{ "id": "37c9c23e-5b26-4f48-8e1e-1de1c97d2153", "created_at": "2026-04-06T01:31:03.412867Z", "updated_at": "2026-04-10T03:38:20.534538Z", "deleted_at": null, "sha1_hash": "bc909ac5fd12d45863c589e1fdf531ffb09ab553", "title": "Lazarus Group Uses the DLL Side-Loading Technique (mi.dll)", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1441527, "plain_text": "Lazarus Group Uses the DLL Side-Loading Technique (mi.dll)\r\nBy ATCP\r\nPublished: 2022-10-05 · Archived: 2026-04-06 01:22:35 UTC\r\nWhile tracking the Lazarus attack group, the ASEC analysis team discovered that the attackers were using the\r\nDLL Side-Loading attack technique (T1574.002) by abusing legitimate applications in the initial compromise\r\nstage to achieve the next stage of their attack process.\r\nhttps://attack.mitre.org/techniques/T1574/002/\r\nThe DLL Side-Loading attack technique saves a legitimate application and a malicious DLL in the same folder\r\npath to enable the malicious DLL to also be executed when the application is run. In other words, it is a malware\r\nexecution technique that allows the malicious DLL to be executed first by changing its name to the filename of the\r\nnormal DLL located in a different path that the legitimate program refers to.\r\nThe list of legitimate processes abused by the Lazarus group is as follows. wsmprovhost.exe and dfrgui.exe are all\r\nnormal MS files.\r\nwsmprovhost.exe (Host process for WinRM plug-ins)\r\ndfrgui.exe (Microsoft Drive Optimizer)\r\nAccording to AhnLab’s ASD (AhnLab Smart Defense) infrastructure, the attackers used an old version of the\r\nInitech process (inisafecrosswebexsvc.exe) through which they distributed the backdoor malware (scskapplink.dll)\r\nhttps://asec.ahnlab.com/en/39828/\r\nPage 1 of 4\n\nused for the initial compromise.\r\nAfterward, it is likely that the executed backdoor malware created wsmprovhost.exe and executed an additional\r\nDLL Side-Loading payload. The grounds for the suspected use of the DLL Side-Loading technique lie in the fact\r\nthat an additional malicious DLL named “mi.dll” was found in the folder path where wsmprovhost.exe was\r\ncreated in the infected PCs. The following is the file path information of mi.dll that was in the same path as\r\nwsmprovhost.exe.\r\nC:\\ProgramData\\Microsoft\\IdentityCRL\\mi.dll\r\nC:\\ProgramData\\Microsoft\\IdentityCRL\\wsmprovhost.exe\r\nC:\\ProgramData\\USOShared\\mi.dll\r\nC:\\ProgramData\\USOShared\\wsmprovhost.exe\r\nC:\\ProgramData\\midassoft\\mi.dll\r\nC:\\ProgramData\\midassoft\\wsmprovhost.exe\r\nmi.dll is a DLL referenced by wsmprovhost.exe (See Figure 3). Thus, when wsmprovhost.exe is run, mi.dll is\r\nloaded in the corresponding process memory.\r\nmi.dll, a normal MS file, exists in the path “c:\\windows\\system32”, but the mi.dll used in this attack was found\r\nnot in the Windows system path but in another path alongside wsmprovhost.exe. The attackers included the\r\nmalware in the BugTrap project source code, an open source code on github, to distribute it under the name\r\n“mi.dll”.