Full Report
Forensic examination of a computer infected with a banking trojan
Analysis Summary
# Tool/Technique: DLL Search Order Hijacking (via TeamViewer)
## Overview
This technique involves placing a malicious Dynamic Link Library (DLL) with the same name as a legitimate system DLL into a directory where a trusted application resides. When the trusted application (in this case, a legitimate TeamViewer executable renamed or used as a launcher) is executed, the Windows operating system prioritizes loading the DLL from the application's local directory rather than the protected system folder, leading to the execution of malicious code under a legitimate process.
## Technical Details
- **Type:** Technique / Malware (Remote Access Trojan)
- **Platform:** Windows
- **Capabilities:** Persistence, Evasion (via signed binary proxying), Execution, Anti-Forensics.
- **First Seen:** [Not specified in article]
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.002 - Hijack Execution Flow: DLL Search Order Hijacking
- **TA0005 - Defense Evasion**
- T1036 - Masquerading
- T1574.002 - Hijack Execution Flow: DLL Search Order Hijacking
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
## Functionality
### Core Capabilities
- **DLL Hijacking:** Utilizes the legitimate `TeamViewer` binary (renamed or original) to load a malicious `msi.dll` located in the same local directory (`b7mg81`).
- **Persistence:** Establishes persistence by adding the malicious executable (`apg.exe`) to the Windows "Run" registry keys.
- **Remote Access:** Configured via `TeamViewer.ini` to function as a Remote Access Trojan (RAT), allowing attackers to control the infected system.
### Advanced Features
- **Anti-Forensics:** The `TeamViewer.ini` file was specifically modified to disable logging, preventing the creation of local audit trails of the attacker's activities.
- **Trusted Proxy:** By using a legitimate, signed TeamViewer binary to load the malware, the attack may bypass security software that trusts signed files.
## Indicators of Compromise
- **File Names:**
- `apg.exe` (Suspicious launcher, likely renamed TeamViewer binary)
- `msi.dll` (Malicious payload located in the application directory, not `System32`)
- `TeamViewer.ini` (Configuration file with logging disabled)
- **Registry Keys:**
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (containing entries for `apg.exe`)
- **Directory Paths:**
- `\b7mg81\` (Randomly named directory in the user profile)
- **Behavioral Indicators:**
- Execution of signed binaries from non-standard directories.
- Presence of system-named DLLs (like `msi.dll`) in user-writable application folders.
- `AppCompatCache` (Shimcache) entries showing the execution of `apg.exe` from a temporary or hidden directory.
## Associated Threat Actors
- **Banking Trojan Operators:** The article references a computer infected with a banking trojan, though the specific actor group is not named.
## Detection Methods
- **Signature-based detection:** Scanning for known malicious hashes of the non-system `msi.dll`.
- **Behavioral detection:** Monitoring for the loading of common system DLLs from non-standard, user-writable paths (DLL Search Order monitoring).
- **Forensic Analysis:** Utilizing tools like **PPEE** to inspect import tables of suspicious binaries and **RegRipper** to analyze `AppCompatCache` and `Run` keys.
## Mitigation Strategies
- **Prevention measures:** Implement application whitelisting (e.g., AppLocker or Windows Defender Application Control) to prevent execution from user-writable directories.
- **Hardening recommendations:** Use "Safe DLL Search Mode" (enabled by default in modern Windows, but still vulnerable if the malicious DLL is in the app folder).
- **Monitoring:** Enable auditing for Registry changes to "Run" keys and monitor process creation events (Event ID 4688).
## Related Tools/Techniques
- **FTK Imager:** Used for forensic image examination.
- **The Sleuth Kit (fls):** Used for file system analysis.
- **RegRipper:** Used for automated registry hive parsing.
- **DLL Side-Loading:** A closely related technique involving the use of Side-by-Side (WinSxS) manifests.