Skip to content

Latest commit

 

History

History
80 lines (67 loc) · 3.31 KB

create-thread.md

File metadata and controls

80 lines (67 loc) · 3.31 KB
ID C0038
Objective(s) Process
Related ATT&CK Techniques None
Version 2.3
Created 14 August 2020
Last Modified 30 April 2024

Create Thread

Malware creates a thread.

Use in Malware

Name Date Method Description
Dark Comet 2008 -- Dark Comet creates a thread. [1]
GoBotKR 2019 -- GoBotKR creates a thread. [1]
Hupigon 2013 -- Hupigon creates a thread. [1]
Locky Bart 2017 -- Locky Bart creates a thread. [1]
Rombertik 2015 -- Rombertik creates a thread. [1]
Shamoon 2012 -- Shamoon creates a thread. [1]

Detection

Tool: capa Mapping APIs
create thread Create Thread (C0038) kernel32.CreateThread, _beginthread, _beginthreadex, PsCreateSystemThread, SHCreateThread, SHCreateThreadWithHandle, kernel32.CreateRemoteThread, kernel32.CreateRemoteThreadEx, RtlCreateUserThread, ntdll.NtCreateThread, ntdll.NtCreateThreadEx, ntdll.ZwCreateThread, ntdll.ZwCreateThreadEx, pthread_create, System.Threading.Thread::Start, System.Threading.Thread::ctor
spawn thread to RWX shellcode Create Thread (C0038) --
Tool: CAPE Class Mapping APIs
injection_create_remote_thread CAPE_InjectionCreateRemoteThread Create Thread (C0038) --
antidebug_ntcreatethreadex antidebug_ntcreatethreadex Create Thread (C0038) NtCreateThreadEx
antidebug_ntsetinformationthread antidebug_ntsetinformationthread Create Thread (C0038) NtSetInformationThread

C0038 Snippet

Process::Create Thread SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db Location: 0x404915 
mov     param_2, dword ptr [ebp + param_4]
push    param_2 ; Pointer to location where thread handler will be returned
mov     param_2, dword ptr [ebp + param_5]
push    param_2 ; Flags controlling thread creation
push    param_1 ; Pointer to variable to be passed to thread
mov     param_1, FUN_004048b8
push    param_1 ; Pointer to function where thread will begin execution
push    esi     ; Size of stack for new thread
push    ebx     ; Pointer to security attributes for thread.  If null, the handle to the thread cannot be inherited
call    KERNEL32.DLL::CreateThread ; Call to thread creation API

References

[1] capa v4.0, analyzed at MITRE on 10/12/2022