Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Hunting for Unsigned DLLs to Find APTs

Summary: Unit 42 hunted for unsigned DLL loading across February to August 2022 and found malware families tied to the Chinese group Stately Taurus (formerly PKPLUG, aka Mustang Panda) and the North Korean group Selective Pisces (aka Lazarus Group). Stately Taurus dropped AvastSvc.exe, wsc.dll and an encrypted AvastAuth.dat into ProgramData to side-load the PlugX RAT, while Selective Pisces used the signed MagicLine4NX.exe to write mi.dll and copy wsmprovhost.exe into a random ProgramData directory, then dropped ualapi.dll into System32 so spoolsv.exe would load it at startup.

What's compelling: Both APT groups hid their payloads behind legitimate signed software - an antivirus binary and a PDF reader in one case, a signed MagicLine4NX process in the other - so detections that only judge a DLL after it loads into memory leave the initial execution unwatched. The most common unsigned DLL paths in the hunt were ProgramData, AppData and user home directories, which are ordinary writable locations on most endpoints.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related