Loading story…
Windows malware and offensive tradecraft increasingly rely on direct system calls, NTDLL unhooking, and related userland-hook bypass methods to evade antivirus and EDR monitoring during code injection and process manipulation. Public research describes replacing high-level WinAPI calls with Nt* syscalls such as NtAllocateVirtualMemory, NtWriteVirtualMemory, and NtCreateSection, often through custom assembly stubs or frameworks like SysWhispers, to avoid hooks placed in ntdll.dll. Other documented techniques include restoring clean .text sections of loaded DLLs from disk, dynamically invoking APIs without standard imports, and abusing TLS-based reentrancy checks in inline hooks so security products skip behavioral inspection.
These methods are reflected in real malware analyses. WikiLoader was observed using indirect syscalls via ntdll.dll to change memory protections, inject code into bingmaps.dll, and later inject shellcode into explorer.exe with ZwOpenProcess, ZwAllocateVirtualMemory, and ZwWriteVirtualMemory. An XWorm loader used direct Nt* syscalls for section-based payload injection into legitimate processes while checking for JMP opcodes on Nt functions as an anti-hooking measure. A separate APT29-linked Dropbox loader resolved direct syscalls through hashed lookups and restored DLL code sections from disk to remove user-mode hooks before maintaining persistence and exchanging encrypted payloads through Dropbox-based command and control.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
An analysis of XWorm-delivering shellcode found it decrypted an intermediate payload from a temporary file and injected the final payload into newly created legitimate Windows processes using NtCreateSection, NtMapViewOfSection, NtWriteVirtualMemory, and NtResumeThread, while checking Nt functions for hooks.
A malware analysis reported that WikiLoader second-stage shellcode loaded bingmaps.dll, used indirect syscalls via ntdll.dll to patch GetBingsMapFactory, performed anti-debug checks, and injected a third shellcode into explorer.exe with ZwOpenProcess, ZwAllocateVirtualMemory, and ZwWriteVirtualMemory.
A follow-up tutorial showed how to replace the ntdll-exported NtAllocateVirtualMemory call with a custom assembly syscall stub in a DLL injection example to bypass userland hooks, and referenced SysWhispers as an alternative generator.
A tutorial introduced Windows syscalls and demonstrated replacing higher-level allocation APIs with NtAllocateVirtualMemory in a DLL injection workflow, while noting syscall IDs vary by Windows version and stub addresses should be resolved dynamically.
The SysWhispers2 project was published as an updated tool for generating direct Windows syscall stubs to evade user-mode API hooks used by security products. Its documentation highlights syscall-address sorting instead of static syscall tables, randomized function name hashes, and optional random syscall jumps via clean ntdll syscall instructions.
A malware analysis of AcroSup64.dll described a Dropbox-based loader that resolves syscalls using a SysWhispers2-like method, hijacks thread execution, restores in-memory .text sections from disk to remove hooks, and establishes Run-key persistence.
Deep Instinct published analysis of an evasion method that nulls TLS slots and TlsExpansionSlots to make a hooked NtWriteVirtualMemory path appear reentrant, causing the hook to skip behavioral checks.
The SysWhispers GitHub project was published as a tool that generates header and assembly files for invoking direct Windows system calls, aiming to bypass user-mode API hooks used by security products. Its documentation included DLL injection examples replacing Win32 APIs with Nt* syscalls and described cross-version support through PEB-based version handling.
An overview article summarized multiple Windows EDR bypass approaches, including patching hooks, restoring clean NTDLL .text sections, using direct syscalls via Dumpert and SysWhispers, and dynamic API invocation with D/Invoke.
MDSec published research on bypassing user-mode hooks and directly invoking Windows system calls for red-team operations. The article focused on techniques for evading userland API monitoring by security products through direct syscall usage.
Outflank published research on combining direct system calls with sRDI to bypass AV/EDR, an early public reference point later cited in discussions of userland-hook bypass techniques.
The EDR bypass overview cites public 2019 research by SpecialHoang and MDSec on bypassing EDR memory protection by patching hooked NTDLL functions, including proof-of-concept work against CylancePROTECT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sources3cur3th1ssh1t.github.io
Open sourcemdsec.co.uk
Open sourceoutflank.nl
Open sourceundocumented.ntinternals.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Security research and malware-development writeups detailed a Windows evasion technique that avoids standard loader APIs such as **`GetProcAddress`** and **`GetModuleHandle`** by manually walking the **Process Environment Block (PEB)** and parsing DLL export tables. The approach resolves modules like **`kernel32.dll`** and **`user32.dll`** at runtime, including from encrypted strings, to reduce obvious API references in binaries and make static or behavioral detection more difficult. Microsoft’s documentation for **`GetProcAddress`** provides the baseline behavior that these custom implementations are designed to replace. One proof of concept showed a custom `GetProcAddress` implementation that located **`MessageBoxA`** dynamically on Windows 10 x64, while another demonstrated finding **`kernel32.dll`** in assembly-style code and resolving exports by hash before allocating memory and launching a benign payload with **`CreateThread`**. The authors framed the method as malware and red-team tradecraft, linked it to **MITRE ATT&CK `T1027`**, and noted similarities to techniques seen in **Conti ransomware** source code, underscoring how manual API resolution can help malicious code lower its detection footprint.
Aug 15, 2026