\r\nhttps://asec.ahnlab.com/en/39828/\r\nPage 2 of 4\n\nThe malicious mi.dll that is executed in the process memory of wsmprovhost.exe includes an additional binary\r\nencrypted internally with the AES-128 algorithm, and the moment it is executed, it uses the decryption key\r\ntransmitted via an argument to decrypt the binary before running an additional malware in the memory.\r\nIt has also been identified that the Lazarus group not only executed malware through wsmprovhost.exe but also\r\nother normal Windows programs such as dfrgui.exe. Using a DLL that is run in a normal process memory area to\r\nperform malicious acts is deemed to be an attempt to bypass the behavior detection of security software.\r\nRecently, the Lazarus group has been using various attack methods, using not only rootkit to disable security\r\nsoftware but also performing malicious acts using normal application software as shown in this report to achieve\r\ntheir attack goals. AhnLab is closely watching and responding to this group’s attack methods and also detecting\r\nthe current type of attack using the following aliases.\r\n[Filename, MD5, Detection Name)\r\n– SCSKAppLink.dll (0cc73994988e8dce2a2eeab7bd410fad) Trojan/Win.Lazardoor.C5266363 (2022.09.30.03)\r\n– mi.dll (54b0454163b25a38368e518e1687de5b) – Trojan/Win.LazarLoader.C5226517 (2022.08.22.02)\r\n– dfgui.exe (9caebeda61018e86a29c291225f0319f) – Normal MS file\r\n– wsmprovhost.exe (ff46decb93c6d676a37e87de57bae196) – Normal MS file\r\n[Behavior Detection]\r\n– InitialAccess/MDP.Event.M4242 (2022.09.21.00)\r\nhttps://asec.ahnlab.com/en/39828/\r\nPage 3 of 4\n\nMD5\r\n0cc73994988e8dce2a2eeab7bd410fad\r\n54b0454163b25a38368e518e1687de5b\r\n9caebeda61018e86a29c291225f0319f\r\nff46decb93c6d676a37e87de57bae196\r\nAdditional IOCs are available on AhnLab TIP.\r\nGain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click\r\nthe banner below.\r\nSource: https://asec.ahnlab.com/en/39828/\r\nhttps://asec.ahnlab.com/en/39828/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "references": [ "https://asec.ahnlab.com/en/39828/" ], "report_names": [ "39828" ], "threat_actors": [ { "id": "34eea331-d052-4096-ae03-a22f1d090bd4", "created_at": "2025-08-07T02:03:25.073494Z", "updated_at": "2026-04-10T02:00:03.709243Z", "deleted_at": null, "main_name": "NICKEL ACADEMY", "aliases": [ "ATK3 ", "Black Artemis ", "COVELLITE ", "CTG-2460 ", "Citrine Sleet ", "Diamond Sleet ", "Guardians of Peace", "HIDDEN COBRA ", "High Anonymous", "Labyrinth Chollima ", "Lazarus Group ", "NNPT Group", "New Romanic Cyber Army Team", "Temp.Hermit ", "UNC577 ", "Who Am I?", "Whois Team", "ZINC " ], "source_name": "Secureworks:NICKEL ACADEMY", "tools": [ "Destover", "KorHigh", "Volgmer" ], "source_id": "Secureworks", "reports": null }, { "id": "732597b1-40a8-474c-88cc-eb8a421c29f1", "created_at": "2025-08-07T02:03:25.087732Z", "updated_at": "2026-04-10T02:00:03.776007Z", "deleted_at": null, "main_name": "NICKEL GLADSTONE", "aliases": [ "APT38 ", "ATK 117 ", "Alluring Pisces ", "Black Alicanto ", "Bluenoroff ", "CTG-6459 ", "Citrine Sleet ", "HIDDEN COBRA ", "Lazarus Group", "Sapphire Sleet ", "Selective Pisces ", "Stardust Chollima ", "T-APT-15 ", "TA444 ", "TAG-71 " ], "source_name": "Secureworks:NICKEL GLADSTONE", "tools": [ "AlphaNC", "Bankshot", "CCGC_Proxy", "Ratankba", "RustBucket", "SUGARLOADER", "SwiftLoader", "Wcry" ], "source_id": "Secureworks", "reports": null }, { "id": "a2b92056-9378-4749-926b-7e10c4500dac", "created_at": "2023-01-06T13:46:38.430595Z", "updated_at": "2026-04-10T02:00:02.971571Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Operation DarkSeoul", "Bureau 121", "Group 77", "APT38", "NICKEL GLADSTONE", "G0082", "COPERNICIUM", "Moonstone Sleet", "Operation GhostSecret", "APT 38", "Appleworm", "Unit 121", "ATK3", "G0032", "ATK117", "NewRomanic Cyber Army Team", "Nickel Academy", "Sapphire Sleet", "Lazarus group", "Hastati Group", "Subgroup: Bluenoroff", "Operation Troy", "Black Artemis", "Dark Seoul", "Andariel", "Labyrinth Chollima", "Operation AppleJeus", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Hidden Cobra", "Bluenoroff", "Stardust Chollima", "Whois Hacking Team", "Diamond Sleet", "TA404", "BeagleBoyz", "APT-C-26" ], "source_name": "MISPGALAXY:Lazarus Group", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "32a223a8-3c79-4146-87c5-8557d38662ae", "created_at": "2022-10-25T15:50:23.703698Z", "updated_at": "2026-04-10T02:00:05.261989Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Lazarus Group", "Labyrinth Chollima", "HIDDEN COBRA", "Guardians of Peace", "NICKEL ACADEMY", "Diamond Sleet" ], "source_name": "MITRE:Lazarus Group", "tools": [ "RawDisk", "Proxysvc", "BADCALL", "FALLCHILL", "WannaCry", "MagicRAT", "HOPLIGHT", "TYPEFRAME", "Dtrack", "HotCroissant", "HARDRAIN", "Dacls", "KEYMARBLE", "TAINTEDSCRIBE", "AuditCred", "netsh", "ECCENTRICBANDWAGON", "AppleJeus", "BLINDINGCAN", "ThreatNeedle", "Volgmer", "Cryptoistic", "RATANKBA", "Bankshot" ], "source_id": "MITRE", "reports": null }, { "id": "f32df445-9fb4-4234-99e0-3561f6498e4e", "created_at": "2022-10-25T16:07:23.756373Z", "updated_at": "2026-04-10T02:00:04.739611Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "APT-C-26", "ATK 3", "Appleworm", "Citrine Sleet", "DEV-0139", "Diamond Sleet", "G0032", "Gleaming Pisces", "Gods Apostles", "Gods Disciples", "Group 77", "Guardians of Peace", "Hastati Group", "Hidden Cobra", "ITG03", "Jade Sleet", "Labyrinth Chollima", "Lazarus Group", "NewRomanic Cyber Army Team", "Operation 99", "Operation AppleJeus", "Operation AppleJeus sequel", "Operation Blockbuster: Breach of Sony Pictures Entertainment", "Operation CryptoCore", "Operation Dream Job", "Operation Dream Magic", "Operation Flame", "Operation GhostSecret", "Operation In(ter)caption", "Operation LolZarus", "Operation Marstech Mayhem", "Operation No Pineapple!", "Operation North Star", "Operation Phantom Circuit", "Operation Sharpshooter", "Operation SyncHole", "Operation Ten Days of Rain / DarkSeoul", "Operation Troy", "SectorA01", "Slow Pisces", "TA404", "TraderTraitor", "UNC2970", "UNC4034", "UNC4736", "UNC4899", "UNC577", "Whois Hacking Team" ], "source_name": "ETDA:Lazarus Group", "tools": [ "3CX Backdoor", "3Rat Client", "3proxy", "AIRDRY", "ARTFULPIE", "ATMDtrack", "AlphaNC", "Alreay", "Andaratm", "AngryRebel", "AppleJeus", "Aryan", "AuditCred", "BADCALL", "BISTROMATH", "BLINDINGCAN", "BTC