Procedure examples

Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).

Nebulae can use DLL side-loading to gain execution.

ROAMINGHOUSE can use a legitimate EXE to sideload a malicious DLL named JSFC.dll. ROAMINGHOUSE has also used ScnCfg32.exe to sideload vsodscpl.dll to enable UPPERCUT execution.

TONESHELL has abused legitimate executables to side-load malicious DLLs. TONESHELL has also been loaded via DLL side-loading, using legitimate, signed executables to include: FastVD.exe, Bandizip.exe and gpgconf.exe.

RainyDay can use side-loading to run malicious executables.

Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.

BOOKWORM has used DLL side-loading to execute the malicious payload. BOOKWORM has also side-loaded DLL components into a legitimate process, including Microsoft Malware Protection `MsMpEng.exe` and Kaspersky Anti-Virus `ushata.exe`.

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.

PUBLOAD has abused legitimate executables to side-load malicious DLLs.

CANONSTAGER has abused legitimate executables to side-load malicious DLLs.

LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.

WastedLocker has performed DLL hijacking before execution.

InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.

CLAIMLOADER has used a legitimately signed executable to execute a malicious payload within a DLL file.

ZeroT has used DLL side-loading to load malicious payloads.

Raspberry Robin can use legitimate, signed EXE files paired with malicious DLL files to load and run malicious payloads while bypassing defenses.

HUI Loader can be deployed to targeted systems via legitimate programs that are vulnerable to DLL search order hijacking.

BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.

SplatDropper has leveraged legitimate binaries to conduct DLL side-loading.

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.

DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

NOOPLDR can be executed via sideloading.

Lumma Stealer has leveraged legitimate applications to then side-load malicious DLLs during execution.

Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.

DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.

Chaes has used search order hijacking to load a malicious DLL.

LODEINFO can use legitimate EXE files to sideload malicious DLLs.

Metamorfo has side-loaded its malicious DLL file.

During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.

A gh0st RAT variant has used DLL side-loading.

Kerrdown can use DLL side-loading to load malicious DLLs.

Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.

Hikit has used DLL to load oci.dll as a persistence mechanism.

StrelaStealer has sideloaded a DLL payload using a renamed, legitimate `msinfo32.exe` executable.

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.

CorKLOG has leveraged legitimate binaries to conduct DLL side-loading.

Pandora can use DLL side-loading to execute malicious payloads.

FinFisher uses DLL side-loading to load malicious programs. A FinFisher variant also uses DLL search order hijacking.

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

AshTag has enabled execution via DLL sideloading using a legitimate executable paired with a malicious DLL named wtsapi32.

SysUpdate can load DLLs through vulnerable legitimate executables.

PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.

ANELLDR can use DLL sideloading from a legitimate application to initiate execution.

LookBack side loads its communications module as a DLL into the libcurl.dll loader.

Egregor has used DLL side-loading to execute its payload.

Melcoz can use DLL hijacking to bypass security controls.