Abusing legitimate Windows methods
https://www.bleepingcomputer.com/news/security/fin7-hackers-bioload-malware-drops-fresher-carbanak-backdoor/
Malware researchers have uncovered a new tool used by the financially-motivated cybercriminal group known as FIN7 to load fresher builds of the Carbanak backdoor.
Dubbed BIOLOAD, the malware loader has a low detection rate and shares similarities with BOOSTWRITE, another loader recently identified to be part of FIN7's arsenal.