North Korean ARTFULPIE trojan downloads DLL in-memory
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA details ARTFULPIE, a North Korean downloader trojan that fetches and executes DLLs in memory from a hardcoded URL.
This Malware Analysis Report (MAR) from CISA, FBI, and DoD documents ARTFULPIE, a trojan attributed to North Korea's HIDDEN COBRA cyber program. The malware operates as a downloader/loader, fetching a DLL from a hardcoded command-and-control server and executing it entirely in memory without writing to disk, complicating detection by traditional file-based methods.
The analyzed sample (mega.exe.exe, SHA256 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c) downloads a DLL from hxxp://193.56.28.103:88/xampp/thinkmeter.dll using a spoofed Internet Explorer 9 user agent. The malware manually loads the retrieved DLL into its own address space and invokes its entry point, allowing arbitrary code execution without touching the file system. Defenders should monitor for network connections to the identified C2 server, suspicious process injection patterns, and in-memory DLL loading activity from suspicious parents.
Mentioned in this report
Detection guidance
DLL Download Using Spoofed MSIE 9.0 User Agent
Proxy-observed HTTP request for a .dll file using an Internet Explorer 9 user agent, as ARTFULPIE does when fetching its in-memory payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DLL Download Using Spoofed MSIE 9.0 User Agent
description: Detects HTTP requests for a .dll resource that carry an MSIE 9.0 user
agent. ARTFULPIE uses a spoofed IE9 user agent to fetch a DLL that it then loads
manually in memory. Generalises on the user-agent plus DLL-download pattern, not
on the C2 address or path.
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: proxy
detection:
selection:
c-useragent|contains: MSIE 9.0
c-uri|endswith: .dll
condition: selection
falsepositives:
- Legacy applications that hard-code an IE9 user agent and legitimately download DLL
components
- Old software updaters in environments still running Windows 7 era tooling
level: medium
id: cee42981-b3e2-5627-97a6-6167149d8eb7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045e
User-Writable Path Process Connecting Outbound to Public Host on TCP 88
A process running from a user-writable path initiates an outbound connection to a non-private address on TCP port 88, an unusual port for a downloader pulling a DLL over HTTP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: User-Writable Path Process Connecting Outbound to Public Host on TCP 88
description: Detects processes executing from user-writable locations (AppData, Temp,
Downloads, Users Public) that open outbound connections to public IP addresses on
TCP port 88. Port 88 is normally Kerberos and stays on internal networks. ARTFULPIE
retrieves its DLL over HTTP on this non-standard port.
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 88
Image|contains:
- \AppData\
- \Users\Public\
- \Temp\
- \Downloads\
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private
falsepositives:
- Portable Kerberos or security testing tools run from Downloads against an external
realm
- Custom applications deployed under AppData that use TCP 88 for a non-Kerberos service
level: medium
id: 53fe5b0f-7d32-5ed4-b65e-84e0ff885c4a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045e
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045e
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs