dmitry-matvienko/malware-analysis-fake-hwmonitorAnalisi tecnica, writeup e regole YARA per una campagna di DLL Sideloading mascherata da HWMonitor
⚠️ DISCLAIMER / ПРЕДУПРЕЖДЕНИЕ
This repository is created strictly for educational, defensive, and threat research purposes. It contains technical post-mortem analysis, Indicators of Compromise (IoCs), and defensive YARA signatures. No active malware binaries are distributed in this repository.
Questo repository documenta l'analisi tecnica di un kit multi-stadio di distribuzione malware camuffato da utility di diagnostica hardware CPUID HWMonitor (versione fittizia 6.77.7).
L'analisi dinamica in sandbox e i classificatori comportamentali (Tria.ge / Recorded Future) hanno confermato che il payload finale è (, Punteggio: ).
BLAKCSEE_STEALERIl reverse engineering ha verificato che la campagna utilizza:
GUP.exe).ntdll.dll.ReadFile, VirtualProtect).System.ServiceModel.dll) e un container payload cifrato da 93,8 MB (ProfilerTools.dll).flowchart TD
subgraph Stage1["1. Initial Access & Sideloading"]
Victim(["User executes downloaded file"]) --> Carrier["hwmonitor-...-6.77.7.exe<br/>(Legitimate Notepad++ GUP.exe)"]
Carrier -->|Auto-loads via Search Order| Loader["libcurl.dll<br/>(Malicious C++ Hook Loader)"]
end
subgraph Stage2["2. Evasion & Memory Hijacking"]
Loader --> CheckEnv{"Environment Check<br/>fcn.180005700"}
CheckEnv -->|Sandbox detected / Network isolated| ExitClean["Clean exit (Timeout 10s)"]
CheckEnv -->|Target host confirmed| StackXOR["Stack-String XOR Resolution<br/>('ReadFile' via 0x180005cf0)"]
StackXOR --> IATHook["Patch Host IAT table<br/>(ntdll.dll via fcn.180009ac0)"]
end
subgraph Stage3["3. Payload Delivery & Ballast"]
IATHook --> ReadBox["Read & decrypt in memory"]
ReadBox --> SafeBox["ProfilerTools.dll (93.8 MB)<br/>Ciphertext Container (Entropy 8.0)"]
SafeBox --> StealerRAM["Decrypted Infostealer in RAM<br/>(RedLine / Lumma / Vidar)"]
Carrier -.->|Ignored by loader| Ballast["ui_framework.dll (16.5 MB)<br/>Clean Microsoft WCF Ballast"]
Carrier -.->|Ignored by loader| Decoy["config.txt (Decoy GitHub links)"]
end| File | Description |
|---|---|
malware_analysis_report_en.txt | Report tecnico completo di reverse engineering in 9 fasi (Inglese). |
malware_analysis_report.txt | Полный подробный отчет о реверс-инжиниринге и методологии (Русский). |
rules_hwmonitor_sideload_en.yar | Ruleset YARA pronto per la produzione con descrizioni e metadati in inglese. |
rules_hwmonitor_sideload.yar | Комплект сигнатур YARA с русскими комментариями. |
hwmonitor-windows-github-io-6.77.7.exe (Carrier)GUP.exe).b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351libcurl.dll without triggering static executable heuristics.libcurl.dll (Loader & IAT Hooker)22a6cea4d2069935a7c621b9a96ba82d46a2d058dffca4d11917721c63ae341akernel32.dll).ReadFile:
(0x23 + 0x07) ^ 0x78 = 'R' (0x52)
(0x23 + 0x26) ^ 0x2c = 'e' (0x65)
(0x23 + 0x45) ^ 0x09 = 'a' (0x61)
(0x23 + 0x64) ^ 0xe3 = 'd' (0x64)
(0x23 - 0x7d) ^ 0xe0 = 'F' (0x46)
(0x23 - 0x5e) ^ 0xac = 'i' (0x69)
(0x23 - 0x3f) ^ 0x88 = 'l' (0x6c)
(0x23 - 0x20) ^ 0x66 = 'e' (0x65)
ProfilerTools.dll (Encrypted Payload Container)8.00 (Dense ciphertext, Non-PE).5B 28 B3 C0 5A 13 73 1F 1A B0 0A A9 53 3C 16 72242e5a415c7efb1f86b408e238d24835c72836f1e8e2439b0a6713e0b1f8d638133710d5b04ef72c22c48b43d0ad39afui_framework.dll (Inflation Ballast)System.ServiceModel.dll (WCF Framework v4.8.3928.0).(Heur) Malware: Stealer by static scanners due to legitimate WCF security token class names. Serves purely as file-pumping ballast.| Tactic | Technique ID | Technique Name |
|---|---|---|
| Defense Evasion | T1574.002 | Hijack Execution Flow: DLL Side-Loading |
| Defense Evasion | T1027.001 | Binary Padding (Binary Inflation / File Pumping) |
| Defense Evasion | T1027 | Obfuscated Files or Information (Stack Strings XOR) |
| Defense Evasion | T1497 | Virtualization/Sandbox Evasion (GetSystemInfo checks) |
| Persistence / Execution | T1055 | Process Injection: IAT Hooking |
| Command and Control | T1568.002 | Dynamic Resolution: Domain Generation Algorithms (DGA) |
# SHA-256 Hashes
64e602e1c744da32c53b5761fa7b15dba72023df0176cc03a48c0c0bb52f2c37 Desktop.7z (Parent Delivery Archive / Tria.ge Sample)
b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351 hwmonitor-windows-github-io-6.77.7.exe (GUP.exe)
22a6cea4d2069935a7c621b9a96ba82d46a2d058dffca4d11917721c63ae341a libcurl.dll (Malicious Loader)
242e5a415c7efb1f86b408e238d24835c72836f1e8e2439b0a6713e0b1f8d638 ProfilerTools.dll (Encrypted Container)
# MD5 Hashes
7744ed6fac4775706938298f9cb5ba0d hwmonitor-windows-github-io-6.77.7.exe
866da3588ceacbb854f95f6d581ca464 libcurl.dll
133710d5b04ef72c22c48b43d0ad39af ProfilerTools.dll
# Magic Header (Offset 0x0)
5B 28 B3 C0 5A 13 73 1F 1A B0 0A A9 53 3C 16 72 ProfilerTools.dll
Per scansionare directory o file alla ricerca di questa campagna, utilizzare lo strumento ufficiale YARA CLI:
# Scan a specific directory recursively
yara64 -r rules_hwmonitor_sideload_en.yar /path/to/target/folder