Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

calendar May 15, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001  ·
Share on: linkedin copy

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Sigma rule (View on GitHub)

 1title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
 2id: d2451be2-b582-4e15-8701-4196ac180260
 3related:
 4    - id: ca5583e9-8f80-46ac-ab91-7f314d13b984
 5      type: similar
 6status: test
 7description: |
 8    Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
 9    Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".    
10references:
11    - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
12    - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
13    - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
14    - https://twitter.com/Max_Mal_/status/1775222576639291859
15    - https://twitter.com/DTCERT/status/1712785426895839339
16author: Swachchhanda Shrawan Poudel
17date: 2024-04-15
18tags:
19    - attack.defense-evasion
20    - attack.privilege-escalation
21    - attack.t1574.001
22logsource:
23    category: image_load
24    product: windows
25detection:
26    selection:
27        Image|endswith:
28            - '\KeyScrambler.exe'
29            - '\KeyScramblerLogon.exe'
30        ImageLoaded|endswith: '\KeyScramblerIE.dll'
31    filter_main_legitimate_path:
32        Image|contains:
33            - 'C:\Program Files (x86)\KeyScrambler\'
34            - 'C:\Program Files\KeyScrambler\'
35        ImageLoaded|contains:
36            - 'C:\Program Files (x86)\KeyScrambler\'
37            - 'C:\Program Files\KeyScrambler\'
38    filter_main_signature:
39        Signature: 'QFX Software Corporation'
40        SignatureStatus: 'Valid'
41    condition: selection and not 1 of filter_main_*
42falsepositives:
43    - Unknown
44level: high

References

Related rules

to-top