Changer", "BUFFETLINE", "BanSwift", "Bankshot", "Bitrep", "Bitsran", "BlindToad", "Bookcode", "BootWreck", "BottomLoader", "Brambul", "BravoNC", "Breut", "COLDCAT", "COPPERHEDGE", "CROWDEDFLOUNDER", "Castov", "CheeseTray", "CleanToad", "ClientTraficForwarder", "CollectionRAT", "Concealment Troy", "Contopee", "CookieTime", "Cyruslish", "DAVESHELL", "DBLL Dropper", "DLRAT", "DRATzarus", "DRATzarus RAT", "Dacls", "Dacls RAT", "DarkComet", "DarkKomet", "DeltaCharlie", "DeltaNC", "Dembr", "Destover", "DoublePulsar", "Dozer", "Dtrack", "Duuzer", "DyePack", "ECCENTRICBANDWAGON", "ELECTRICFISH", "Escad", "EternalBlue", "FALLCHILL", "FYNLOS", "FallChill RAT", "Farfli", "Fimlis", "FoggyBrass", "FudModule", "Fynloski", "Gh0st RAT", "Ghost RAT", "Gopuram", "HARDRAIN", "HIDDEN COBRA RAT/Worm", "HLOADER", "HOOKSHOT", "HOPLIGHT", "HOTCROISSANT", "HOTWAX", "HTTP Troy", "Hawup", "Hawup RAT", "Hermes", "HotCroissant", "HotelAlfa", "Hotwax", "HtDnDownLoader", "Http Dr0pper", "ICONICSTEALER", "Joanap", "Jokra", "KANDYKORN", "KEYMARBLE", "Kaos", "KillDisk", "KillMBR", "Koredos", "Krademok", "LIGHTSHIFT", "LIGHTSHOW", "LOLBAS", "LOLBins", "Lazarus", "LightlessCan", "Living off the Land", "MATA", "MBRkiller", "MagicRAT", "Manuscrypt", "Mimail", "Mimikatz", "Moudour", "Mydoom", "Mydoor", "Mytob", "NACHOCHEESE", "NachoCheese", "NestEgg", "NickelLoader", "NineRAT", "Novarg", "NukeSped", "OpBlockBuster", "PCRat", "PEBBLEDASH", "PLANKWALK", "POOLRAT", "PSLogger", "PhanDoor", "Plink", "PondRAT", "PowerBrace", "PowerRatankba", "PowerShell RAT", "PowerSpritz", "PowerTask", "Preft", "ProcDump", "Proxysvc", "PuTTY Link", "QUICKRIDE", "QUICKRIDE.POWER", "Quickcafe", "QuiteRAT", "R-C1", "ROptimizer", "Ratabanka", "RatabankaPOS", "Ratankba", "RatankbaPOS", "RawDisk", "RedShawl", "Rifdoor", "Rising Sun", "Romeo-CoreOne", "RomeoAlfa", "RomeoBravo", "RomeoCharlie", "RomeoCore", "RomeoDelta", "RomeoEcho", "RomeoFoxtrot", "RomeoGolf", "RomeoHotel", "RomeoMike", "RomeoNovember", "RomeoWhiskey", "Romeos", "RustBucket", "SHADYCAT", "SHARPKNOT", "SIGFLIP", "SIMPLESEA", "SLICKSHOES", "SORRYBRUTE", "SUDDENICON", "SUGARLOADER", "SheepRAT", "SierraAlfa", "SierraBravo", "SierraCharlie", "SierraJuliett-MikeOne", "SierraJuliett-MikeTwo", "SimpleTea", "SimplexTea", "SmallTiger", "Stunnel", "TAINTEDSCRIBE", "TAXHAUL", "TFlower", "TOUCHKEY", "TOUCHMOVE", "TOUCHSHIFT", "TOUCHSHOT", "TWOPENCE", "TYPEFRAME", "Tdrop", "Tdrop2", "ThreatNeedle", "Tiger RAT", "TigerRAT", "Trojan Manuscript", "Troy", "TroyRAT", "VEILEDSIGNAL", "VHD", "VHD Ransomware", "VIVACIOUSGIFT", "VSingle", "ValeforBeta", "Volgmer", "Vyveva", "W1_RAT", "Wana Decrypt0r", "WanaCry", "WanaCrypt", "WanaCrypt0r", "WannaCry", "WannaCrypt", "WannaCryptor", "WbBot", "Wcry", "Win32/KillDisk.NBB", "Win32/KillDisk.NBC", "Win32/KillDisk.NBD", "Win32/KillDisk.NBH", "Win32/KillDisk.NBI", "WinorDLL64", "Winsec", "WolfRAT", "Wormhole", "YamaBot", "Yort", "ZetaNile", "concealment_troy", "http_troy", "httpdr0pper", "httpdropper", "klovbot", "sRDI" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775439063, "ts_updated_at": 1775792300, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/bc909ac5fd12d45863c589e1fdf531ffb09ab553.pdf", "text": "https://archive.orkl.eu/bc909ac5fd12d45863c589e1fdf531ffb09ab553.txt", "img": "https://archive.orkl.eu/bc909ac5fd12d45863c589e1fdf531ffb09ab553.jpg" } }