T1055 Process Injection in real malware
ATT&CK technique T1055 Process Injection appears in 502 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.5% of the analyzed corpus. Seven-day prevalence is falling (166 recent vs 168 prior). Most associated families: Azov, HUILoader, Delf, Viking, Emotet.
Tactics: stealth, privilege-escalation
Prevalence in the corpus
- Samples exhibiting T1055: 502
- Share of analyzed corpus: 0.5%
- Last 7 days: 166 · prior 7 days: 168 (falling)
Malware families using T1055
Example samples
- caa09636ef5be5c198f4d25c35d5613923fcee8a1561c09189d55ee39b7dd50c - malicious
- f428d4b689ac95dcd2872c008340cbb3487acfe4f010e072279fb8a7e82cb9ea - malicious
- c95de5c07ba2511287531a216da0e01ae0a40d8ace97b565277d16d7c0bf87d6 - malicious
- e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88 - malicious
- ee6ed06897896ab87a9a84035fd7e7f2ff889afc7794017428fe1805dc09b8ea - malicious
- aa6f888e01eec9da826d56420789ad44db1e5ef4d2f82bb85c8f814d8cc41bd8 - malicious
- f8a1066950ff88da91de8ee95aac7d33293cbbad6f4445e534e7721eb38391c2 - malicious
- 25429c8146dd1bf0f808ac3f6816a2f88ccbd95f0907ae952b548e27ed0cc8e4 - malicious
- 9be89e1694b400922eecb56f35875636b99222f2a58cb3549809a21bc972233d - malicious
- a76c1abd038973ddec464bc5c94af0bd6b7a9568c09193216eaad2c21e8d9c5a - malicious
- 70731f43818f4fb17dcf9802a344f6a44565999763aaa9e2dde2020752b2e654 - malicious
- 323fe1ce9916cc899e8431cb9ed0b08467ee355bf373b70183bfb2e203314453 - malicious
- 7de8f68891d0aba0cc155c4e1643ba05f40efa004c2006b72aa2444e4d3c7088 - malicious
- 3aa31049337404bd038772db2a6dbf0d868ff000de3754407a37fb0762458e15 - malicious
- 1fe8b9165ffbd8955e81ba2585a8229da199a13cc7397fd41d7f86abdc3d4c31 - malicious
- a106446fa5f832bf0e1c40dd3a22ac15eb33df1cc0080992fade82f81cae6956 - malicious
- e3eb01c5af15751843eb4ab05bf2109aa10fd90889f1f3e3509e5529924d9f8d - malicious
- 78b61feb5c60671cd74d367becc6c6714af64cbf8dacd3912845865d80f4a143 - malicious
- e1a1ee6050491a32a76b987d9af16f02d27d493611bdf971cf009f0796443b7e - malicious
- 39bf9153e37936fe3eb634050e6316a9e04906a9770ad072498945172185eda7 - malicious
- 4fd72cf5f3f6cc66c5ab3ae2245aaccdeeb73695725a47aa0c3ef8a474148576 - malicious
- fa0f672eb3cddaf594b9c3d0d2445a7f7ce6d3d1ac6270b17a8dc5555e6c8e5f - malicious
- 947ad49292382fea9ce24a7468fab72fb9e23826ab417b317d5b9e672aa9137e - malicious
- 7d251e89525322c0dc1fc2c8217a649e4d17dddeeb9daec90a1c1a7140b285f9 - malicious
- d5d14876befa9960fb7ebb7e6cd4c9643ae88ffdfd124b272ae28d98fde46674 - malicious
Canonical technique definition: MITRE ATT&CK T1055 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1055
- How common is ATT&CK T1055 (Process Injection) in real malware?
- ATT&CK technique T1055 Process Injection appears in 502 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.5% of the analyzed corpus. Seven-day prevalence is falling (166 recent vs 168 prior). Most associated families: Azov, HUILoader, Delf, Viking, Emotet.
- Is T1055 becoming more common?
- Prevalence is falling: 166 samples in the last seven days against 168 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1055?
- In this corpus T1055 is most associated with Azov (49), HUILoader (42), Delf (35), Viking (34), Emotet (24). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1055?
- 0.5% of the publicly analyzed corpus (502 of 100981 samples) exhibits T1055. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats