From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – The victim was induced to open a file from a WebDAV share, triggering the initial execution chain (‘a user executed a file pulled from a WebDAV server’).
• [T1027.013 ] Obfuscated Files or Information: Encrypted/Encoded File – The payloads were staged as encrypted droppers and packed content that had to be decrypted before use (‘Encrypted droppers’, ‘decrypted the embedded payload using AES and GZip’).
• [T1140 ] Deobfuscate/Decode Files or Information – The loader decrypted and unpacked the hidden payload before execution (‘decrypted the embedded payload using AES and GZip’).
• [T1027.007 ] Obfuscated Files or Information: Dynamic API Resolution – The DlrtyGames chain resolved APIs by hash to hinder analysis (‘resolved APIs by hash’).
• [T1620 ] Reflective Code Loading – The stealer was mapped directly into memory using Assembly.Load(byte[]) (‘mapped the payload directly into memory’).
• [T1055.012 ] Process Hollowing – Malicious code ran inside legitimate signed processes to evade detection (‘executed inside a legitimate, EV-signed Qihoo 360 process via process hollowing’).
• [T1036.002 ] Masquerading: Right-to-Left Override – The lure disguised an executable as a PDF using RTLO (‘a right-to-left override (RTLO) masqueraded .scr executable’).
• [T1036.007 ] Masquerading: Double File Extension – The directory included tests for double-extension tricks to make executables appear as documents (‘double extensions’).
• [T1574.001 ] Hijack Execution Flow: DLL – The DlrtyGames chain used DLL sideloading through a legitimate signed binary (‘used DLL sideloading to load discord-rpc.x64.dll’).
• [T1106 ] Native API – The final injection stage used low-level Windows process manipulation APIs and related calls (‘updated thread context, and resumed execution’).
• [T1497.003 ] Time Based Evasion – The payload delayed execution to complicate analysis (‘After a 45-second sleep delay’).
• [T1622 ] Debugger Evasion – The stealer checked for analysis tooling and terminated if monitored (‘called IsDebuggerPresent’, ‘called FailFast’).
• [T1548.002 ] Bypass User Account Control – The DlrtyGames chain performed COM auto-elevation (‘performed COM auto-elevation through dllhost.exe’).
• [T1113 ] Screen Capture – The RAT included screenshot capability (‘plugins for … screenshots’).
• [T1056.001 ] Keylogging – The RAT included a keylogger module with keyword triggers (‘Its keylogger module used plaintext keyword triggers’).
• [T1005 ] Data from Local System – The stealer collected local application data, Telegram data, and desktop screenshots (‘browser data, messaging sessions, and local application data’).
• [T1555.003 ] Credentials from Web Browsers – The stealer targeted browser usernames, passwords, cookies, and session tokens (‘saved browser usernames, passwords, cookies, session tokens’).
• [T1539 ] Steal Web Session Cookie – The collection logic included browser cookies and session tokens (‘cookies, session tokens’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data was sent to attacker infrastructure over HTTP/TLS (‘exfiltrated to 77[.]110.127.205’).
• [T1573 ] Encrypted Channel – The exfiltration used TLS via SslStream (‘over SslStream (TLS without SNI)’).
• [T1053.005 ] Scheduled Task – The IOC section references task-based persistence artifacts (‘Schedule tasks: brokerhost, net_queue_32’).
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence was established via a Run key (‘HKCUSoftwareMicrosoftWindowsCurrentVersionRunXNNNMHJAZNCNHGIKJDW’).
• [T1546.003 ] WMI Event Subscription – The article’s MITRE table lists possible persistence using WMI event subscription (‘Possible persistence WMI Event Subscription’).
• [T1055 ] Process Injection – The report describes code being executed inside another process and the RAT being injected into signed hosts (‘process hollowing’, ‘created signed host processes’).