APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

MITRE Techniques

• [T1574.002 ] DLL Side-Loading – CoolClient executes by abusing a legitimate Sangfor binary that loads malicious libngs.dll [‘the legitimate Sangfor application (defender.exe or Sang.exe) loads the malicious libngs.dll through DLL sideloading’]
• [T1055 ] Process Injection – The malware injects decrypted payloads into synchost.exe and later into a suspended synchost.exe instance for execution [‘the decrypted DLL is then injected into a newly created suspended instance of synchost.exe’ and ‘allocation, thread context modification, and ResumeThread’]
• [T1543.003 ] Create or Modify System Process: Windows Service – CoolClient installs itself as a service and also deploys msagent.sys as a driver service [‘establishes an additional persistence mechanism by installing itself as a Windows service’ and ‘a new driver service is created and started’]
• [T1547.001 ] Registry Run Keys / Startup Folder – Persistence is maintained via an AutoRun entry under HKCU Run [‘creates an AutoRun entry under: HKCUSoftwareMicrosoftWindowsCurrentVersionRun’]
• [T1112 ] Modify Registry – The malware adds Microsoft Defender exclusions and writes configuration values used by the driver [‘added both a folder exclusion and a file exclusion’ and ‘updates the HKLMSYSTEMRNGWid_H1deF5Dirs registry value’]
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – CoolClient excludes its fake Defender path from Microsoft Defender scanning to avoid detection [‘added both a folder exclusion and a file exclusion to Microsoft Defender’]
• [T1068 ] Exploitation for Privilege Escalation – The sample uses an RPC-based UAC bypass and privilege elevation flow to relaunch itself with elevated rights [‘implements an RPC-based process creation technique’ and ‘launch winver.exe through the RPC interface’]
• [T1134.002 ] Access Token Manipulation: Create Process with Token – The malware duplicates and reuses access tokens to create an elevated process under another session [‘duplicates its access token, updates the session identifier, and creates a new synchost.exe process using CreateProcessAsUserA’]
• [T1027 ] Obfuscated Files or Information – CoolClient decrypts components with XOR and uses obfuscated control flow in its loader [‘decrypted using a 0x32-byte repeating XOR keystream’ and ‘heavily obfuscated through control flow flattening’]
• [T1562.006 ] Impair Defenses: Indicator Blocking – The driver hides files, registry entries, processes, modules, and network indicators from visibility [‘hiding and protection mechanisms’ and ‘matching IP addresses are removed before the data is returned to user mode’]
• [T1014 ] Rootkit – The newly introduced signed kernel-mode driver provides rootkit-style hiding and protection features [‘enables the driver’s rootkit functionality’ and ‘hiding and protecting processes, files, and registry objects’]