North Korean HOTCROISSANT Trojan malware analysis
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analysis of HOTCROISSANT, a North Korean beaconing Trojan with system survey, file transfer, and command execution capabilities.
CISA, FBI, and DoD released a Malware Analysis Report (MAR) detailing HOTCROISSANT, a full-featured beaconing implant attributed to North Korean government-sponsored HIDDEN COBRA activity. The malware performs system reconnaissance, file upload and download, process execution, command execution, and screen captures. It uses custom XOR-based network encoding with zipped payload delivery, hardcoded command-and-control infrastructure, and attempts to hide API usage through obfuscated string lookups via LoadLibrary and GetProcAddress. The sample analyzed communicates with C2 at 94.177.123.138:8088 and exhibits several implementation flaws including broken ProcessKill and WindowClose commands due to programmer errors. The malware maintains a persistent beaconing loop after initial victim information transmission.
Mentioned in this report
Detection guidance
User-Writable Path Process Connecting Outbound to TCP 8088
Detects a process running from a user-writable directory making an outbound connection to a public address on TCP 8088, the non-standard port used by the HOTCROISSANT beacon. It matches the port and execution-location pattern, not the C2 IP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: User-Writable Path Process Connecting Outbound to TCP 8088
description: Detects a process running from a user-writable directory (AppData, Temp,
ProgramData, Public) making an outbound connection to a public address on TCP 8088.
HOTCROISSANT-style beaconing implants use a hardcoded non-standard port for C2.
Matches the port and execution-location pattern, not the C2 IP.
tags:
- attack.command-and-control
- attack.t1071
- attack.t1041
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 8088
Image|contains:
- \AppData\
- \Users\Public\
- \ProgramData\
- \Windows\Temp\
- \Temp\
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private
falsepositives:
- Developer tools or locally installed web apps in AppData that talk to an external
service on port 8088
- Portable admin or monitoring agents run from ProgramData that use 8088
level: medium
id: 3e1d4506-9e15-5953-8225-d28ea42c0972
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045d
Process from User-Writable Path Spawning cmd.exe for Host Reconnaissance
Detects a binary running from a user-writable directory spawning cmd.exe to run host reconnaissance commands, as a beaconing implant would for system discovery and command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process from User-Writable Path Spawning cmd.exe for Host Reconnaissance
description: Detects a binary executing from a user-writable directory (AppData, Temp,
ProgramData, Public) that spawns cmd.exe to run host discovery commands. This is
consistent with a beaconing implant performing system reconnaissance and command
execution on operator tasking.
tags:
- attack.discovery
- attack.execution
- attack.t1082
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- \AppData\
- \Users\Public\
- \ProgramData\
- \Windows\Temp\
selection_child:
Image|endswith: \cmd.exe
CommandLine|contains:
- systeminfo
- ipconfig /all
- tasklist
- whoami
- net user
filter_known_parents:
ParentImage|contains:
- \Microsoft\Teams\
- \Programs\Microsoft VS Code\
- \Google\Chrome\
condition: selection_parent and selection_child and not filter_known_parents
falsepositives:
- Software installers or updaters unpacked to Temp that gather system information
- Admin scripts or portable tools launched from a user profile
level: medium
id: bdb1b358-b60e-58c0-8b6d-7014e41704f3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045d
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045d
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs