Description

The Process Enumeration feature in malware provides attackers with a detailed inventory of all running processes on a compromised system. This is the digital equivalent of a burglar quietly taking stock of valuables in a home. By cataloging active processes, the malware gains insights into the software environment, including potential vulnerabilities and operational characteristics of the target system. This information can be invaluable for escalating privileges, inserting additional payloads, or avoiding detection by identifying security software that may be running. Process Enumeration thereby serves as a crucial intelligence-gathering step, arming attackers with the necessary data to tailor their subsequent actions for maximum impact and minimum detection.

Existing Techniques

Name	Associated Feature(s)	Has Snippet	Matching Sample
Loaded Modules Enumeration	Process Manager		0
Process Dump	Process Manager, Password Recovery		0
Process Information Gathering	Process Manager		0
Running Process Enumeration	Process Manager		0

Associated with Releases

Version	Origins	Authors	Languages	Release Date
Beast 2.00	Romania 🇷🇴	Tataye	Delphi	May, 2003
Beast 2.01	Romania 🇷🇴	Tataye	Delphi	Jun, 2003
LanFiltrator 1.1 Fix 1	Australia 🇦🇺	Read101	Delphi	Aug, 2003
A-311 Death 1.03	Russia 🇷🇺	Corpse	Assembly, MASM	Aug, 2003
Optix Pro 1.32	Unknown 🏴‍☠️	s13az3 , xMs	Delphi	Sep, 2003
CIA 1.2	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Sep, 2003
Beast 2.05	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
Beast 2.02	Romania 🇷🇴	Tataye	Delphi	Sep, 2003
Sinique 1.0	Unknown 🏴‍☠️	xtremeNTL	Delphi	Oct, 2003
Fearless Lite 1.01	Australia 🇦🇺, France 🇫🇷	Read101 , Triforce	Delphi	Nov, 2003
ProRat 1.1	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Jan, 2004
Hue 1.0	Unknown 🏴‍☠️	B33T	Visual Basic 6 (VB6)	Jan, 2004
ProRat 1.2	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Jan, 2004
ProRat 1.3	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Feb, 2004
Nuclear RAT 1.0 Beta 5	Brazil 🇧🇷	caesar2k	Delphi	Feb, 2004
Beast 2.06	Romania 🇷🇴	Tataye	Delphi	Feb, 2004
ProRat 1.4	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Feb, 2004
LanFiltrator 1.5 Beta III	Australia 🇦🇺	Read101	Delphi	Feb, 2004
ProRat 1.6	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2004
ProRat 1.8	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2004
Infector NG 2004 2.1.0	Belgium 🇧🇪, United Kingdom 🇬🇧	fc , Infiltration	Delphi	May, 2004
Optix Pro 1.33	Unknown 🏴‍☠️	s13az3	Delphi	Aug, 2004
Flux 1.0	Sweden 🇸🇪	Gargamel	C++	Aug, 2004
Beast 2.07	Romania 🇷🇴	Tataye	Delphi	Aug, 2004
Erazer 1.0	Austria 🇦🇹	(v)aster	Delphi	Aug, 2004
Erazer 1.1	Austria 🇦🇹	(v)aster	Delphi	Sep, 2004
Institution 2004 0.4.0	United States 🇺🇸	Aphex	Delphi	Oct, 2004
CIA 1.3	England 🏴󠁧󠁢󠁥󠁮󠁧󠁿	Alchemist	Visual Basic 6 (VB6)	Dec, 2004
Seed 1.1	Brazil 🇧🇷	caesar2k	Delphi, C++	Feb, 2005
ProRat 1.9	Turkey 🇹🇷	HighLander , ATmaCA	Borland C++	Mar, 2005
Y3K rat 2k5 RC 1.0	Austria 🇦🇹	SHA	Delphi	Jun, 2005
Erazer Lite 0.4	Austria 🇦🇹	(v)aster	Delphi	Aug, 2005
CyberNetic 1.62 (PE)	Unknown 🏴‍☠️, Spain 🇪🇸	Cybernetic crew , mHKm , shukisnike	Delphi	Aug, 2005
Y3K rat 2k5 RC 1.1	Austria 🇦🇹	SHA	Delphi	Nov, 2005
TrojNa$ 1.0	Unknown 🏴‍☠️, Australia 🇦🇺	flippmode , Satan_Addict , Read101	Delphi	Jan, 2006
Bersek 1.1	Brazil 🇧🇷	XpyXt	Visual Basic 6 (VB6)	Jun, 2006
Turkojan 3.0	Turkey 🇹🇷	Fungus	Delphi	Sep, 2006
Casper Demo	Unknown 🏴‍☠️	loog	Visual Basic 6 (VB6)	Oct, 2006
Bifrost 1.2.1	Sweden 🇸🇪	ksv	C++	Jan, 2007
Hav-Rat 1.2	Sweden 🇸🇪	Havalito	Delphi	Feb, 2007
Bandook 1.35	Lebanon 🇱🇧	PrinceAli	Delphi, C++	Apr, 2007
Poison Ivy 2.3.0	Sweden 🇸🇪	Shapeless	Delphi, MASM	Jun, 2007
Hav-Rat 1.3.2	Sweden 🇸🇪	Havalito	Delphi	Jul, 2007
sharK 2.4.0 Fwb+	Germany 🇩🇪	sNiper109 , rockZ	Visual Basic 6 (VB6)	Aug, 2007
DARKMOON 4.11 Private Edition	Spain 🇪🇸	shukisnike	Delphi	Aug, 2007
Nuclear RAT 2.1.0	Brazil 🇧🇷	caesar2k	Delphi	Sep, 2007
Bump-Rat 1.2 Beta	France 🇫🇷	Scraniak	Visual Basic 6 (VB6)	Sep, 2007
Poison Ivy 2.3.2	Sweden 🇸🇪	Shapeless	Delphi, MASM	Jan, 2008
Lost Door 1.0	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Jan, 2008
ZombieRat 1.2	Romania 🇷🇴	The Bo$$	Assembly, Delphi	Jan, 2008