dmitry-matvienko/malware-analysis-fake-hwmonitorTechnical analysis, writeup, and YARA rules for a DLL Sideloading campaign disguised as HWMonitor
⚠️ DISCLAIMER / ПРЕДУПРЕЖДЕНИЕ
This repository is created strictly for educational, defensive, and threat research purposes. It contains technical post-mortem analysis, Indicators of Compromise (IoCs), and defensive YARA signatures. No active malware binaries are distributed in this repository.
This repository documents the technical dissection of a multi-stage malware delivery kit masquerading as the hardware diagnostic utility CPUID HWMonitor (fictitious version 6.77.7).
Dynamic sandbox analysis and behavioral classifiers (Tria.ge / Recorded Future) confirmed the final payload as Blakcsee Stealer (, Score: ).
BLAKCSEE_STEALERReverse engineering verified that the campaign utilizes:
GUP.exe).ntdll.dll.ReadFile, VirtualProtect).System.ServiceModel.dll) and an encrypted 93.8 MB payload container (ProfilerTools.dll).flowchart TD
subgraph Stage1["1. Initial Access & Sideloading"]
Victim(["User executes downloaded file"]) --> Carrier["hwmonitor-...-6.77.7.exe<br/>(Legitimate Notepad++ GUP.exe)"]
Carrier -->|Auto-loads via Search Order| Loader["libcurl.dll<br/>(Malicious C++ Hook Loader)"]
end
subgraph Stage2["2. Evasion & Memory Hijacking"]
Loader --> CheckEnv{"Environment Check<br/>fcn.180005700"}
CheckEnv -->|Sandbox detected / Network isolated| ExitClean["Clean exit (Timeout 10s)"]
CheckEnv -->|Target host confirmed| StackXOR["Stack-String XOR Resolution<br/>('ReadFile' via 0x180005cf0)"]
StackXOR --> IATHook["Patch Host IAT table<br/>(ntdll.dll via fcn.180009ac0)"]
end
subgraph Stage3["3. Payload Delivery & Ballast"]
IATHook --> ReadBox["Read & decrypt in memory"]
ReadBox --> SafeBox["ProfilerTools.dll (93.8 MB)<br/>Ciphertext Container (Entropy 8.0)"]
SafeBox --> StealerRAM["Decrypted Infostealer in RAM<br/>(RedLine / Lumma / Vidar)"]
Carrier -.->|Ignored by loader| Ballast["ui_framework.dll (16.5 MB)<br/>Clean Microsoft WCF Ballast"]
Carrier -.->|Ignored by loader| Decoy["config.txt (Decoy GitHub links)"]
end| File | Description |
|---|---|
malware_analysis_report_en.txt | Comprehensive 9-stage technical reverse-engineering report (English). |
malware_analysis_report.txt | Полный подробный отчет о реверс-инжиниринге и методологии (Русский). |
rules_hwmonitor_sideload_en.yar | Production-ready YARA ruleset with English descriptions and metadata. |
rules_hwmonitor_sideload.yar | Комплект сигнатур YARA с русскими комментариями. |
hwmonitor-windows-github-io-6.77.7.exe (Carrier)GUP.exe).b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351libcurl.dll without triggering static executable heuristics.libcurl.dll (Loader & IAT Hooker)22a6cea4d2069935a7c621b9a96ba82d46a2d058dffca4d11917721c63ae341akernel32.dll).ReadFile:
(0x23 + 0x07) ^ 0x78 = 'R' (0x52)
(0x23 + 0x26) ^ 0x2c = 'e' (0x65)
(0x23 + 0x45) ^ 0x09 = 'a' (0x61)
(0x23 + 0x64) ^ 0xe3 = 'd' (0x64)
(0x23 - 0x7d) ^ 0xe0 = 'F' (0x46)
(0x23 - 0x5e) ^ 0xac = 'i' (0x69)
(0x23 - 0x3f) ^ 0x88 = 'l' (0x6c)
(0x23 - 0x20) ^ 0x66 = 'e' (0x65)
ProfilerTools.dll (Encrypted Payload Container)8.00 (Dense ciphertext, Non-PE).5B 28 B3 C0 5A 13 73 1F 1A B0 0A A9 53 3C 16 72242e5a415c7efb1f86b408e238d24835c72836f1e8e2439b0a6713e0b1f8d638133710d5b04ef72c22c48b43d0ad39afui_framework.dll (Inflation Ballast)System.ServiceModel.dll (WCF Framework v4.8.3928.0).(Heur) Malware: Stealer by static scanners due to legitimate WCF security token class names. Serves purely as file-pumping ballast.| Tactic | Technique ID | Technique Name |
|---|---|---|
| Defense Evasion | T1574.002 | Hijack Execution Flow: DLL Side-Loading |
| Defense Evasion | T1027.001 | Binary Padding (Binary Inflation / File Pumping) |
| Defense Evasion | T1027 | Obfuscated Files or Information (Stack Strings XOR) |
| Defense Evasion | T1497 | Virtualization/Sandbox Evasion (GetSystemInfo checks) |
| Persistence / Execution | T1055 | Process Injection: IAT Hooking |
| Command and Control | T1568.002 | Dynamic Resolution: Domain Generation Algorithms (DGA) |
# SHA-256 Hashes
64e602e1c744da32c53b5761fa7b15dba72023df0176cc03a48c0c0bb52f2c37 Desktop.7z (Parent Delivery Archive / Tria.ge Sample)
b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351 hwmonitor-windows-github-io-6.77.7.exe (GUP.exe)
22a6cea4d2069935a7c621b9a96ba82d46a2d058dffca4d11917721c63ae341a libcurl.dll (Malicious Loader)
242e5a415c7efb1f86b408e238d24835c72836f1e8e2439b0a6713e0b1f8d638 ProfilerTools.dll (Encrypted Container)
# MD5 Hashes
7744ed6fac4775706938298f9cb5ba0d hwmonitor-windows-github-io-6.77.7.exe
866da3588ceacbb854f95f6d581ca464 libcurl.dll
133710d5b04ef72c22c48b43d0ad39af ProfilerTools.dll
# Magic Header (Offset 0x0)
5B 28 B3 C0 5A 13 73 1F 1A B0 0A A9 53 3C 16 72 ProfilerTools.dll
To scan directories or files for this campaign, use the official YARA CLI tool:
# Scan a specific directory recursively
yara64 -r rules_hwmonitor_sideload_en.yar /path/to/target/folder