why

Introduction

Processes, threads, and handles are fundamental components of the Windows operating system. Processes are instances of running programs, and they consist of one or more threads. Threads are the basic units of execution within a process, and they are responsible for carrying out the tasks of the program. Handles are used to identify and manage system resources such as files, registry keys, and network connections.

For malware developers, understanding how these components work together is crucial for creating malware that can evade detection, propagate throughout a system, and carry out its malicious activities. Malware often creates new processes, injects code into existing processes, and manipulates system handles to achieve its objectives.

what

Processes

Processes are a fundamental aspect of Windows operating system, and understanding how they work is crucial for malware development. In simple terms, a process is an instance of an executable that contains everything needed for a program to run, including the executable code, data, and memory. Each program or application can have multiple processes running at the same time.

Processes can be useful for malware developers because they provide a way to execute code on a system. A common tactic is to inject malicious code into a legitimate process, which can be difficult to detect. Malware can also create its own processes, known as child processes, which can be used to execute additional malicious code.

One advantage of using processes for malware is that each process has its own virtual address space, which it believes is exclusively allocated to it. This means that a process thinks that all the memory is for it alone. This can make it difficult for security software to detect malicious activity since the malware is hidden within a legitimate process.

Creating a process is simple:

CreateProcess()

Threads

Threads are a common feature in malware development, as they enable malware to perform multiple tasks simultaneously, making it more efficient and harder to detect. Threads are independent paths of execution within a single process, and they can run concurrently, allowing malware to perform multiple tasks simultaneously.

Malware developers use threads in various ways, depending on the type of malware they are creating and their objectives. Here are a few ways that threads are used in malware development:

Concealment: Threads can be used to hide the presence of malware from detection by security software. Malware developers can create a thread that continuously checks for the presence of antivirus software and terminates the malware process if it is detected.
Spreading: Malware can use threads to replicate itself across a network or infect other systems. These threads can run in the background while the malware performs other tasks, such as stealing data or executing commands.
Persistence: Malware can use threads to establish persistence on a system by creating a thread that runs at startup and continuously runs in the background, ensuring that the malware remains active even after a system reboot.

To create a thread You can simply use either:

CreateRemoteThread()
CreateThread()

CreateRemoteThread is for creating a thread in another process and CreateThread is for in current process

Fibers

Much like threads fibers are just a way of executing code however as threads are often highly suspicious using different techniques to run code is an important part of malware development.

Fibers are a lightweight mechanism for cooperative multitasking that allows a program to switch between different execution contexts without using system-level thread synchronization. Fibers are similar to threads, but they are user-level threads that rely on cooperative multitasking rather than preemptive multitasking.

In the context of malware development, fibers could be used as a means of obfuscation or evasion. For example, a malware developer could use fibers to split the execution of their malicious code across multiple contexts, making it more difficult to detect or trace.

To create a fiber you use together:

CreateFiber();
SwitchToFiber()

You can even turn a Fiber into a thread using:

ConvertFiberToThread()

or viceversa

ConvertThreadToFiber()

Thanks: Chris Wellons

Handles

In computing, a "handle" refers to a unique identifier that is used to represent a resource or object within a program. These resources or objects can include things like files, windows, or devices. Handles are used to manage and manipulate these resources in a program.

For a malware developer, handles might be used to gain access to system resources that are typically protected or restricted, such as accessing sensitive files or controlling system processes. Malware can use handles to interact with the operating system and other programs in order to carry out its malicious actions.

To get a handle on a Process using its process ID:

HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

Malware Creation