Hijack Execution Flow: DLL

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.^[10]

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.^[11][12]

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).^[13][14][15]

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows.^[16] APT41 has also used legitimate executables to perform DLL side-loading of their malware.^[17]

APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.^[18] APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.^[18]

Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory.^[19] Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.^[20]

Astaroth can launch itself via DLL Search Order Hijacking.^[21]

BackdoorDiplomacy has executed DLL search order hijacking.^[22]

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.^[23][24]

DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.^[25]

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.^[26]

BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.^[27]

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.^[28]

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO.^[29] Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.^[29]

Chaes has used search order hijacking to load a malicious DLL.^[30]

Chimera has used side loading to place malicious DLLs in memory.^[31]

Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.^[32]

Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons.^[33][34] Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs.^[35]

Clambling can store a file named mpsvc.dll, which opens a malicious mpsvc.mui file, in the same folder as the legitimate Microsoft executable MsMpEng.exe to gain execution.^[36][37]

Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.^[38]

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems.^[39] Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.^[40]

DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.^[41]

Denis exploits a security vulnerability to load a fake DLL and execute its code.^[13]

Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.^[42]

Dridex can abuse legitimate Windows executables to side-load malicious DLL files.^[43]

Earth Lusca has placed a malicious payload in %WINDIR%\SYSTEM32\oci.dll so it would be sideloaded by the MSDTC service.^[44]

Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.^[45]

Egregor has used DLL side-loading to execute its payload.^[46]

Empire contains modules that can discover and exploit various DLL hijacking opportunities.^[47]

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.^[48]

FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).^[49]

FinFisher uses DLL side-loading to load malicious programs.^[50][51] A FinFisher variant also uses DLL search order hijacking.^[50][52]

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate version.dll during the Microsoft.IdentityServer.ServiceHost.exe execution process.^[53]

GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.^[54]

A gh0st RAT variant has used DLL side-loading.^[55]

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.^[14]

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.^[56]

Hikit has used DLL to load oci.dll as a persistence mechanism.^[57]

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.^[58] HTTPBrowser has also used DLL side-loading.^[59]

HUI Loader can be deployed to targeted systems via legitimate programs that are vulnerable to DLL search order hijacking.^[34]

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.^[60][61]

InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.^[62]

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.^[21]

Kerrdown can use DLL side-loading to load malicious DLLs.^[63]

Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.^[64] Lazarus Group utilized DLL side-loading to execute malicious payloads through abuse of the legitimate processes wsmprovhost.exe and dfrgui.exe.^[65]

LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.^[66]

LookBack side loads its communications module as a DLL into the libcurl.dll loader.^[67]

LuminousMoth has used legitimate executables such as winword.exe and igfxem.exe to side-load their malware.^[68][69]

Lumma Stealer has leveraged legitimate applications to then side-load malicious DLLs during execution.^[70]

Melcoz can use DLL hijacking to bypass security controls.^[21]

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.^[71][72][73] menuPass has also used DLL search order hijacking.^[74]

metaMain can support an HKCMD sideloading start method.^[75]

Metamorfo has side-loaded its malicious DLL file.^[76][77][78]

MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.^[79]

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.^[80]

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.^[81][82][83]

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.^[84]

Nebulae can use DLL side-loading to gain execution.^[85]

Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.^[66]

During Operation CuckooBees, the threat actors used the legitimate Windows services IKEEXT and PrintNotify to side-load malicious DLLs.^[86]

Pandora can use DLL side-loading to execute malicious payloads.^[61]

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.^[87]

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.^[66]

PlugX has the ability to use DLL search order hijacking for installation on targeted systems.^[88] PlugX has also used DLL side-loading to evade anti-virus.^{[12][59][89][71][90][36][91]}

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.^[92][93]

PowGoop can side-load Goopdate.dll into GoogleUpdate.exe.^[80][94]

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.^[95]

QakBot has the ability to use DLL side-loading for execution.^[96]

RainyDay can use side-loading to run malicious executables.^[85]

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.^[97]

Raspberry Robin can use legitimate, signed EXE files paired with malicious DLL files to load and run malicious payloads while bypassing defenses.^[98]

RCSession can be installed via DLL side-loading.^[99][36][91]

Mustang Panda used DLL search order hijacking on vulnerable applications to install PlugX payloads during RedDelta Modified PlugX Infection Chain Operations.^[100]

RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.^[101]

RTM has used search order hijacking to force TeamViewer to load a malicious DLL.^[102]

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.^[103]

SideCopy has used a malicious loader DLL file to execute the credwiz.exe process and side-load the malicious payload Duser.dll.^[104]

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.^[105]

Storm-1811 has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of b at runtime to load a Cobalt Strike beacon payload.^[106]

StrelaStealer has sideloaded a DLL payload using a renamed, legitimate msinfo32.exe executable.^[107]

SysUpdate can load DLLs through vulnerable legitimate executables.^[61]

During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.^[108]

Threat Group-3390 has performed DLL search order hijacking to execute their payload.^[109] Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as rc.exe, a legitimate Microsoft Resource Compiler.^{[59][110][111][60][112]}

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.^[113]

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.^[114][115]

Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.^[116]

WastedLocker has performed DLL hijacking before execution.^[117]

Waterbear has used DLL side loading to import and load a malicious DLL loader.^[26]

Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).^[118]

Whitefly has used search order hijacking to run the loader Vcrodat.^[119]

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.^[120][121]

ZeroT has used DLL side-loading to load malicious payloads.^[122][123]

When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.

Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses.^[124]

Use the program sxstrace.exe that is included with Windows, along with manual inspection, to check manifest files for side-by-side problems in software.^[125]

Identify and block potentially malicious software executed through DLL hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.^[126]

Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.^[127]

Enable Safe DLL Search Mode to move the user's current folder later in the search order. This is included by default in modern versions of Windows; the associated Windows Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode.^[128]

Update software regularly to include patches that fix DLL side-loading vulnerabilities.