T1055.012: Process Injection: Process Hollowing (RunPE)
Operational Executive Summary
T1055.012 (Process Injection: Process Hollowing (RunPE)) is classified under the Defense Evasion tactic within the MITRE ATT&CK framework. Tradecraft designed to avoid detection, analysis, and eradication throughout their operational lifecycle, including process injection, file obfuscation, and disabling defensive telemetry. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 59 distinct malware families, totaling over 21,311 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Process Injection: Process Hollowing (RunPE) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Process Injection: Process Hollowing (RunPE), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1055.012 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Process Injection: Process Hollowing (RunPE) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1055/012/.
Detection Engineering & Threat Hunting
Detecting Process Injection: Process Hollowing (RunPE) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1055.012 (Process Injection: Process Hollowing (RunPE)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Process Injection: Process Hollowing (RunPE) across adjacent network segments.
Cataloged Malware Families Utilizing T1055.012 (59 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1055.012 (Process Injection: Process Hollowing (RunPE)):
59 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| cobaltstrike | Hacktool | 3,500 | Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Origin... |
| prepscram | Pua | 3,130 | SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepscram) is a prolific soft... |
| gamarue | Loader | 2,789 | Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the his... |
| kovter | Trojan | 2,414 | Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomwar... |
| nanocore | Rat | 2,400 | NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great ... |
| autoit | Packer | 1,895 | AutoIt (classified across commercial antivirus vendors as Trojan:Win32/AutoIt, Packer:Win32/AutoIt, and Backdoor.AutoIt) is a widely abused legitimate freeware ... |
| yakes | Trojan | 751 | Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-... |
| occamy | Trojan | 589 | Trojan:Win32/Occamy.C (widely cataloged across Microsoft Defender and endpoint telemetry as Trojan:Win32/Occamy or Win32/Occamy) is a high-severity, multi-stage... |
| khalesi | Infostealer | 555 | Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system con... |
| vbkryjetor | Packer | 551 | Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual... |
| memery | Trojan | 445 | Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and ... |
| skeeyah | Trojan | 440 | Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender tele... |
| wdfload | Advanced Threat | 358 | Wdfload (cataloged across security software as Trojan:Win32/Wdfload, Rootkit:Win32/Wdfload, and Trojan.Wdfload) is an advanced Windows rootkit and kernel-mode s... |
| genkryptik | Packer | 353 | GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software ... |
| dfay | Trojan | 300 | TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engine... |
| remcos | Rat | 198 | Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer ... |
| processhijack | Trojan | 187 | ProcessHijack (cataloged in threat telemetry as Trojan:Win32/ProcessHijack and Trojan:Win32/ProcessHijack.GTM!MTB) represents a family of sophisticated stealth ... |
| spygate | Rat | 127 | Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in ... |
| dllinject | Hacktool | 97 | DllInject (cataloged under vendor detection signatures including Trojan:Win32/DllInject, HackTool:Win32/DllInject, and MSIL/DllInject) represents a broad family... |
| lokibot | Infostealer | 55 | LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground de... |
| formbook | Spyware | 35 | Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime fo... |
| chthonic | Banking Trojan | 14 | Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res... |
| dimnie | Infostealer | 13 | Dimnie (first discovered in 2014 and thoroughly analyzed by security firms including Palo Alto Networks Unit 42) is an evasive modular infostealer and intellige... |
| autit | Trojan | 11 | Autit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autit, Trojan.Win32.Autit, and Win32/Autit) is a multi-stage trojan... |
| malwarecrypter | Ransomware | 10 | Trojan:Win32/Malwarecrypter is a generic, heuristic detection name used by endpoint security solutions to flag executable files that have been obfuscated using ... |
| mine | Advanced Threat | 10 | CoinMiner:Win32/Mine (also tracked under generic 'Miner' heuristics) represents a massive class of malware designed to secretly hijack the processing power (CPU... |
| moleboxvs | Trojan | 10 | HackTool:Win32/Moleboxvs (or simply **Molebox**) is a heuristic detection for executable files that have been packed, encrypted, or virtualized using the 'Moleb... |
| vbcryptent | Trojan | 7 | Trojan:Win32/Vbcryptent is a generic heuristic detection utilized by security vendors to classify a wide variety of malicious payloads (trojans, stealers, worms... |
| genericrxau | Ransomware | 6 | Trojan:Win32/Genericrxau (often seen as Trojan:Win32/Generic.rx!au) is not a specific malware family, but rather a **generic heuristic detection** utilized by M... |
