LegionLoader Dynamic API Resolution via AppData Process Loading User32/Kernel32

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a behavioral pattern associated with LegionLoader malware, where a process running from the 'AppData\Roaming' directory loads 'user32.dll' or 'kernel32.dll'. This pattern is frequently used to dynamically resolve GUI interaction APIs (such as MessageBoxA) via GetProcAddress as an anti-analysis and obfuscation technique.