Malware Development for Ethical Hackers & Pentesters

What is Malware?

Malware (short for malicious software) is any software designed to harm, exploit, or compromise computers, networks, or data. Attackers use malware for various purposes, such as stealing information, disrupting systems, or gaining unauthorized access.

Types of Malware

1. Virus – Attaches itself to files and spreads when executed, often damaging or modifying data.

2. Worm – Spreads automatically across networks without needing a host file or user action.

3. Trojan Horse – Disguises itself as a legitimate program but contains malicious code.

4. Ransomware – Encrypts a victim’s files and demands a ransom for decryption.

5. Spyware – Secretly monitors user activities and collects sensitive data.

6. Adware – Displays unwanted ads and may track user behavior.

7. Rootkit – Hides deep in the system to allow attackers to maintain control.

8. Keylogger – Records keystrokes to steal passwords and other sensitive information.

9. Botnet – A network of infected computers controlled remotely to perform large-scale attacks.

10. Fileless Malware – Operates in memory without leaving traces on disk, making detection difficult.

Each type of malware has different attack vectors and impact, often used in cybercrime, espionage, or cyber warfare.

Learn about the PE (Portable Executable) file structure, the fundamental format for Windows executables and DLLs. Explore its key components, including headers, sections, and metadata, essential for malware development,reverse engineering, malware analysis, and Windows development.

Discover the MS-DOS Header in PE files, the first structure in Windows executables. Learn about its fields, including the magic number (MZ), used to identify DOS executables and provide a stub for legacy compatibility in modern Windows programs

Explore the DOS Stub in PE files, a small legacy program that runs in DOS, displaying a message like 'This program cannot be run in DOS mode.' Understand its role in compatibility and how it bridges old DOS systems with modern Windows executables.

Learn the fundamentals of NT Headers in Windows PE files! Understand their structure, key fields, and role in executable loading. Essential for malware development, reverse engineering, malware analysis, and security research.

Explore the PE Header subsections: Signature, File Headers, and Optional Header. Understand their structure, purpose, and role in Windows executables. Essential for reverse engineering and malware analysis!

Learn how section headers in PE ( Portable Executable ) files define executable sections using the IMAGE_SECTION_HEADER structure from winnt.h. This course covers .text, .data, .rdata, .reloc, and more, essential for malware development, malware analysis, reverse engineering, and binary exploitation.

Explore how different sections in PE files store code, data, and metadata using the IMAGE_SECTION_HEADER structure from winnt.h. Learn about .text, .data, .rdata, .bss, and .reloc for malware analysis, reverse engineering, and exploit development. Essential for ethical hackers and security researchers.

A process is an instance of a running program in Windows. It consists of memory, system resources, and at least one thread responsible for executing instructions. Each process runs in its own virtual address space, ensuring isolation from other processes.

Some Key Components of a Process:

• Threads: The actual execution units within the process.

• Handles: References to system resources like files, registry keys, and synchronization objects.

• Security Token: Defines the user privileges and permissions for the process.

Example:

• Opening Notepad.exe creates a Notepad process, with threads handling UI updates and user input.

• In Task Manager or Process Hacker, you can inspect processes and their resource usage.

In Windows, a security token is a kernel-managed data structure that represents the security identity and privileges of a process or thread. It answers a single, critical question for the OS:

“Who is this code running as, and what is it allowed to do?”

A security token is an access card issued by Windows when a user logs in.

Every process runs with a copy of that card, and Windows checks it every time the process tries to access a resource.

A handle in Windows is an abstract reference to a system resource, such as a file, registry key, process, thread, or synchronization object. Instead of directly accessing these resources, applications use handles, which act as unique identifiers managed by the operating system.

Handles are essential for resource management in Windows, allowing processes to interact with system objects securely and efficiently. Each handle has associated permissions that define what actions can be performed on the resource.

Example:

• When you open a file in a program, Windows assigns a file handle to track that file.