| autoitscript | Trojan | 5 | Autoitscript (classified in antivirus detection telemetry under designations including Trojan:Win32/Autoitscript, Trojan.Win32.Autoitscript, and Win32/Autoitscr... |
| cardinal | Ransomware | 5 | Cardinal (classified in antivirus detection telemetry under designations including Ransom:Win32/Cardinal, Ransom.Win32.Cardinal, and Win32/Cardinal) is a crypto... |
| loki | Trojan | 5 | TrojanSpy:Win32/Loki (universally known as **LokiBot**) is one of the most prevalent, enduring, and dangerous information stealers on the cybercriminal market. ... |
| msildrop | Ransomware | 5 | TrojanDropper:Win32/Msildrop (or Generic MSIL Dropper) is a broad heuristic classification for malicious software written in C# or VB.NET and compiled into Micr... |
| cpuminer | Ransomware | 4 | Trojan:Win32/Cpuminer (often a generalized classification for multiple variants) represents a massive shift in cybercrime monetization: **Cryptojacking**. Inste... |
| injectorlib | Ransomware | 3 | HackTool:Win32/Injectorlib is not a standalone malware family, but a **Heuristic Detection** specifically targeting the *behavior* of Code Injection. It flags e... |
| unpacked | Ransomware | 3 | Trojan:Win32/Unpacked is a critical **Heuristic Detection** flagged by modern endpoint security solutions. It is not a specific malware family, but rather a beh... |
| vbcryptor | Ransomware | 3 | Ransomware:Win32/Vbcryptor is a broad detection name applied to various strains of ransomware, file encoders, and malicious crypters that are compiled using Mic... |
| cryptexe | Ransomware | 2 | Trojan:Win32/Cryptexe is a generic detection frequently applied to malware that utilizes sophisticated software packing, encryption, or obfuscation tools ('cryp... |
| cryptpack | Ransomware | 2 | Riskware:Win32/Cryptpack is a broad heuristic detection used by antivirus engines to identify files that have been obfuscated, compressed, or encrypted using kn... |
| grandcrab | Ransomware | 2 | Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Act... |
| kbot | Ransomware | 2 | Trojan:Win32/Kbot is an advanced, modular botnet agent and banking trojan that shares code similarities and operational tactics with high-tier threats like Emot... |
| launcher | Ransomware | 2 | Trojan:Win32/Launcher is a generic classification for a critical architectural component of modern malware: the initial execution stub. A 'Launcher' (or Dropper... |
| msilinj | Trojan | 2 | Trojan:MSIL/Msilinj (often denoting a Microsoft Intermediate Language Injector) is a specific detection for a loader or 'crypter' written in the .NET framework ... |
| adcrypterlib | Ransomware | 1 | Adcrypterlib (classified in antivirus detection telemetry under designations including Ransom:Win32/Adcrypterlib, Ransom.Win32.Adcrypterlib, and Win32/Adcrypter... |
| ciadoor | Trojan | 1 | <h3>Executive Summary</h3> CiaDoor is a stealthy Remote Access Trojan (RAT) and backdoor designed to provide threat actors with persistent, unauthorized adminis... |
| comine | Trojan | 1 | Coinminer:Win32/Comine (or Trojan:Win32/Comine) is a malicious cryptomining application designed to silently hijack the CPU and GPU resources of infected system... |
| delphinjector | Ransomware | 1 | Trojan:Win32/Delphinjector is a generic classification for malware or specialized droppers written in Delphi whose primary function is Process Injection (`T1055... |
| flinject | Ransomware | 1 | <h3>Executive Summary</h3> FLInject (often flagged as Trojan.Inject or Injector.FLInject) is a specific, malicious utility designed solely to perform code injec... |
| genericrxed | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxed" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxeh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxeh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| gracewire | Ransomware | 1 | <h3>Executive Summary</h3> GraceWire is a highly sophisticated, memory-resident Trojan primarily associated with the financially motivated threat group TA505 (t... |
| injeber | Trojan | 1 | HackTool:Win32/Injeber (or Trojan:Win32/Injeber) describes a specialized utility or a component of a larger malware framework whose primary, explicit purpose is... |
| msilpack | Advanced Threat | 1 | <h3>Executive Summary</h3> MSILPack (or MSIL/Packer) is a heuristic detection identifying a malicious file that has been wrapped, obfuscated, or compiled using ... |
| multiinjector | Trojan | 1 | HackTool:Win32/Multiinjector (or Trojan:Win32/Multiinjector) describes a specialized utility or a component of a larger malware framework whose primary, explici... |
| murka | Ransomware | 1 | <h3>Executive Summary</h3> Murka is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting as... |
| penzievs | Ransomware | 1 | <h3>Executive Summary</h3> Penzievs is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting... |
| proteus | Ransomware | 1 | <h3>Executive Summary</h3> Proteus represents a sophisticated, multi-purpose Botnet and Trojan framework designed to subjugate infected Windows systems. Once a ... |
| rakhni | Ransomware | 1 | <h3>Executive Summary</h3> Rakhni is a notorious and highly versatile malware family that originally emerged as Ransomware but evolved into a multifaceted threa... |