DRAKVUF : Process Injector Enhancement

<p><strong>DRAKVUF</strong> allows to inject a binary directly into a running virtual machine. The current implementation uses either <code>CreateProcessA()</code> or <code>ShellExecuteA()</code> from the Windows API, which implies to have the program we want to execute into the guest’s filesystem. Furthermore, once the function is called, the process will have the name of that file. It can further lead a malware to detect the presence of <strong>DRAKVUF</strong> if we run known analysis tools.</p> <p>To solve this issue we can use a more advanced technique to inject our binary. Among all the possibilities, the <strong>Process Doppelgänging</strong> technique seems the most suitable. It allows to inject the binary directly into the memory, without modification on the filesystem, by using <strong>NTFS transaction</strong>.</p>