reloc  base relocation information, when present

Microsoft’s PE specification describes the headers, sections, imports, exports, relocations, resources, and other data directories. The operating system uses those structures when it maps an image and resolves what it needs.

The DOS header begins with the MZ signature. Its e_lfanew field is located at file offset 0x3c and points to the PE signature. The PE signature is PE\0\0. These are useful recognition points, but the full specification is not something I need to memorize for the current CRTO goal.

The distinction between an EXE and a DLL is represented in the PE metadata and in how the image is used. A DLL is an executable image intended to be loaded as a library rather than launched as a normal application. Windows supports both load-time and run-time dynamic linking, including APIs such as LoadLibrary.

Programs, processes, and threads

A program is a set of instructions and data. A process is a running instance with its own virtual address space, handles, security context, and other resources. Multiple processes can run the same program while maintaining separate process state.

A thread is an execution path within a process. It has CPU state, including an instruction pointer and stack-related state, and it executes instructions on behalf of the process. A process may contain multiple threads that share the process address space.

Windows exposes several process-creation APIs. CreateProcessW creates a process with the caller’s security context in the normal case. Other APIs can create a process under a different token or logon context when the caller has the required permissions. User-mode APIs eventually cross into the Windows kernel, but the internal path is an implementation detail rather than a rule to rely on for every Windows version.

Virtual memory

Each process has its own virtual address space. The memory manager maps virtual pages to physical memory as needed, so physical pages do not need to be contiguous. Process memory can contain executable code, writable data, mapped files, stacks, heaps, and other runtime state.

This matters for process injection because the technique usually combines two separate questions:

1. How does code or data enter the target process’s address space?
2. How does a thread begin executing that code or data?

At a high level, injection may involve allocating or mapping memory, writing or mapping content, changing memory permissions, and creating or redirecting an execution path. The exact APIs and telemetry depend on the technique.

Access tokens and privileges

A process normally has a primary access token describing its security context. The token can include the user SID, group memberships, and enabled privileges. Threads can impersonate another token, which changes the security context used for operations performed by that thread.

Windows privileges are distinct from ordinary object permissions. Examples of high-impact privileges include:

• SeDebugPrivilege, which can enable access to other processes subject to policy and protected-process restrictions
• SeTakeOwnershipPrivilege, which allows taking ownership of securable objects when the privilege is enabled and the operation is otherwise permitted
• SeRestorePrivilege, which can bypass some file and registry access checks for restoration operations
• SeLoadDriverPrivilege, which permits loading drivers when other requirements are satisfied
• SeCreateTokenPrivilege, which is highly sensitive because it can be used in token-creation scenarios

Having a privilege present does not mean every operation will succeed. Its state, the requested access, integrity boundaries, protected-process rules, security policy, and other controls still matter.

Process injection

Process injection is a family of techniques that places code or data in another process or redirects an existing execution path. It can support execution in a different security context or attempt to blend activity into a trusted process, but it is not automatically privilege escalation and it does not guarantee defense evasion.

Common conceptual families include:

• Classic remote injection: obtain an appropriate process handle, allocate memory, write content, and create a thread or another execution path.
• Thread hijacking: suspend or otherwise control an existing thread, change its context, and resume it at a different execution location.
• Asynchronous procedure calls: queue work to a thread and rely on that thread entering an alertable state.
• Process hollowing: create a process in a suspended state, replace or unmap its original image, map another image, adjust the process state, and resume it. The exact implementation varies.
• DLL injection: cause a target process to load a DLL through an appropriate loading path.

These techniques can generate valuable defensive signals, including unusual cross-process handles, remote memory allocation or writes, executable private memory, thread creation, thread-context changes, image loads, and mismatches between a process and the code executing inside it.

Platform Invoke

P/Invoke is the .NET mechanism for calling functions in unmanaged libraries from managed C# code. It can expose native Windows APIs exported by DLLs such as kernel32.dll, advapi32.dll, and user32.dll.

P/Invoke is a language interop mechanism, not a separate injection technique. The security meaning comes from the API and how it is used.

What I need to remember for CRTO

I do not need to memorize every PE field or reproduce injection code yet. The useful mental model is:

PE metadata tells Windows how an image is structured.
Processes own virtual address spaces.
Threads execute instructions inside those processes.
Tokens describe security context.
Injection changes where code or data lives, or where execution goes.

That model makes later techniques easier to understand without confusing a file format, a loader, shellcode, a process, and a thread.

Review prompts

• What is the difference between a PE image, a DLL, a loader, and shellcode?
• Why does loading from memory not eliminate detection opportunities?
• Which parts of process injection concern memory, and which concern execution?
• How do a process token and an impersonating thread differ?
• Which telemetry could reveal remote memory writes or a new execution path?

This is a living study note. Sources and understanding may change as it is reviewed.