Fake Microsoft-Branded DUI70.dll Uses BITS to Relaunch a Backdoor

Summary

Analysis details a fake Microsoft-branded DUI70.dll, signed by an individual, that sideloads through CameraSettingsUIHost.exe and uses a failing BITS job to relaunch. The 14-command backdoor's C2 was not observed; its listed domains no longer resolved.

Key points

DUI70.dll claims to be a Microsoft component but was signed with a valid certificate issued to an individual, according to the analysis.
The DLL sideloads alongside the genuine CameraSettingsUIHost.exe and forwards its 86 functions to the real Windows DLL.
It creates a BITS job named PreSignInSettingsConfigJSON2 that requests a nonexistent resource at google[.]com; the job's failure triggers the host program to relaunch.
The analysis says the job may relaunch the program after a restart, but the researchers did not observe this across a restart.
The backdoor supports 14 commands, including file transfer, program execution, shell commands, and process management.
The DLL is configured to contact healthlys[.]com and four Azure App Service hostnames, but the sandbox did not observe C2 communication and none of the five names resolved when checked.
The article recommends reviewing BITS jobs for suspicious notification commands and checking public folders for named files associated with the sample.

Article Details

Attack Vectors: A malicious DUI70.dll is sideloaded beside the genuine CameraSettingsUIHost.exe in C:\Users\Public\Documents.
The DLL creates a BITS job with a notify command that relaunches the host program when the job fails, providing persistence.
The backdoor communicates with its C2 servers over HTTPS and supports remote shell commands, file upload and download, and program execution.
Defensive Notes: Inspect BITS jobs for PreSignInSettingsConfigJSON2 and for notify commands that launch programs outside C:\Windows.
Hunt in C:\Users\Public\Documents for DUI70.dll, umpdc.dll, CameraSettingsUIHost.exe, LockAppHost.exe, VersionInfo.txt, and Spagetti.txt.
Investigate HTTPS POST requests using the user agent WinHTTP Example/1.0 and paths under /market-api/.
Treat Windows components located outside C:\Windows, especially files claiming to be Microsoft products but signed by an individual, as suspicious.
The article recommends alerting on certificate serial 237DD9C69CE233B0CF24AA24AA803DA4.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`healthlys[.]com`	Reported C2 domain used by the backdoor.
HOSTNAME	`sync-endpoint-1[.]azurewebsites[.]net`	Reported Azure App Service hostname used as a fallback C2 endpoint.
HOSTNAME	`sync-endpoint-2[.]azurewebsites[.]net`	Reported Azure App Service hostname used as a fallback C2 endpoint.
HOSTNAME	`sync-endpoint-3[.]azurewebsites[.]net`	Reported Azure App Service hostname used as a fallback C2 endpoint.
HOSTNAME	`sync-endpoint[.]azurewebsites[.]net`	Reported Azure App Service hostname used as a fallback C2 endpoint.
SHA256	`adf0957559b8914b125ef263959f2882481df3b5dd0472888bf07e4e455a5d34`	SHA-256 hash of the malicious DUI70.dll sample.