Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

calendar Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.execution attack.stealth attack.t1574.001  ·
Share on: linkedin copy

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Sigma rule (View on GitHub)

 1title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
 2id: d2451be2-b582-4e15-8701-4196ac180260
 3related:
 4    - id: ca5583e9-8f80-46ac-ab91-7f314d13b984
 5      type: similar
 6status: test
 7description: |
 8    Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
 9    Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".    
10references:
11    - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
12    - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
13    - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
14    - https://twitter.com/Max_Mal_/status/1775222576639291859
15    - https://twitter.com/DTCERT/status/1712785426895839339
16author: Swachchhanda Shrawan Poudel
17date: 2024-04-15
18tags:
19    - attack.persistence
20    - attack.privilege-escalation
21    - attack.execution
22    - attack.stealth
23    - attack.t1574.001
24logsource:
25    category: image_load
26    product: windows
27detection:
28    selection:
29        Image|endswith:
30            - '\KeyScrambler.exe'
31            - '\KeyScramblerLogon.exe'
32        ImageLoaded|endswith: '\KeyScramblerIE.dll'
33    filter_main_legitimate_path:
34        Image|contains:
35            - 'C:\Program Files (x86)\KeyScrambler\'
36            - 'C:\Program Files\KeyScrambler\'
37        ImageLoaded|contains:
38            - 'C:\Program Files (x86)\KeyScrambler\'
39            - 'C:\Program Files\KeyScrambler\'
40    filter_main_signature:
41        Signature: 'QFX Software Corporation'
42        SignatureStatus: 'Valid'
43    condition: selection and not 1 of filter_main_*
44falsepositives:
45    - Unknown
46level: high

References

Related rules

to-top