Windows API Families for Malware Analysis
Process APIs
| API | Purpose | Suspicious Use |
|---|---|---|
| CreateProcess | Start new process | Spawning cmd/powershell |
| OpenProcess | Get process handle | Targeting other processes |
| VirtualAllocEx | Allocate remote memory | Process injection |
| WriteProcessMemory | Write to remote process | Code injection |
| CreateRemoteThread | Run thread in remote process | Classic injection |
File APIs
| API | Purpose | Suspicious Use |
|---|---|---|
| CreateFile | Open/create files | Dropping payloads |
| WriteFile | Write data | Writing malicious files |
| DeleteFile | Delete files | Self-deletion |
| CopyFile | Copy files | Spreading |
| FindFirstFile | Enumerate files | Reconnaissance |
Registry APIs
| API | Purpose | Suspicious Use |
|---|---|---|
| RegOpenKeyEx | Open registry key | Reading config |
| RegSetValueEx | Set registry value | Persistence |
| RegCreateKeyEx | Create key | New persistence entry |
| RegDeleteKey | Delete key | Covering tracks |
Network APIs
| API | Purpose | Suspicious Use |
|---|---|---|
| InternetOpen | Init WinINet | HTTP C2 |
| URLDownloadToFile | Download file | Payload delivery |
| WSAStartup | Init Winsock | Raw socket C2 |
| connect/send/recv | Socket operations | Custom protocols |
Evasion APIs
| API | Purpose | Suspicious Use |
|---|---|---|
| IsDebuggerPresent | Check debugger | Anti-analysis |
| VirtualProtect | Change memory perms | Unpacking |
| GetTickCount | Timing check | Anti-sandbox |
| Sleep | Delay execution | Sandbox evasion |