Tool
Rundll32
- First Reported
- Nov 30, 2023
- Latest Reported
- Feb 8, 2024
Reported Context (2)
- The threat actor then uses Rundll32 to execute the patched “oci.dll” using this command: C:\Windows\System32\rundll32.exe %TEMP%\win_oci_41aa0d5.dll MainEntry. This patched “oci.dll” will extract “zar32.dll” and Zardoor Backdoor Used in Long-Running Espionage Campaign Against Saudi Nonprofit
- the JavaScript executes the batch script to run the dropped DLL loader by sideloading it with a copied rundll32. The DLL loader will decrypt the encrypted SugarGh0st payload in memory and run it reflectively. SugarGh0st RAT Campaign Targets Uzbekistan Government and South Korea
Malware (3)
People (6)
MITRE ATT&CK (25)
Vendors (1)
Products (11)
Tools (18)
Industries (2)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.