An APT hacking group known as “Dragon Breath”, “Golden Eye Dog” or “APT-Q-27” is demonstrating a new trend that uses multiple, complex variations of the classic DLL sideloading technique to evade detection.
See also: Chinese Earth Longzhi group resurfaces with advanced malware tactics
These attack variants start with an initial vector that leverages a pure application, most often Telegram, which carries a second-stage payload, which in turn carries a malicious malware loader DLL.
The lure for victims is Trojanized Telegram, LetsVPN or WhatsApp apps for Android, iOS or Windows that are supposedly localized for people in China. It is believed that the trojanized apps are promoted using BlackSEO or malvertising.
According to Sophos analysts who have monitored the threat actor's recent attacks, the targeting scope of this campaign is focused on Chinese-speaking Windows users in China, Japan, Taiwan, Singapore, Hong Kong, and the Philippines.
See also: City of Dallas attacked by Royal ransomware
Double DLL sideloading
DLL sideloading is a technique used by attackers since 2010, exploiting the insecure way Windows loads DLL (Dynamic Link Library) files required by an application.
The attacker places a malicious DLL, with the same name as the legitimate, required DLL, in an application's directory. When the user launches the executable, Windows prioritizes the local malicious DLL over the one located in the system.
The attacker's DLL contains malicious code that is loaded at this stage, giving the attacker privileges or executing commands on the host by exploiting the trusted, signed application that loads it.
In this campaign, victims run the installer of the mentioned applications, which places components on the system and creates a desktop shortcut and a system startup entry.
If the victim attempts to launch the newly created desktop shortcut, as the first step is expected to be, instead of launching the application, the following command will be executed on the system.
The command runs a renamed version of 'regsvr32.exe' ('appR.exe') to execute a renamed version of 'scrobj.dll' ('appR.dll') and provides a DAT file ('appR.dat') as input to it. The DAT contains JavaScript to be executed by the script execution engine library ('appR.dll').
The JavaScript code launches the Telegram application's user interface in the foreground, while simultaneously installing various sideloading components in the background.
The installer then loads a second-stage application using a clean dependency (libexpat.dll) to load a second, clean application as an intermediate attack stage.
See also: Sandworm: Used WinRAR to destroy data of a Ukrainian government agency
In a variant of the attack, the pure application “XLGame.exe” is renamed to “Application.exe” and the second-stage loader is also a pure executable, signed by Beijing Baidu Netcom Science and Technology Co., Ltd.
In another variant, the second-stage clean loader is “KingdomTwoCrowns.exe”, which is not digitally signed and Sophos was unable to determine what benefit it offers other than obfuscating the execution chain.
In a third variant of the attack, the second-stage loader is the clean executable file, “d3dim9.exe”, which is digitally signed by HP Inc.
This “double DLL sideloading” technique achieves evasion, obfuscation, and persistence, making it difficult for defenders to adapt to specific attack patterns and effectively protect networks .
The last payload
In all observed attack variants, the final DLL payload is decrypted from a text file (“templateX.txt”) and executed on the system.
This payload is a backdoor that supports various commands, such as system reboot, modifying registry keys, recovering files, stealing clipboard content, executing commands in a hidden CMD window, and more.
The backdoor also targets the MetaMask Chrome extension for the cryptocurrency wallet, aiming to steal digital assets from victims.
In summary, DLL sideloading remains an effective attack method for hackers and one that Microsoft and developers have failed to address for over ten years.
In the latest APT-Q-27 attack, analysts observed DLL sideloading variants that are difficult to detect - thus, achieving a quieter infection chain.
Information source: bleepingcomputer.com
