018. That's How Real Adversaries Abuse Wksprt.exe and Use DLL Proxying
Hello everyone! Cyble shared a research on a recent campaign targeting organizations in Germany. Two things caught my attention - abusing wksprt.exe (RemoteApp and Desktop Connection Runtime) for sideloading and using DLL proxying. Interesting enough that the theat actors copied this legitimate file from the compromised system to a newly created folder using xcopy: xcopy /Y /I C:\Windows\System32\wksprt.exe "C:\Users\<USER>\AppData\Local\InteI\" This legitimate executable is used to sideload a malicious DLL (IPHLPAPI.dll), which loads renamed legitimate DLL (IPHLPLAPI.dll), both from the same folder. The malicious DLL acts as a proxy to forward function calls to the legitimate DLL. At the same time, the malicious DLL read the contents of the file ccache.dat to decrypt the shellcode and retrieve the final payload - a Sliver implant. Despite the fact the adversary leverages quite sophisticated techniques like DLL proxying, the infection process is extremely noisy, fo...