Hijack Execution Flow: DLL Side-Loading

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.^[2]

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.^[3][4]

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).^[5][6][7]

APT41 used legitimate executables to perform DLL side-loading of their malware.^[8]

APT41 DUST used DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.^[9]

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.^[10][11]

DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.^[12]

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.^[13]

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.^[14]

Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.^[15]

Chimera has used side loading to place malicious DLLs in memory.^[16]

Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.^[17]

Cinnamon Tempest has abused legitimate executables to side-load weaponized DLLs.^[18]

Clambling can store a file named mpsvc.dll, which opens a malicious mpsvc.mui file, in the same folder as the legitimate Microsoft executable MsMpEng.exe to gain execution.^[19][20]

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems.^[21] Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.^[22]

DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.^[23]

Denis exploits a security vulnerability to load a fake DLL and execute its code.^[5]

Dridex can abuse legitimate Windows executables to side-load malicious DLL files.^[24]

Earth Lusca has placed a malicious payload in %WINDIR%\SYSTEM32\oci.dll so it would be sideloaded by the MSDTC service.^[25]

Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.^[26]

Egregor has used DLL side-loading to execute its payload.^[27]

FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).^[28]

FinFisher uses DLL side-loading to load malicious programs.^[29][30]

GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.^[31]

A gh0st RAT variant has used DLL side-loading.^[32]

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.^[6]

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.^[33]

HTTPBrowser has used DLL side-loading.^[34]

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.^[35][36]

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.^[37]

Kerrdown can use DLL side-loading to load malicious DLLs.^[38]

Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.^[39]

LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.^[40]

LookBack side loads its communications module as a DLL into the libcurl.dll loader.^[41]

LuminousMoth has used legitimate executables such as winword.exe and igfxem.exe to side-load their malware.^[42][43]

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.^[44][45][46]

metaMain can support an HKCMD sideloading start method.^[47]

Metamorfo has side-loaded its malicious DLL file.^[48][49][50]

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.^[51]

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.^[52][53][54]

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.^[55]

Nebulae can use DLL side-loading to gain execution.^[56]

Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.^[40]

During Operation CuckooBees, the threat actors used the legitimate Windows services IKEEXT and PrintNotify to side-load malicious DLLs.^[57]

Pandora can use DLL side-loading to execute malicious payloads.^[36]

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.^[58]

Pcexter has been distributed and executed as a DLL file named Vspmsg.dll via DLL side-loading.^[40]

PlugX has used DLL side-loading to evade anti-virus.^{[4][34][59][44][60][19][61]}

PowGoop can side-load Goopdate.dll into GoogleUpdate.exe.^[51][62]

QakBot has the ability to use DLL side-loading for execution.^[63]

RainyDay can use side-loading to run malicious executables.^[56]

Raspberry Robin can use legitimate, signed EXE files paired with malicious DLL files to load and run malicious payloads while bypassing defenses.^[64]

RCSession can be installed via DLL side-loading.^[65][19][61]

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.^[66]

SideCopy has used a malicious loader DLL file to execute the credwiz.exe process and side-load the malicious payload Duser.dll.^[67]

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.^[68]

SysUpdate can load DLLs through vulnerable legitimate executables.^[36]

During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.^[69]

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as rc.exe, a legitimate Microsoft Resource Compiler.^{[34][70][71][35][72]}

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.^[73][74]

Waterbear has used DLL side loading to import and load a malicious DLL loader.^[13]

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.^[75][76]

ZeroT has used DLL side-loading to load malicious payloads.^[77][78]

When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.^[1]

Update software regularly to include patches that fix DLL side-loading vulnerabilities.