• If you create a new thread, Windows provides a thread handle for managing it.

• Using tools like Process Hacker you can inspect active handles within a running process

What is a Handle in Windows?

A handle in Windows is nothing but an integer value (a reference) used by the operating system to identify and access system resources.

What kind of resources?

• Files

• Registry keys

• Processes

• Threads

• Windows (GUI)

• Sockets

• Device Drivers

Using windows handle we can find out handle of a running program in windows. We will see how we can do this in this video practically.

CreateProcess() – Understanding the Most Important Windows API for Malware Developers & Ethical Hackers

The CreateProcess() WinAPI function is one of the most critical and powerful functions in Windows programming, especially in the fields of malware development, ethical hacking, and Windows internals analysis. For ethical hackers and malware developers, understanding CreateProcess() is essential because it forms the foundation of how programs, payloads, and malicious implants spawn new processes, execute secondary components, and interact with the Windows operating system at a low level.

CreateProcess() is responsible for creating a new process along with its primary thread. It allows complete control over how the child process behaves before, during, and after execution. This capability makes it a preferred method for malware authors, penetration testers, and red-team operators to perform actions like process injection, process hollowing, parent PID spoofing, privilege escalation workflows, stealthy payload execution, and more. Ethical hackers learning malware development must thoroughly understand the parameters and behavior of CreateProcess() to analyze malicious binaries, build ethical payloads, and detect suspicious activity in Windows environments.

The function exposes a detailed set of parameters like LPSTARTUPINFO, LPPROCESS_INFORMATION, command-line arguments, environment blocks, security attributes, creation flags, and handle inheritance options. These allow fine-grained manipulation of how a process launches—whether it starts suspended, hidden, under a spoofed parent, with custom memory permissions, or redirected I/O handles. These capabilities are heavily used in advanced exploitation and malware techniques such as process hollowing, reflective injection, remote thread creation, token impersonation workflows, and post-exploitation automation.

In malware analysis, understanding CreateProcess() helps analysts identify how threats propagate, execute additional tools, or evade detection by abusing legitimate system processes like svchost.exe, cmd.exe, or rundll32.exe. Ethical hackers learning malware development also use CreateProcess() to craft controlled demonstrations of Windows process behavior, stealthy process execution chains, and realistic red-team simulations.

By mastering the CreateProcess() function, students will gain a solid foundation in Windows API programming, improve their understanding of Windows process architecture, and acquire essential skills for both ethical malware development and professional malware analysis. Whether you are building custom loaders, analyzing malicious executable behavior, or teaching Windows internals, CreateProcess() is a must-know function for any ethical hacker working on Windows-based security research or malware development.

Setting a custom environment block in CreateProcess() is an essential skill for ethical hackers, malware developers, and Windows security researchers who want fine-grained control over how a child process behaves. In Windows malware development, customizing the environment allows you to manipulate variables such as paths, credentials, execution modes, API keys, and sandbox-evasion flags before the new process starts. The lpEnvironment parameter of CreateProcess() lets you supply a fully custom block of environment variables instead of inheriting the parent’s environment. This block must contain a sequence of null-terminated strings, formatted as NAME=VALUE, and must end with a double null terminator. When using CreateProcessW, the environment block must be built using wide strings, along with the CREATE_UNICODE_ENVIRONMENT flag.

For malware analysts and ethical hackers, understanding this mechanism is important because many advanced malware families modify environment variables to evade detection, alter process behavior, or configure payload stages. Red-team operators also use custom environment blocks to run tools with modified PATH values, spoofed runtime settings, or controlled execution environments. Mastering custom environment manipulation in CreateProcess() strengthens your understanding of Windows internals, process creation, and stealthy malware execution techniques, making it a key concept in professional malware development and ethical hacking workflows.

