As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' would decrypt the DLL and inject the payload into a victims valid process using
CreateRemoteThread and all that yadda. But how do malware authors get to avoid heuristic detection AFTER the payload has been decrypted? I mean, I don't think most (if any) malware authors are actually loading their DLL's directly from memory just after decrypting the payload. Rather they decrypt it and use the DLL decrypted path in
LoadLibrary. But how come that they are successful in bypassing AV this way, since most AV's use hook functions into all these Windows API functions (
LoadLibrary I'd guess is heavily monitored), and so even if the malware escaped static AND dynamic analysis in the first glance since the AV won't be able to sandbox the encrypted the DLL through the hijacked one (there are hundreds of simple techniques to avoid AV sandboxing to access the decryption phase, and if it doesn't reach the decryption phase, the sandbox simulation does not raise any alarms) how does it escape it when its time to actually inject the payload into a process?
Won't the AV grab the DLL path that Windows is being requested to load through
LoadLibrary and re-scan it? And this time the payload will be a completely malicious and decrypted DLL, easily recognized by static signature and/or heuristic analysis thus raising the AV alarm? How come any malware ever passed any AV with this method? What conceptual part am I missing?