malware

BOOSTWRITE S0415

Type: malware
Platform: Windows
Created: 11 October 2019
Last modified: 11 April 2024

BOOSTWRITE is a loader crafted to be launched via abuse of the DLL search order of applications used by FIN7.[1]

TechniquesBottom 23%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

BOOSTWRITE MITRE reference S0415

Encrypted/Encoded File T1027.013 ↗

BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.2

Stealth1 detection rules

Shared Modules T1129 ↗

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.3

Execution8 detection rules

Deobfuscate/Decode Files or Information T1140 ↗

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.4

Stealth20 detection rules

Code Signing T1553.002 ↗

BOOSTWRITE has been signed by a valid CA.5

Defense Impairment1 detection rules

DLL T1574.001 ↗

BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.6

Execution · Stealth112 detection rules

Standing S0415

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques5Bottom 23%

23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique8medBottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique4med28th pct

28th percentile · 72% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 5 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 113Splunk ESCU (cumulative) · 28

Standing S0415

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2020-7315	medium	Nasreddine Bencherchali (Nextron Systems), fornotes	2022-12-01	2026-01-24	df6ecb8b-7822-4f4b-b412-08f524b4576c
	Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	frack113	2022-05-09	2026-05-18	28a452f3-786c-4fd8-b8f2-bddbe9d616d1
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris, @atc_project (fix)	2017-05-15	2022-12-25	75edd3fd-7146-48e5-9848-3013d7f0282c
	This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris	2017-05-15	2022-12-25	13fc89a9-971e-4ca6-b9dc-aa53a445bf40
	Detects DLL sideloading activity seen used by Diamond Sleet APT	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	d1b65d98-37d7-4ff6-b139-2d87c1af3042
	Hunts known SVR-specific DLL names.	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	CISA	2023-12-18	—	e64c8ef3-9f98-40c8-b71e-96110991cb4c
	Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-30	—	b6f91281-20aa-446a-b986-38a92813a18f
	Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-02	—	ebea773c-a8f1-42ad-a856-00cb221966e8
	Detects processes loading the non-existent DLL "ShellChromeAPI". (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-01	—	ee4c5d06-3abc-48cc-8885-77f1c20f4451
	Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded	Generic	test	-	windows	DNS Server	Execution, Stealth Hijack Execution Flow DLL	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	cbe51394-cd93-4473-b555-edf0144952d9
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	The Fax service attempts to load ualapi.dll, which is non-existent. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	NVISO	2020-05-04	2022-06-02	828af599-4c53-4ed2-ba4a-a9f835c434ea
	Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Subhash Popuri (@pbssubhash)	2021-08-21	2024-06-27	602a1f13-c640-4d73-b053-be9a2fa58b96
	Detects loading of DLLs associated with Katz Stealer malware 2025 variants. (...)	Emerging	experimental	image_load	windows	Sysmon	Execution Shared Modules	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-22	—	e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98
	Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospa (...)	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Thurein Oo, Nasreddine Bencherchali (Nextron Systems)	2023-10-18	—	24007168-a26b-4049-90d0-ce138e13a5cf
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
Splunk	The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.	Generic	stable	process_creation	linux	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Obfuscated Files or Information Compile After Delivery Execution Shared Modules Resource Development Stage Capabilities	CVE-2025-32463	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	9dbf4a61-0493-43bd-932c-532ba7671a7a
	Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upo (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113	2022-08-12	—	1908fcc1-1b92-4272-8214-0fbaf2fa5163
	Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) fro (...)	Generic	test	-	windows	Security Mitigations	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2022-08-02	2022-09-28	0b0ea3cc-99c8-4730-9c53-45deee2a4c86
	Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2023-03-15	829a3bdf-34da-4051-9cf4-8ed221a8ae4f
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
Splunk	The following analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. (...)	Hunting	stable	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2021-41379	medium	Michael Haag, Splunk	2021-12-08	2026-05-13	ccb98a66-5851-11ec-b91c-acde48001122
Splunk	The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. (...)	Generic	stable	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Teoderick Contreras, Splunk, Sanjay Govind	2021-07-05	2026-05-13	8bb3f280-dd9b-11eb-84d5-acde48001122
	Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-08-17	e61e8a88-59a9-451c-874e-70fcc9740d67
	Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	f63b56ee-3f79-4b8a-97fb-5c48007e8573
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	b2400ffb-7680-47c0-b08a-098a7de7e7a9
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	2bd63d53-84d4-4210-80ff-bf0658f1bf78
	Detects potential DLL sideloading of "7za.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	low	X__Junior	2023-06-09	—	4f6edb78-5c21-42ab-a558-fd2a6fc1fd57
	Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symante (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2025-10-07	552b6b65-df37-4d3e-a258-f2fc4771ae54
	Detects potential DLL sideloading of "appverifUI.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	X__Junior (Nextron Systems)	2023-06-20	—	ee6cea48-c5b6-4304-a332-10fc6446f484
	Detects potential DLL sideloading of "AVKkid.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	X__Junior (Nextron Systems)	2023-08-03	—	952ed57c-8f99-453d-aee0-53a49c22f95d
	Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	low	Den Iuzvyk	2020-07-15	2023-04-18	50f852e6-af22-4c78-9ede-42ef36aa3453
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential DLL sideloading of "CCleanerDU.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	X__Junior (Nextron Systems)	2023-07-13	—	1fbc0671-5596-4e17-8682-f020a0b995dc
	Detects potential DLL sideloading of "CCleanerReactivator.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	X__Junior	2023-07-13	—	3735d5ac-d770-4da0-99ff-156b180bc600
	Detects potential DLL sideloading of "chrome_frame_helper.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2023-05-15	72ca7c75-bf85-45cd-aca7-255d360e423c
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects DLL sideloading of "dbgcore.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-10-25	2025-10-06	9ca2bf31-0570-44d8-a543-534c47c33ed7

Title

Description