{
  "family": "delphinjector",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Trojan:Win32/Delphinjector is a generic classification for malware or specialized droppers written in Delphi whose primary function is Process Injection (`T1055`). Delphi is popular among threat actors (like the authors of Emotet or early Ryuk variants) because it compiles into large, complex, standalone executables that are difficult to analyze statically and often bypass basic AV heuristics.<br><br><b>Understanding Delphinjector</b><br>To an end-user, the execution is invisible. For a SOC analyst, a Delphinjector detection is a major red flag indicating that a highly evasive staging mechanism has breached the endpoint. The Delphi binary is almost certainly a 'wrapper' designed to hollow out a legitimate process and inject a more destructive payload (like Cobalt Strike or ransomware) into memory.<br><br><b>Execution and Injection Mechanics</b><br>Upon execution, the Delphi executable typically drops a highly obfuscated payload into memory. It then launches a legitimate, trusted Windows process (like `svchost.exe`, `explorer.exe`, or `RegAsm.exe`) in a suspended state (`T1055.012`). It unmaps (hollows) the legitimate code from the suspended process's memory and injects its own malicious code. Finally, it resumes the thread. To the OS and many EDR tools, the executing code appears to be the legitimate Microsoft binary, completely bypassing application whitelisting and firewall rules.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the injected payload. Host-based IoCs require behavioral analysis (EDR). Analysts should look for a Delphi-compiled executable spawning legitimate Windows binaries (like `svchost.exe`) without the appropriate command-line arguments. Network IoCs involve that 'legitimate' process suddenly making outbound connections to low-reputation IP addresses. Memory forensics (dumping the `svchost.exe` process) is strictly required to extract the actual payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1055.012",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (The core behavior of this family)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing (Specifically targeting legitimate binaries)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Using Delphi to complicate static analysis)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; process injection is a precursor to severe attacks like ransomware or lateral movement.",
    "Use EDR tools to identify the legitimate process that was hollowed out (e.g., `svchost.exe`) and terminate it.",
    "Capture a live RAM dump of the infected host to allow forensic analysts to extract the injected payload from memory.",
    "Investigate the initial execution of the Delphi executable (often a macro-enabled document or a downloaded crack)."
  ],
  "what_to_avoid": [
    "Do not assume the machine is clean just because the initial Delphinjector executable was quarantined; the payload may already be running in memory.",
    "Avoid whitelisting standard Windows binaries globally in your EDR, as this ignores process hollowing."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}