{
  "family": "delfinject",
  "sample_count": 26,
  "category": "trojan",
  "description": "Trojan:Win32/Delfinject is a heuristic detection identifying a specific, malicious behavior: a binary compiled in the Delphi programming language attempting to inject malicious code into the memory space of a legitimate Windows process. It is not a single malware family, but a technique commonly used by various Delphi-based threats, including banking trojans and RATs.<br><br><b>Understanding Delfinject</b><br>To an end-user, Delfinject is a standard antivirus warning. For incident responders, 'Delfinject' signifies that a payload has attempted a sophisticated evasion technique. Delphi (Object Pascal) was historically very popular among malware authors because the resulting binaries often had distinct structural differences from C++ malware, confusing older AV engines. The 'inject' portion of the name indicates the malware is attempting Process Hollowing or DLL Injection, ensuring the malicious code runs under the guise of a trusted application (like `explorer.exe` or `svchost.exe`).<br><br><b>Execution and Injection Mechanics</b><br>Delfinject-flagged files are often initial droppers or loaders distributed via malspam. Upon execution, the Delphi binary unpacks a secondary payload in memory (`T1027.002`). It then launches a legitimate Windows process in a suspended state (`CREATE_SUSPENDED`). It hollows out the memory of that legitimate process and writes its decrypted payload into that space (`T1055.012`). Finally, it resumes the thread. To the operating system and many task managers, it appears that a normal system file is running, but the executed code is entirely malicious.<br><br><b>Forensic Analysis & Impact</b><br>The impact depends entirely on the injected payload (which could be a banking trojan like Danabot or a RAT). EDR tools are vital here, as they monitor the behavioral anomaly of the process injection. Analysts must use memory forensics (like Volatility) to dump the memory of the injected process (`T1055`) to retrieve the true, unpacked payload for reverse engineering.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1055.012",
    "T1059.003",
    "T1547.001",
    "T1027.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Verify that the endpoint security solution successfully quarantined the Delphi executable and prevented the process injection.",
    "If the injection succeeded, immediately isolate the endpoint from the network to prevent the hidden payload from establishing C2 or exfiltrating data.",
    "Capture a live memory image (RAM dump) of the infected machine to extract the injected code from the hollowed process.",
    "Perform a wide EDR hunt across the enterprise using the hash of the initial Delphi dropper."
  ],
  "what_to_avoid": [
    "Do not dismiss a Delfinject alert as a generic false positive; it is a clear indicator of an active evasion attempt.",
    "Avoid relying solely on static analysis of the Delphi file on disk; the true threat is the payload it injects into memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}