Sigma Rule Library

Malicious DLL Load By Compromised 3CXDesktopApp

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

View on GitHubOpen raw file

Detection logic

selection

Hashes|contains:
  - SHA256=7986BBAEE8940DA11CE089383521AB420C443AB7B15ED42AED91FD31CE833896
  - SHA1=BF939C9C261D27EE7BB92325CC588624FCA75429
  - MD5=74BC2D0B6680FAA1A5A76B27E5479CBC
  - SHA256=11BE1803E2E307B647A8A7E02D128335C448FF741BF06BF52B332E0BBF423B03
  - SHA1=20D554A80D759C50D6537DD7097FED84DD258B3E
  - MD5=82187AD3F0C6C225E2FBA0C867280CC9
  - SHA256=F79C3B0ADB6EC7BCC8BC9AE955A1571AAED6755A28C8B17B1D7595EE86840952
  - SHA1=894E7D4FFD764BB458809C7F0643694B036EAD30
  - MD5=11BC82A9BD8297BD0823BCE5D6202082
  - SHA256=8AB3A5EAAF8C296080FADF56B265194681D7DA5DA7C02562953A4CB60E147423
  - SHA1=3B3E778B647371262120A523EB873C20BB82BEAF
  - MD5=7FAEA2B01796B80D180399040BB69835

Condition

selection

Raw YAML

title: Malicious DLL Load By Compromised 3CXDesktopApp
id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
related:
    - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26 # Proxy C2
      type: similar
    - id: 76bc1601-9546-4b75-9419-06e0e8d10651 # Proxy GH
      type: similar
    - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8 # DNS C2
      type: similar
    - id: 51eecf75-d069-43c7-9ea2-63f75499edd4 # net_connection C2
      type: similar
    - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c # ProcCreation Exec
      type: similar
    - id: 63f3605b-979f-48c2-b7cc-7f90523fed88 # ProcCreation ChildProc
      type: similar
    - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a # ProcCreation Update
      type: similar
status: test
description: Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp
references:
    - https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-31
modified: 2024-11-23
tags:
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Hashes|contains:
            # ffmpeg.dll
            - 'SHA256=7986BBAEE8940DA11CE089383521AB420C443AB7B15ED42AED91FD31CE833896'
            - 'SHA1=BF939C9C261D27EE7BB92325CC588624FCA75429'
            - 'MD5=74BC2D0B6680FAA1A5A76B27E5479CBC'
            # d3dcompiler_47.dll
            - 'SHA256=11BE1803E2E307B647A8A7E02D128335C448FF741BF06BF52B332E0BBF423B03'
            - 'SHA1=20D554A80D759C50D6537DD7097FED84DD258B3E'
            - 'MD5=82187AD3F0C6C225E2FBA0C867280CC9'
            # Inner object from ffmpeg.dll
            - 'SHA256=F79C3B0ADB6EC7BCC8BC9AE955A1571AAED6755A28C8B17B1D7595EE86840952'
            - 'SHA1=894E7D4FFD764BB458809C7F0643694B036EAD30'
            - 'MD5=11BC82A9BD8297BD0823BCE5D6202082'
            # ICONIC Stealer payload
            - 'SHA256=8AB3A5EAAF8C296080FADF56B265194681D7DA5DA7C02562953A4CB60E147423'
            - 'SHA1=3B3E778B647371262120A523EB873C20BB82BEAF'
            - 'MD5=7FAEA2B01796B80D180399040BB69835'
    condition: selection
falsepositives:
    - Unlikely
level: critical

False positives

  • Unlikely

References

Related rules

Similar rules

APT PRIVATELOG Image Load Pattern

high

windows · Same logsource category (image_load)

Diamond Sleet APT DLL Sideloading Indicators

high

windows · Same logsource category (image_load)

DLL Names Used By SVR For GraphicalProton Backdoor

medium

windows · Same logsource category (image_load)

Kapeka Backdoor Loaded Via Rundll32.EXE

high

windows · Same logsource category (image_load)