The malware you’re describing would never be used. The designers of this stuff run it at ring zero on Windows with unlimited permissions and zero transparency