> Technique · Process Hollowing Targeting svchost.exe / RegSvcs.exe_

~/packetpursuit $ cat /intel/techniques/process-hollowing-svchost-regsvcs.md

typetechniquefamilyprocess-hollowing-svchost-regsvcsconfidencehighcreated2026-07-17updated2026-07-17process-injectionprocess-hollowingsvchostregsvcsreflective-loadingshellcode

Process Hollowing Targeting svchost.exe / RegSvcs.exe

Overview

A manual PE loader / process hollowing technique embedded in x86 shellcode dropped by the unclassified-autoit-compiled AutoItSC cluster. The shellcode decrypts an inner payload (typically a .NET assembly), creates a suspended legitimate process, hollows it, and reflectively loads the decrypted PE into the target's address space.

Targets

  • Primary: C:\Windows\System32\svchost.exe — a trusted, frequently-running system process that blends in with normal activity.
  • Fallback: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe or v2.0.50727\RegSvcs.exe — .NET Framework utility processes with legitimate CLR context, useful for hosting .NET payloads.

Mechanism

  1. Path construction: Target process paths are built on the stack character-by-character (stack-string obfuscation), then passed to CreateProcessA in suspended state.
  2. PE parsing: The shellcode walks the decrypted payload's DOS header (e_lfanew at offset 0x3c), NT headers (Signature PE\0\0), File Header (Machine, NumberOfSections, etc.), and Optional Header (ImageBase, AddressOfEntryPoint, SizeOfImage, Subsystem).
  3. Section mapping: Each section header (Name, VirtualAddress, SizeOfRawData, PointerToRawData) is mapped into the target process's memory with NtUnmapViewOfSection / VirtualAllocEx / WriteProcessMemory.
  4. IAT resolution: The shellcode resolves imports by walking the Import Directory, loading DLLs via LoadLibraryA, and patching thunk tables via GetProcAddress.
  5. Relocation processing: If the payload cannot load at its preferred ImageBase, the shellcode fixes base relocations by walking the .reloc directory.
  6. Thread resumption: The shellcode updates the suspended thread's context (EAX / Rcx = entry point) and calls ResumeThread.

Cluster Context

This exact technique has been observed across at least three confirmed siblings:

  • 127c404a — parachronistic payload, 15-byte XOR key K1DOQHHP0ZQDOL4, inner payload AgentTesla .NET assembly.
  • 763ae850 — ambiparous payload, 22-byte XOR key, inner payload stripped PE32.
  • 6718622d — emboweling payload, 19-byte XOR key, inner payload AgentTesla.

All use the same DllCallAddress entry point at offset 0x23b0 after RWX allocation via VirtualAlloc.

Detection

  • Suspended svchost.exe or RegAsm.exe spawned from %TEMP% or unusual parent processes.
  • Memory sections in svchost.exe with RWX permissions and .NET metadata not matching the on-disk image.
  • Unmapped original image followed by new allocation at same or different base.

Related