# North Korean ARTFULPIE trojan downloads DLL in-memory

Published: 2025-07-17 · Severity: routine · Sectors: defense, government-national
Canonical: https://vorant.io/reports/09dad598-dbc9-54d6-ada7-884e44824f50/north-korean-artfulpie-trojan-downloads-dll-in-memory

> CISA details ARTFULPIE, a North Korean downloader trojan that fetches and executes DLLs in memory from a hardcoded URL.

This Malware Analysis Report (MAR) from CISA, FBI, and DoD documents ARTFULPIE, a trojan attributed to North Korea's HIDDEN COBRA cyber program. The malware operates as a downloader/loader, fetching a DLL from a hardcoded command-and-control server and executing it entirely in memory without writing to disk, complicating detection by traditional file-based methods.

The analyzed sample (mega.exe.exe, SHA256 606c6000f36dc69fefc6df828e1ac9c5529a71a62b99f5df55463606c4c9689c) downloads a DLL from hxxp://193.56.28.103:88/xampp/thinkmeter.dll using a spoofed Internet Explorer 9 user agent. The malware manually loads the retrieved DLL into its own address space and invokes its entry point, allowing arbitrary code execution without touching the file system. Defenders should monitor for network connections to the identified C2 server, suspicious process injection patterns, and in-memory DLL loading activity from suspicious parents.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: ARTFULPIE
- Campaigns: HIDDEN COBRA

## Detection guidance (public sample)

### DLL Download Using Spoofed MSIE 9.0 User Agent

ATT&CK: T1105

Proxy-observed HTTP request for a .dll file using an Internet Explorer 9 user agent, as ARTFULPIE does when fetching its in-memory payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DLL Download Using Spoofed MSIE 9.0 User Agent
description: Detects HTTP requests for a .dll resource that carry an MSIE 9.0 user
  agent. ARTFULPIE uses a spoofed IE9 user agent to fetch a DLL that it then loads
  manually in memory. Generalises on the user-agent plus DLL-download pattern, not
  on the C2 address or path.
tags:
- attack.command-and-control
- attack.t1105
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains: MSIE 9.0
    c-uri|endswith: .dll
  condition: selection
falsepositives:
- Legacy applications that hard-code an IE9 user agent and legitimately download DLL
  components
- Old software updaters in environments still running Windows 7 era tooling
level: medium
id: cee42981-b3e2-5627-97a6-6167149d8eb7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045e
```

### User-Writable Path Process Connecting Outbound to Public Host on TCP 88

ATT&CK: T1105

A process running from a user-writable path initiates an outbound connection to a non-private address on TCP port 88, an unusual port for a downloader pulling a DLL over HTTP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: User-Writable Path Process Connecting Outbound to Public Host on TCP 88
description: Detects processes executing from user-writable locations (AppData, Temp,
  Downloads, Users Public) that open outbound connections to public IP addresses on
  TCP port 88. Port 88 is normally Kerberos and stays on internal networks. ARTFULPIE
  retrieves its DLL over HTTP on this non-standard port.
tags:
- attack.command-and-control
- attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 88
    Image|contains:
    - \AppData\
    - \Users\Public\
    - \Temp\
    - \Downloads\
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private
falsepositives:
- Portable Kerberos or security testing tools run from Downloads against an external
  realm
- Custom applications deployed under AppData that use TCP 88 for a non-Kerberos service
level: medium
id: 53fe5b0f-7d32-5ed4-b65e-84e0ff885c4a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045e
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045e

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/09dad598-dbc9-54d6-ada7-884e44824f50/north-korean-artfulpie-trojan-downloads-dll-in-memory.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup