Malware Development: Process Injection

196,811
0
Published 2023-05-30
#Malware #Development #redteam

Pork is airborne and hell hath frozen over; MALDEV PART 2 IS FINALLY OUT! Thank you, guys, so much for bearing with my RNG upload schedules (I don't even know if the word "schedule" can even be associated with me). Please enjoy the newest installment of our ongoing Malware Development series. As always, you can find more on my blog here: crows-nest.gitbook.io/

In the next video, we'll be taking a look at the lower-level NTAPI from NTDLL, and perhaps some system calls! I am going to be taking a bit of a break since this video almost obliterated my soul; I'm a one-man team and this takes forever, especially when it's an hour long. I sincerely hope you guys found some use for this video, and once again, thank you for being here and watching. I will catch you guys later :)

I love you guys, enjoy.

⚠️ Disclaimer:
The information presented in this video is for educational purposes only. It is not intended to be used for illegal or malicious activities. The creator and any individuals involved in the production of this video are not responsible for any misuse of the information provided. It is the responsibility of the viewer to ensure that they comply with all relevant laws and regulations in their jurisdiction.

🔖 My Socials:
avatar/mascot made with picrew: picrew.me/en/image_maker/1108773
- full credits to the artist: twitter.com/mimisentakosen
- visit her shop: coconala.com/services/1871766?ref=profile_top_serv…
official discord server: dsc.gg/crow-academy
crows-nest.gitbook.io/
github.com/cr-0w
twitter.com/cr0ww_

💖 Support My Work
www.patreon.com/cr0w
ko-fi.com/cr0ww
www.buymeacoffee.com/cr0w
Join this channel to get access to perks:
youtube.com/channel/UCMqXCTXulFWHrmd2588IqJw/join

🎵 Music/Videos Used:
youtube.com/@KronoMuzik =    • [Twitch safe] Animal Crossing Lofi Ch...  
youtube.com/@SuperLofiWorld =    • No Copyright Music Playlist - 1 Hour ...  
youtube.com/@jonathanwebster1452 =    • Stargate style wormhole  

❤️ Websites Featured:
www.elastic.co/blog/ten-process-injection-techniqu…
learn.microsoft.com/en-us/windows/win32/api/
crows-nest.gitbook.io/
crows-nest.gitbook.io/crows-nest/malware-developme…
crows-nest.gitbook.io/crows-nest/malware-developme…

The images and music used in this video are used under the principle of fair use for the purpose of criticism, comment, news reporting, teaching, scholarship, and research. I do not claim ownership of any of the images/music and they are used solely for the purpose of enhancing the content of the video. I respect the rights of the creators and owners of these images and will remove any image upon request by the rightful owner.

Copyright Disclaimer under section 107 of the Copyright Act of 1976, allowance is made for “fair use” for purposes such as criticism, comment, news reporting, teaching, scholarship, education, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing.

🕰️ Timestamps:
00:00 - Intro
01:18 - Prerequisites
03:52 - Small Disclaimer
04:44 - What is Process Injection?
06:58 - Shellcode Injection
38:37 - Generating Shellcode
41:05 - Starting The Listener
41:36 - Performing The Injection
42:36 - Next Step
43:12 - What is a DLL?
45:03 - Creating a DLL
50:42 - DLL Injection
1:01:20 - Performing The Injection II
1:03:53 - Common Pitfalls
1:05:11 - O

All Comments (21)
  • @crr0ww
    HELLO, EVERYONE :P THANK YOU SO MUCH FOR STICKING AROUND AND WATCHING THE VIDEO <3 Below are some inevitable changes/fixes that I'll have to make; thank you for bearing with me FIXES: - I completely forgot that I needed to initialize both values if they're on the same line: HANDLE hProcess, hThread = NULL; (this just initializes hThread but leaves hProcess uninitialized, the more optimal way of doing this would be: HANDLE hProcess = NULL, hThread = NULL;) the code in my GitHub Repo, or blog will reflect these changes, thank you to @uri ts for bringing this to my attention. - It would've been better to declare our variables within the function scope (i.e., within main()), rather than defining them globally. The blog post will mention this as well and the code within the repo will also be updated.
  • @Beryesa.
    Imagine a "rewrite in rust, memory safety" comment on a malware dev video.
  • @stefanosbek
    I could go pay lots and lots of money to learn this stuff and still wouldn't have it been explained that well. You have a talent for teaching.
  • @rahulramteke3338
    This is content is at the level of John Hammond, Hackersploit, LiveOverflow etc Underrated
  • @dead-wi2el
    malware is cool and all but youre an amazing presenter and you NEED to keep this up! love it!
  • @gyrotta
    i thought you were not gonna make these anymore thank you for these you really know how to make everything comprehensible
  • @Timm2003
    U can literally see that these videos take lots of time, the animations are great and the stuff is soo good explained, thank u!
  • @sinatra02
    almost dropped my phone on my face seeing the notification for this video
  • At some point it's not about the info, it's about the way it's feed. Just wanna say thanks SO MUCH for the way you explain things, not only they're crystal clear but it's also fun to watch!
  • @no-one6790
    I JUST yesterday thought about learning some more about making malware and watching a video of yours, so this was a perfect timing!
  • I never thought I would learn about process injection so easily, in my mind it was a monster too complicated for me, and you just made it easy. Thank you so much for your content and I hope you do many many more of these! ❤
  • @0xf1uff
    The way you are explaining goes straight to my brain in an understandable, funny and very pleasant way. Thank you for existing!
  • @bean3330
    Phenomenal explanation! I love how thorough you are when discussing the details, I wish I had someone like you to learn from when I first started out.
  • @jordan1300
    You explain this stuff very well and your random humour keeps me interested for the entire hour. Keep it up looking forward to part three!
  • @Jenusx
    Thanks! You are on a different level. You made complicated concepts easy to understand and fun at the same time.
  • @brunom12111
    I was waiting for the next episode! Thanks, you can explain really well
  • @turb0004
    Firstly I thought you wouldn't make next video but now I'm surprised. Good job, keep going! Thanks for your content ❤
  • Crow, I know you must hear this all the time but: Your videos are amazing. You are funny and combine it with explaining things EXTREMELY well and easy to understand. Your edit is so perfect. A lot of programming "tutorials" or teachings just browse over stuff like we would take for granted, but you take time and explain it with easy language so people having difficulties learning can still follow along. As I learned to do dll injections when I used to create game hacks I feel how I took stuff for granted and had forgot about why we do certain stuff which would be very good knowledge to beginners wanting to learn. Sorry for the long comment (if you read it at all xD) but once again, Very big thank you for the videos, they are soo good and I hope they help you too as you said. Take care <3
  • @Trikstarck
    Seriously, this video and the previous are so interesting, wonderfully presented and funny throughout. I’m sure you will be my main inspiration to get started in malware development, to aid my malware analysis selfstudy. Keep it up!