MITRE ATT&CK T1055.012 Process Injection: Process Hollowing

Process Hollowing is a process injection technique that adversaries generally use to bypass process-based defenses by injecting malicious code into a suspended or hollowed process. This technique involves creating a process in a suspended state, then unmapping or hollowing out its memory and replacing it with malicious code. This allows the attacker to execute their code within the context of the target process.

In this blog post, we explain the T1055.012 Process Hollowing technique of the MITRE ATT&CK® framework and explore how adversaries employ process hollowing with real-world attack examples in detail.

The Red Report 2025 The 10 Most Prevalent MITRE ATT&CK Techniques Used by Adversaries GET THE REPORT

Adversary Use of Process Hollowing

Process hollowing is a technique used by malware to hide its code execution within the memory of a legitimate process. The malware begins by creating a new, suspended process of a legitimate, trusted system process. It then hollows out the contents of the legitimate process's memory, replacing it with the malicious code, and resumes the execution of the process. This can make it more difficult for security software to detect the presence of the malware, as it is running within the context of a trusted process. The legitimate process's original code is usually unmapped from memory, so it is no longer visible to the operating system.

An example Process Hollowing attack is given below.

1. Create a suspended process: This initial step is about creating a suspended process, which adversaries will later use to hollow. To create a new process, the malware uses the CreateProcess function. As discussed before, this attack includes hollowing the memory of a suspended process. Thus, malware suspends this newly created process' primary thread via the CREATE_SUSPEND option used in the fdwCreate flag.

2. Hollow out the legitimate code: Malware hollows out the legitimate code from the memory of the suspended process. This is done by using particular API calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection. The malware calls the ZwUnmapViewOfSection function to remove a previously mapped view of a section from the virtual address space of the target process.  One important thing to add is that the ZwUnmapViewOfSection function is called from kernel mode, meaning that it is not intended to be called directly from user mode. To unmap a view of a section from the virtual address space of the target process from user mode, adversaries should use the NtUnmapViewOfSection function instead. 

3. Allocate memory in the target process: Malware allocates memory in the target process via the VirtualAllocEx function. One critical thing to note is that malware uses the flProtect parameter to ensure that the code is marked as writeable and executable.

4. Write shellcode to the allocated memory: The adversary uses the WriteProcessMemory function to write the malicious code (also known as shellcode) to the allocated memory within the hollowed process.

5. Change the memory protection: The malware calls the VirtualProtectEx function to change the memory protection of the code and data sections in the target process to make it appear normal, meaning that the memory in these sections will be marked as readable and in the case of "Read/Execute", executable.

6. Retrieve the target thread's context: The target thread's context is retrieved using the GetThreadContext.

7. Update the target thread's instruction pointer: Malware updates the target thread's instruction pointer to point to the written shellcode that the malware has written in the fourth step. Following this, malware commits the hijacked thread's new context with SetThreadContext.

8. Resume the suspended process: The malware uses the ResumeThread to make the suspended process resume so that it can run the shellcode within. 

In April 2024, REMCOS RAT was reported to use process hollowing to copy itself into iexplore.exe [1]. Using the CreateProcessW API, the malware starts the target process in the suspended state and gets its thread context via the GetThreadContext API. Then, the malware uses ZwCreateSection and ZwMapViewOfSection APIs to create and map shared memory into the target process, along with the handle of the remote process. Finally, the malware sets the thread context with a new entry point pointing to the REMCOS entry point and resumes the process execution, successfully completing the process injection via process hollowing. 

References

[1] C. François and S. Bousseaden, "Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part One — Elastic Security Labs." Available: https://www.elastic.co/security-labs/dissecting-remcos-rat-part-one