Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

calendar Apr 15, 2024 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002  ·
Share on: linkedin copy

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Sigma rule (View on GitHub)

 1title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
 2id: d2451be2-b582-4e15-8701-4196ac180260
 3status: experimental
 4description: |
 5    Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
 6    Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".    
 7references:
 8    - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
 9    - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
10    - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
11    - https://twitter.com/Max_Mal_/status/1775222576639291859
12    - https://twitter.com/DTCERT/status/1712785426895839339
13author: Swachchhanda Shrawan Poudel
14date: 2024/04/15
15tags:
16    - attack.defense_evasion
17    - attack.privilege_escalation
18    - attack.t1574.001
19    - attack.t1574.002
20logsource:
21    category: image_load
22    product: windows
23detection:
24    selection:
25        Image|endswith:
26            - '\KeyScrambler.exe'
27            - '\KeyScramblerLogon.exe'
28        ImageLoaded|endswith: '\KeyScramblerIE.dll'
29    filter_main_legitimate_path:
30        Image|contains:
31            - 'C:\Program Files (x86)\KeyScrambler\'
32            - 'C:\Program Files\KeyScrambler\'
33        ImageLoaded|contains:
34            - 'C:\Program Files (x86)\KeyScrambler\'
35            - 'C:\Program Files\KeyScrambler\'
36    filter_main_signature:
37        Signature: 'QFX Software Corporation'
38        SignatureStatus: 'Valid'
39    condition: selection and not 1 of filter_main_*
40falsepositives:
41    - Unknown
42level: high

References

Related rules

to-top