The CreateThread() WinAPI function is a fundamental building block in Windows malware development, ethical hacking, and low-level process manipulation. It allows developers to create new threads inside a process, enabling concurrent execution of code, background tasks, and payload delivery mechanisms. For ethical hackers learning malware development, understanding CreateThread() is crucial because many malicious techniques—such as shellcode execution, keylogging, in-memory payload staging, and process injection—rely on spawning custom threads to run attacker-controlled code.

CreateThread() gives you the ability to specify the thread’s starting address, stack size, security attributes, and optional parameters to pass data directly into the new thread. This flexibility makes it a powerful API for executing shellcode in memory without touching the disk, running background monitoring routines, or implementing multi-stage payloads. Many malware families use CreateThread() to execute encrypted shellcode after decrypting it in memory, maintain persistence, or coordinate communication with command-and-control servers.

For malware analysts, recognizing how CreateThread() is abused helps identify suspicious thread creation patterns, stack manipulation, and injected code regions inside processes. Ethical hackers benefit by learning how to safely use this function to build controlled proof-of-concept malware and understand thread-level execution within the Windows architecture. Mastering CreateThread() strengthens your knowledge of Windows internals, multithreading, and stealthy malware execution, making it an essential concept in professional malware development.

Important Note: Please put both virtual machines ( kali & windows ) on host only adapter in network settings before doing this practical and for all upcoming practicals to work.

DLL Hijacking is one of the most important persistence and privilege-escalation techniques in Windows malware development and ethical hacking. It exploits how Windows searches for and loads Dynamic Link Libraries, allowing an attacker to trick a vulnerable application into loading a malicious DLL instead of the legitimate one. Understanding DLL Hijacking is essential for malware developers, penetration testers, and red-team operators because it enables stealthy code execution without modifying the target application or dropping suspicious executables.

The technique works by abusing the DLL search order, where Windows checks specific directories such as the application folder, system directories, and PATH locations. If a required DLL is missing or improperly validated, attackers can place a malicious DLL with the same name in a directory the application checks first. When the program runs, the malicious DLL loads automatically, giving ethical hackers full control to execute payloads, persistence mechanisms, or post-exploitation code under the context of the vulnerable application.

For malware analysts, DLL Hijacking knowledge is vital for identifying abnormal loading behavior and suspicious module paths. In ethical malware development, this technique teaches students how Windows resolves dependencies, how persistence is achieved, and how attackers leverage trusted processes for stealth. Mastering DLL Hijacking deepens understanding of Windows internals, process loading, and practical malware techniques.

APC (Asynchronous Procedure Call) Code Injection is an advanced Windows malware development technique that allows attackers and ethical hackers to execute malicious code inside the context of another process thread. Unlike traditional process injection methods such as CreateRemoteThread or process hollowing, APC injection targets a thread’s APC queue, enabling code execution when the thread enters an alertable state. This makes APC injection extremely stealthy and powerful for ethical hacking, red-team operations, and malware analysis training.

In APC-based malware development, the attacker allocates memory inside the target process, writes shellcode, and uses functions like QueueUserAPC() or NtQueueApcThread() to queue the malicious payload. When the victim thread calls functions like SleepEx(), WaitForSingleObjectEx(), or performs I/O operations, Windows automatically executes the queued APC, running the attacker’s code without creating a new thread. This stealth makes detection harder for security tools and is commonly used by advanced malware families.

For ethical hackers and malware developers, understanding APC code injection provides deep insights into Windows internals, thread scheduling, and low-level execution flow. For malware analysts, it helps in recognizing abnormal APC patterns, suspicious memory writes, and injected shellcode inside legitimate processes. Mastering APC injection strengthens skills in stealthy payload execution, post-exploitation, and modern Windows malware techniques.

When malware is first executed:

• It may run once and disappear when the system restarts.

• Without persistence, the attacker loses access.

Persistence ensures:
The malware auto-runs again after reboot, login, or scheduled time.
The attacker retains control of the target system.