Payouts King / RomulusLoader Process Injection into Legitimate Host Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•6

Detects suspicious cross-process memory injection activity by correlating remote virtual memory allocation (VirtualAllocEx or MapViewOfSection) followed by the creation of a remote thread (CreateRemoteThread) targeting established legitimate Windows processes. This behavior is commonly associated with malware loaders such as Payouts King and RomulusLoader for facilitating code injection.