StingyBasilisk Uses COM Hijacking and Named-Pipe C2 to Hide Windows Malware
Summary
PT ESC IR describes StingyBasilisk, active since at least April 2022, using COM hijacking, Windows Time Providers, SMB lateral movement and named-pipe C2; its loaders capture network traffic and execute encrypted payloads in memory.
Key points
- PT ESC IR says it could not determine StingyBasilisk’s initial infection vector or reliably attribute the activity to a known APT group.
- The group used COM hijacking and Windows Time Providers to maintain persistence on compromised Windows hosts.
- SMB and Impacket’s atexec tool were used for lateral movement and remote scheduled-task execution.
- TediousLoader captures network traffic with raw sockets, identifies specially crafted packets, and uses their configuration to receive and execute encrypted payloads.
- CunningDoor was deployed through DLL sideloading; its payloads communicated through named pipes or, in one variant, an IP address and port.
- SilentCOM used COM proxying and named-pipe communication to load shellcode and receive further payloads.
- The investigators also describe HenMapCaCon, a Go DLL with a named-pipe server and a /fetch endpoint designed to retrieve files from compromised systems.
Article Details
- Attack Vectors
- Initial infection vector was not determined.
- The attackers used SMB to transfer malware to target hosts and Impacket's atexec to create and run scheduled tasks remotely through Windows Task Scheduler.
- Persistence was established through COM hijacking of Network List Manager and Network Configuration, and by registering malicious DLLs as Windows Time providers.
- CunningDoor was deployed using DLL sideloading, including rundll32.exe loading IKEYUI64.dll to trigger a malicious library.
- Malware captured network traffic with raw sockets and used specially crafted packets to configure communication and trigger payload loading.
- Malicious components used Windows named pipes to receive shellcode and communicate with other stages.
- HenMapCaCon included a /fetch endpoint designed to exfiltrate files from a compromised system.
- Defensive Notes
- Inspect COM TreatAs registry values for unexpected redirection of Network List Manager or Network Configuration, including malicious DLLs such as netprofmprox.dll.
- Review HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders for unexpected providers, DLL paths, or Enabled values.
- Monitor remote scheduled-task creation over SMB and the \pipe\atsvc named pipe; the observed task names followed a GUID-like pattern.
- Monitor for the described CunningDoor and SilentCOM named-pipe patterns and for the ChaCha20 initialization constant 71 20 2F 78 48 3F D9 14 48 B0 13 DA 02 32 46 88 in Windows process memory.
- Investigate rundll32.exe executions that load IKEYUI64.dll and inspect for related malicious DLLs and shellcode files.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesStingyBasilisk used SMB to transfer malware to target hosts during lateral movement.T1027 · Obfuscated Files or InformationThe malware concealed configuration and payloads using XOR operations and AES encryption before execution.T1040 · Network SniffingTediousLoader used raw sockets and promiscuous-mode capture to inspect network traffic on compromised hosts.T1041 · Exfiltration Over C2 ChannelHenMapCaCon's /fetch endpoint was described as designed to exfiltrate files from a compromised system.T1053.005 · Scheduled TaskThe attackers used atexec to create and immediately run scheduled tasks remotely through Windows Task Scheduler.T1105 · Ingress Tool TransferThe malware received additional code and payloads through network connections or Windows named pipes.T1218.011 · Rundll32The attackers ran rundll32.exe with IKEYUI64.dll and the ikeyUI_DlgSelectDeviceA export to launch the CunningDoor chain.T1546.015 · Component Object Model HijackingThe attackers modified COM TreatAs registry values to redirect Network List Manager and Network Configuration activation to malicious DLLs.T1547.003 · Time ProvidersThe attackers registered malicious DLLs as Windows Time providers so W32Time would load them at system startup.T1573.001 · Symmetric CryptographyThe described malware encrypted payloads or communications using AES and, for SilentCOM traffic, ChaCha20.T1574.002 · DLL Side-LoadingCunningDoor was launched through DLL sideloading, including use of the legitimate IKEYUI64.dll to load a malicious library.T1620 · Reflective Code LoadingThe loaders decrypted received shellcode and executed payloads in process memory.
Threat Actors
Malware
CunningDoorMalware in the group's arsenal: SilentCOM, TediousLoader, and CunningDoor.DLPReelIn another case, the attackers placed the legitimate, SafeNet-signed library eToken.dll on the host to load the malicious DLPReel.dll. All of the malicious logic was implemented in the exported REEL_Initialize function.HenMapCaConThe HenMapCaCon.dll dynamic-link library was written in Go and compiled with Go 1.18–1.19. It was built using cgo to provide compatibility with C interfaces. To hinder analysis, Go function names were stripped from theSilentCOMMalware in the group's arsenal: SilentCOM, TediousLoader, and CunningDoor.TediousLoaderMalware in the group's arsenal: SilentCOM, TediousLoader, and CunningDoor.
Products
Tools
atexecThey used SMB to transfer malware to specific directories on target hosts. To execute it, they used atexec, a tool in the Impacket suite that supports remote command execution through Windows Task Scheduler. The toolImpacket transfer malware to specific directories on target hosts. To execute it, they used atexec, a tool in the Impacket suite that supports remote command execution through Windows Task Scheduler. The tool connected to thePT DumperThe COM object inventory module in the PT Dumper utility is shown below: