Family Tree: DLL-Sideloading Cases May Be Related

MITRE Techniques

• [T1574.002] DLL sideloading – The attacker plants and invokes a legitimate application that loads the malicious DLL. This allows the attacker to take advantage of the trust the system already has in the application. “As above, except the attacker plants and invokes a legitimate application that loads the malicious DLL.”
• [T1574.001] DLL preloading – An attacker plants a malicious DLL in a directory that will be searched by a pre-existing application before the location of a legitimate library (based on the default Windows search order).
• [T1055] Process Injection – The loader JAs are injected into processes (e.g., “loader.ja is injected into the winver.exe process (process hollowing; we’ll have more to say about this technique in Scenario 3)”).
• [T1548.002] Abuse Elevation: Bypass User Account Control – The implant employs a UAC bypass using the CMSTPLUA COM interface, injecting and elevating privileges.
• [T1543.003] Create or Modify System Process: Windows Service – The malware installs and uses a Windows service (e.g., “creates a service named gupdaten”).
• [T1071.001] Web Protocols – The malware communicates with attacker infrastructure over HTTP/HTTPS (e.g., “reverse HTTP shell, connecting to the attacker-controlled server” and specific URLs).
• [T1134] Access Token Manipulation – The analysis notes potential token-related activity (e.g., “grabs its process token”), indicating token manipulation during infection.
• [T1027] Obfuscated/Compressed Files and Information – The implants and configs are described as encrypted or obfuscated (e.g., “encrypted implants” and “encrypted config in time.sig”).