Full Report
ResolverRAT targets healthcare organizations using advanced evasion techniques and social engineering
Analysis Summary
Here is the structured summary based on the provided context about ResolverRAT:
# Tool/Technique: ResolverRAT
## Overview
ResolverRAT is a newly observed Remote Access Trojan (RAT) designed to target organizations within the healthcare and pharmaceutical sectors globally. It employs multilayered evasion techniques and advanced in-memory execution to evade detection and analysis.
## Technical Details
- Type: Malware family (Remote Access Trojan - RAT)
- Platform: Windows (Inferred from DLL side-loading using standard executables like `hpreader.exe`)
- Capabilities: Remote access, data exfiltration, execution of payloads, complex evasion mechanisms.
- First Seen: Prior to April 14, 2025 (Date of article publication)
## MITRE ATT&CK Mapping (Inferred based on described capabilities)
- TA0001 - Initial Access
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (Inferred from use of attachments/links in email)
- TA0005 - Defense Evasion
- T1218 - Signed Binary Proxy Execution
- T1218.011 - DLL Side-loading
- TA0011 - Command and Control
- T1071 - Application Layer Protocol (Implied requirement for a RAT)
## Functionality
### Core Capabilities
- Initial access achieved via socially engineered phishing emails themed around copyright enforcement or legal inquiries, localized for specific countries.
- Utilizes **DLL side-loading** through vulnerable, **signed executables** (e.g., `hpreader.exe`) for initial execution and persistence setup.
- Executes the primary payload directly **in-memory**, complicating forensic analysis.
### Advanced Features
- **Layered Evasion Techniques:** Combines multiple methods to prevent static and dynamic analysis detection.
- Unique loader and payload architecture, distinct from previously known families like Rhadamanthys or Lumma, despite potential reuse of generic phishing infrastructure.
## Indicators of Compromise
- File Hashes: [Not specified in the context]
- File Names: `hpreader.exe` (Used as a vulnerable signed loader)
- Registry Keys: [Not specified in the context]
- Network Indicators: [Not specified in the context, implied C2 communication]
- Behavioral Indicators: Execution of reflective or in-memory code following the side-loading of a DLL into a legitimate signed process.
## Associated Threat Actors
- Specific threat actor groups were not named in the provided context, only that the operation appears globally coordinated. Prior campaigns reusing infrastructure were potentially linked to actors using Rhadamanthys.
## Detection Methods
- Signature-based detection: Will likely be weak due to in-memory execution and unique architecture.
- Behavioral detection: Crucial for detecting anomalous DLL loading into signed processes (`hpreader.exe`) and subsequent in-memory execution indicative of a RAT.
- YARA rules: [Not specified in the context]
## Mitigation Strategies
- User awareness training focused on identifying sophisticated, localized phishing lures regarding legal issues or copyright.
- Implement stricter controls over the execution of signed binaries, such as enforcing application allow-listing or monitoring suspicious child processes or memory regions associated with known sideload vulnerable executables.
- Endpoint Detection and Response (EDR) must prioritize monitoring memory modifications and injection techniques.
## Related Tools/Techniques
- Rhadamanthys (Malware family previously using `hpreader.exe` as a loader)
- Lumma (Mentioned in passing as another contemporary malware family)
- DLL Side-loading (The specific execution mechanism used)