What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Question

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious.

If so, what will be some of the false positives? will a normal user who just wants to install normal apps and browse the web be effected?

I just don't understand why would an benign app need to do this? And how common is it? For example, if it is only 1 in a billion benign app that does this, then why allow it at all?

Answer 1

Well the problem with this approach is that the injection happens using the WinAPI which is also used by native windows applications. A very common chain that has been out there in the wild for a while now is the following one:

OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread

and variants. If you notice all of the above functions are part of the WinAPI. Now let's study what exactly each of these functions do. From the MSDN docs:

OpenProcess: Opens an existing local process object. The access to the process object. This access right is checked against the security descriptor for the process.

So this is a simple function that justs allows an application to get a handle and interact with another process if it has the appropriate rights. This is very common to happen on windows for various applications.

VirtualAllocEx: Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero.

So again this function can be used to allocate some memory space which is useful if e.g. someone wants to make a custom memory manager for an application. Even malloc which is used a lot in C/C++ programming in its core uses VirtualAllocEx and variants.

WriteProcessMemory: Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.

Well, what is the point of allocating space if you can't write to it (if you have the appropriate privileges/rights of course).

CreateRemoteThread: Creates a thread that runs in the virtual address space of another process.

Creating threads is useful for many reasons. In this case - it is just a way we can execute the process we already have a handle for, using OpenProcess from above.

In addition a variant of the above routine is also used for DLL injection/hooking which is used e.g. by software debuggers.

So as you can see this technique is often used to inject malicious code but it is also used by built-in applications. For this reason there are other techniques (e.g. code signature etc...) to prevent malware infection/injection. The bad news is that unfortunately there are also ways to bypass some of these techniques.