Full Report
An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into&
Analysis Summary
# Tool/Technique: SLEEPWALKER
## Overview
SLEEPWALKER is a sophisticated, passive Windows backdoor designed for high-stealth operations. It remains inert in memory, making no outbound connections, and only activates upon receiving a specifically crafted "trigger" network packet. Once activated, it executes commands via a proprietary 23-instruction language (bytecode), allowing an attacker to perform post-compromise activities without leaving a traditional network footprint.
## Technical Details
- **Type:** Malware family (Passive Backdoor)
- **Platform:** Windows (64-bit)
- **Capabilities:** Custom bytecode execution, passive network sniffing, multi-transport communication (TCP, UDP, ICMP, SMB, VMCI), memory-only execution.
- **First Seen:** Reported August 26, 2026.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Custom Bytecode)
- T1112 - Modify Registry
- T1620 - Reflective Code Loading
- **TA0008 - Lateral Movement**
- T1021.002 - Remote Services: SMB/Windows Admin Shares
- **TA0011 - Command and Control**
- T1205 - Traffic Signaling (Port Knocking/Passive Triggering)
- T1095 - Non-Application Layer Protocol (ICMP/VMCI)
## Functionality
### Core Capabilities
- **Passive Triggering:** Operates as a "listener" on network interfaces, capturing all traffic (promiscuous mode) to identify a specific trigger packet before acting.
- **Custom Instruction Set:** Utilizes a unique 23-instruction language for command execution, making analysis difficult as the opcodes do not follow standard formats.
- **DLL Side-Loading:** Specifically designed to be loaded by `ERAAgent.exe` (ESET Management Agent) by impersonating the legitimate `dpapi.dll`.
- **Memory-Resident Execution:** Designed to run code directly in memory to avoid disk-based detection forensics.
### Advanced Features
- **Multi-Transport Support:** Can communicate over TCP, UDP, ICMP, and SMB named pipes.
- **VMCI Integration:** Supports VMware’s Virtual Machine Communication Interface (VMCI) to communicate between guest VMs and hosts, bypassing traditional virtual switches and network firewalls.
- **Stealth via Impersonation:** Carries version resources and exports identical to the genuine Microsoft `dpapi.dll` and ESET Management Agent components.
- **Promiscuous Mode Sniffing:** Can capture traffic intended for other machines if situated on a gateway or bridge.
## Indicators of Compromise
- **File Hashes:**
- *Note: Specific SHA256 was not provided in the text summary, but the file size is 59,904 bytes (64-bit DLL).*
- **File Names:** `dpapi.dll` (located in the same directory as `ERAAgent.exe`).
- **Registry Keys:**
- `HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters\EveryoneIncludesAnonymous` (Set to 1)
- `HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes` (Appends malicious pipe name).
- **Network Indicators:**
- Use of VMware VMCI sockets for C2.
- Presence of unauthenticated SMB Named Pipes.
- **Behavioral Indicators:** `ERAAgent.exe` loading an unsigned `dpapi.dll`; network interface entering promiscuous mode unexpectedly.
## Associated Threat Actors
- **Unknown:** Currently unattributed, though researchers note the complexity is consistent with a "targeted, well-resourced operation."
- **Related Patterns:** Similar side-loading techniques have been used by **ToddyCat** and **UNC3886** (specifically VMCI usage).
## Detection Methods
- **Signature-Based:** Scan for unsigned DLLs named `dpapi.dll` residing in non-system directories, particularly within ESET installation folders.
- **Behavioral Detection:** Monitor for modifications to `NullSessionPipes` registry keys and monitor for `ERAAgent.exe` initiating unusual raw socket or VMCI activity.
- **Memory Forensics:** Scan process memory for the 23-instruction interpreter engine or AES-256-CCM encrypted configuration blocks.
## Mitigation Strategies
- **Endpoint Hardening:** Restrict administrative privileges to prevent the placement of side-loading DLLs in application directories.
- **Integrity Checks:** Implement Application Control/Allowlisting (e.g., AppLocker or Windows Defender Application Control) to block the execution of unsigned DLLs.
- **Network Segmentation:** Limit the use of VMCI where not strictly necessary and monitor for unexpected SMB Null Session activity.
## Related Tools/Techniques
- **DLL Side-loading:** A common technique used by various APTs to bypass security software.
- **Port Knocking:** Similar concept to the "Passive Trigger" mechanism.
- **VMCI Sockets:** Previously documented in use by **UNC3886** for guest-to-host persistence.