Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

calendar May 13, 2024 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002  ·
Share on: linkedin copy

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Sigma rule (View on GitHub)

 1title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
 2id: d2451be2-b582-4e15-8701-4196ac180260
 3related:
 4    - id: ca5583e9-8f80-46ac-ab91-7f314d13b984
 5      type: similar
 6status: experimental
 7description: |
 8    Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
 9    Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".    
10references:
11    - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
12    - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
13    - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
14    - https://twitter.com/Max_Mal_/status/1775222576639291859
15    - https://twitter.com/DTCERT/status/1712785426895839339
16author: Swachchhanda Shrawan Poudel
17date: 2024/04/15
18tags:
19    - attack.defense_evasion
20    - attack.privilege_escalation
21    - attack.t1574.001
22    - attack.t1574.002
23logsource:
24    category: image_load
25    product: windows
26detection:
27    selection:
28        Image|endswith:
29            - '\KeyScrambler.exe'
30            - '\KeyScramblerLogon.exe'
31        ImageLoaded|endswith: '\KeyScramblerIE.dll'
32    filter_main_legitimate_path:
33        Image|contains:
34            - 'C:\Program Files (x86)\KeyScrambler\'
35            - 'C:\Program Files\KeyScrambler\'
36        ImageLoaded|contains:
37            - 'C:\Program Files (x86)\KeyScrambler\'
38            - 'C:\Program Files\KeyScrambler\'
39    filter_main_signature:
40        Signature: 'QFX Software Corporation'
41        SignatureStatus: 'Valid'
42    condition: selection and not 1 of filter_main_*
43falsepositives:
44    - Unknown
45level: high

References

Related rules

to-top