A legitimate Windows program launches, and a companion DLL loaded from its folder gives the intruder a way back in. Microsoft Threat Intelligence’s September 28 analysis identifies that pattern in NeedyMantis, a modular implant used after attackers already gained access. Microsoft observed it in a limited number of targeted intrusions affecting telecoms, universities, medical nonprofits, intergovernmental organizations and government contractors.
Hunt for the pair: a DLL beside legitimate software and an archive with the same basename but no extension. Microsoft’s analyzed Poedit example paired WinSparkle.dll with WinSparkle. In one observed incident, an operator used Impacket to copy legitimate software, a malicious DLL and its archive from a network share, then executed the legitimate software on a target device. The share-to-host activity gives investigators a path to trace beyond a file alert.
A legitimate program loads the implant
NeedyMantis uses DLL sideloading: a real application loads a substituted DLL while starting normally. Microsoft saw packaging beside Poedit, curl, Vim and TightVNC components and DLL names that imitate Microsoft Office, Broadcom, Intel and NVIDIA components. The first-stage DLL reads the neighboring custom archive, extracts a second-stage loader and launches it. The archive’s outer layer is XOR-decoded and decompressed; individual entry names are XOR-decoded and their contents decompressed. Names and keys vary between samples.
In the Poedit sample, encryptbase64.ps1 is the second-stage loader. Despite the .ps1 extension, Microsoft identified x64 shellcode inside it. The resulting main component coordinates communications and additional modules. A file called dnsapi.dll carries configuration rather than the Windows networking library it resembles; ws2_32.dll carries the communications component. The analyzed configuration points to corp[.]tripswithengine[.]com on port 443 and the path /library/zip/. The communications DLL uses WebSockets and a hard-coded firefox/21.0 user agent. A process that appears to belong to normal software may therefore communicate with an attacker-controlled host.
One known operator, other possible users
Microsoft describes Storm-3069, the actor associated with the DAEMON Tools supply-chain compromise, as one observed user of NeedyMantis. Microsoft also observed activity beyond that campaign and has “not determined whether all observed activity is attributable to the same threat actor or whether multiple actors have access to the malware.” Treat this as a post-compromise hunt across possible entry routes: Microsoft observed NeedyMantis itself being deployed after access, rather than through the DAEMON Tools supply chain.
Search for the loader and its archive
Start with endpoint file and process telemetry for a DLL loaded by a legitimate program from one of the named software directories. Microsoft’s example paths include %ProgramFiles%\Poedit\WinSparkle.dll, %ProgramData%\USOShared\libcurl.dll, %ProgramData%\VIM\vim64.dll, %ProgramData%\office\dbghelp.dll and %ProgramData%\ics\nvml.dll. On a hit, collect the parent executable, DLL hash, creation time, nearby same-basename extensionless file and preceding network-share copy or remote execution activity. A filename match is a triage lead; the paired archive, hash and loading process make it more specific.
The published SHA-256 values are e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e for the analyzed WinSparkle.dll loader, 9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef for its WinSparkle archive, and c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77 for an older libcurl archive. Use hashes to identify these samples, then use the loader/archive relationship for variants.
Look for outbound connections to corp[.]tripswithengine[.]com and correlate with the initiating endpoint and application. Microsoft provides Defender XDR hunting queries over DeviceFileEvents for the DLL paths and across network and related tables for that domain and the Firefox/21.0 user agent. Search fields containing raw hostnames with the indicator restored to its canonical form in the hunting console; leave the published indicator defanged. The user agent by itself can also occur in unrelated traffic, so tie it to the host, process and file evidence.
Contain access and verify controls
On a matching host, isolate the device and preserve its file, process and network history. Block the identified C2 destination in the network controls, remove the attacker-controlled loader and archive through incident response, and trace the account and network share that delivered them to other hosts. Because NeedyMantis arrives after initial access, removing its files alone leaves the original access path for the operator to reuse.
Microsoft recommends cloud-delivered protection with block at first sight, Defender for Endpoint’s EDR in block mode, network protection and automatic attack disruption. Confirm the intended policy is applied to affected devices, then check for new connection attempts to the identified destination and for a reappearing loader/archive pair. Use the account and transfer history to investigate the initial foothold even if those checks stay clear.
Check where the legitimate software and its companion files came from. A familiar executable next to an unfamiliar DLL and same-name archive deserves a file-and-process investigation, especially when that host also reached the published C2.