12 minhigh
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
HoneyMyte APT group has upgraded the CoolClient backdoor with a kernel-mode Windows rootkit driver (msagent.sys) that provides process hiding, file and registry protection, and network data filtering via Nsiproxy hooking. The driver is signed with an expired certificate from 2013-2014 issued to 'Nanjing Ranyi Technology Co., Ltd.' and communicates with the user-mode backdoor through IOCTL requests to device \Device\ToolTool. The malware uses DLL sideloading via a legitimate Sangfor application and a multi-stage execution chain with encrypted payloads, establishing persistence through AutoRun registry keys and Windows services.
Sens:▲ 24h
Showing defanged values
- domainblack-popular[.]comC2 domain used by CoolClient backdoor for command and control communication
- domaincloudtroe[.]giize[.]comC2 domain used by CoolClient backdoor for command and control communication
- domainemployers[.]theworkpc[.]comC2 domain used by CoolClient backdoor for command and control communication
- domainfreeread[.]casacam[.]netC2 domain used by CoolClient backdoor
- domainnews[.]dursamjbataar[.]orgC2 domain used by CoolClient backdoor
- domainsundanish[.]freeddns[.]orgC2 domain used by CoolClient backdoor
- domaintorinarlabs[.]webredirect[.]orgC2 domain used by CoolClient backdoor
- domainus[.]lenovoappstore[.]comC2 domain used by CoolClient backdoor
- domainvideo[.]dursamjbataar[.]orgC2 domain used by CoolClient backdoor
- domainwhatismybestthing[.]comC2 domain used by CoolClient backdoor
- filenameC:\programdata\msdn\Alternative CoolClient installation directory observed in intrusions
- filenameC:\ProgramData\symantecdir\Alternative CoolClient installation directory observed in intrusions
- filenameC:\ProgramData\virtualstore\Alternative CoolClient installation directory observed in intrusions
- filenameC:\ProgramFiles\commonfiles\microsoftshared\office14\Alternative CoolClient installation directory observed in intrusions
- filenameC:\ProgramFiles\Microsoft\WindowsDefender\Fake Windows Defender installation directory used by CoolClient for malware components
- filenameC:\ProgramFiles\windowsmediaplayer\mediares\Alternative CoolClient installation directory observed in intrusions
- filenameC:\Windows\identitycrl\production\Alternative CoolClient installation directory observed in intrusions
- filenameC:\Windows\serviceprofiles\networkservice\Alternative CoolClient installation directory observed in intrusions
- filenamelibngs.dllFirst-stage loader DLL sideloaded by legitimate Sangfor application, decrypts and loads loadcert.ini into memory
- filenamemsagent.sysKernel-mode rootkit driver filename deployed by CoolClient to C:\Program Files\Microsoft\Windows Defender\msagent.sys, signed with expired certificate from Nanjing Ranyi Technology Co., Ltd.
- md52d7c8780e97409770a9d4f31c66c9d63MD5 hash of msagent.sys kernel-mode rootkit driver deployed by CoolClient to hide processes, files, and registry entries
- md59460e150e1981d5c165043520c5c12feMD5 hash of msagent.sys kernel-mode rootkit driver (second variant)
- md59717f005c5fb98e08d2ad983d88f94eeMD5 hash of libngs.dll first-stage loader sideloaded by legitimate Sangfor application (defender.exe)
- md5eb79558b037669792652a816e2c669deMD5 hash of ctxmui.dll listed in CoolClient IOCs
- md5f518d8e5fe70d9090f6280c68a95998fMD5 hash of libngs.dll first-stage loader (second variant)
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunAutoRun persistence key where CoolClient creates value 'goopdate' to launch Sang.exe with 'work' parameter at user logon
- registry_keyHKLM\SYSTEM\CurrentControlSet\Services\media_updatenWindows service registry key for CoolClient persistence, configured to execute Sang.exe with 'work' parameter
- registry_keyHKLM\SYSTEM\CurrentControlSet\Services\msagentWindows service registry key for msagent.sys kernel driver, also contains minifilter Instances subkey
- registry_keyHKLM\SYSTEM\RNGRootkit configuration registry key used by msagent.sys driver to store hidden/protected file, registry, and process lists (values include Wid_H1deF5Dirs, Wid_H1deF5Files, Hid_State, Hid_StealthMode)
- registry_key\Registry\Machine\SYSTEM\CurrentControlSet\Services\media_updatenKernel-mode path for media_updaten service, registered with driver for protection via IOCTL 0x2220F0
Detection / Hunteropenrouter
What Happened
A hacking group called HoneyMyte has added new stealth capabilities to their CoolClient malware. The malware now includes a kernel-level driver that hides the malware's files, processes, and registry entries from security tools and system administrators. The driver also filters network information to hide the malware's communication channels. The malware disguises itself as a legitimate Windows Defender component and uses a signed (but expired) certificate to load the driver into Windows. Organizations in Asia (Pakistan, Mongolia, Myanmar) and Russia, particularly government entities, are the primary targets. Defenders should check for the specific file hashes, domains, and registry keys identified in the report, and verify that their security tools can detect DLL sideloading and unauthorized driver loading.
Key Takeaways
- HoneyMyte (Mustang Panda) upgraded CoolClient backdoor with a kernel-mode rootkit driver (msagent.sys) that hides processes, files, registry entries, and filters network data via Nsiproxy hooking
- The kernel driver is signed with an expired certificate (valid Aug 2013 to Sep 2014) issued to 'Nanjing Ranyi Technology Co., Ltd.' and contains a PDB path referencing a Nanjing laboratory
- CoolClient uses a multi-stage execution chain: DLL sideloading via legitimate Sangfor application, followed by encrypted payload stages (loadcert.ini, cert.ini) injected into synchost.exe
- The malware adds Microsoft Defender exclusions via wmic before deployment and establishes persistence through both AutoRun registry keys and Windows services
- PlugX is used as the initial post-compromise implant before CoolClient deployment, consistent with previous HoneyMyte campaigns
Affected Systems
- Windows systems (kernel-mode driver requires Windows with support for signed driver loading)
- Organizations in Asia (Pakistan, Mongolia, Myanmar) and Russia, including government entities
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: PlugX deployed as initial post-compromise implant by HoneyMyte
- Defense Evasion: Microsoft Defender exclusions added via wmic for fake Windows Defender directory and renamed sideloader executable
- Execution: Renamed Sangfor executable (defender.exe) sideloads libngs.dll, which decrypts and loads loadcert.ini into memory
- Persistence: AutoRun registry entry (goopdate) and Windows service (media_updaten) established; scheduled task created for SYSTEM-level execution at startup
- Defense Evasion: Kernel-mode driver (msagent.sys) deployed and initialized via IOCTLs to hide processes, files, registry entries, and filter C2 addresses from network tools via Nsiproxy hooking
- C2: Final-stage implant (cert.ini) injected into synchost.exe for backdoor communication with C2 domains
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not include any detection rules, queries, or signatures. It provides IOCs (file hashes, domains, file paths, registry keys) and technical analysis of the malware behavior that could be used to develop custom detections.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The rootkit hides processes, files, and registry entries after deployment, reducing EDR visibility into the running CoolClient process. However, the deployment chain (DLL sideloading, service creation, Defender exclusion, driver loading, process injection) generates visible telemetry before the rootkit is fully operational. |
| Network Visibility | Low | The rootkit hooks the Nsiproxy driver to filter C2 IP addresses from network enumeration tools on the endpoint. C2 communication may still be visible at the network perimeter if the domains are blocked or monitored at the firewall or DNS layer. |
| Detection Difficulty | Hard | The rootkit actively hides processes, files, and registry entries using kernel-mode callbacks and DKOM techniques. Post-deployment detection requires kernel-level telemetry or boot-time scanning. However, the deployment chain has visible indicators that can be detected before the rootkit is fully operational. |
Required Log Sources
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 7 (Image Loaded - DLL sideloading detection)
- Sysmon Event ID 6 (Driver Load)
- Sysmon Event ID 11 (File Creation)
- Sysmon Event ID 13 (Registry Value Set)
- Windows Security Event ID 4688 (Process Creation with command line)
- Windows System Event Log (Service Control Manager events)
- Windows Task Scheduler operational log
- Microsoft Defender exclusion change logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for Sangfor applications (Sang.exe or defender.exe) executing from atypical directories such as C:\Program Files\Microsoft\Windows Defender, which would indicate DLL sideloading. | Process creation telemetry with full image path and command line (Sysmon EID 1, Windows Security EID 4688) | Execution | Low - legitimate Sangfor software typically runs from its own installation directory, not from Windows Defender paths |
| Hunt for wmic commands targeting the MSFT_MpPreference class to add Microsoft Defender exclusion paths, especially for paths containing 'Microsoft\Windows Defender'. | Process creation telemetry with command line logging (Sysmon EID 1, Windows Security EID 4688) | Defense Evasion | Medium - administrators may legitimately add Defender exclusions, but exclusions for Windows Defender's own directory are suspicious |
| Hunt for kernel driver loading from non-standard paths, specifically msagent.sys loaded from directories other than C:\Windows\System32\drivers. | Driver load events (Sysmon EID 6, Windows System Event Log) | Defense Evasion | Low - legitimate drivers typically load from System32\drivers; loading from Program Files is unusual |
| Hunt for registry modifications under HKLM\SYSTEM\RNG, specifically values with names starting with 'Wid_H1de' or 'Hid_', which indicate rootkit configuration. | Registry value set events (Sysmon EID 13, Windows Registry monitoring) | Defense Evasion | Low - this registry path is not used by standard Windows components |
| Hunt for process injection into synchost.exe where the parent process is a Sangfor application or a process running from a fake Windows Defender directory. | Process creation and handle access events (Sysmon EID 1, 10, Windows Security EID 4688) | Defense Evasion | Low - synchost.exe is a legitimate Windows process but is not typically spawned by Sangfor applications |
Control Gaps
- Standard process enumeration tools (Task Manager, Process Explorer) will not show the hidden CoolClient process after the rootkit is active
- File system browsing will not reveal hidden malware files and directories after the rootkit minifilter is loaded
- Registry editing tools will not display hidden registry keys and values after the registry callback is registered
- Network enumeration tools relying on Nsiproxy will not show C2 connections to registered IP addresses
- EDR sensors may lose visibility into protected processes after the rootkit object callbacks are registered
- Driver signature enforcement may not block the driver if the system accepts expired certificates or if the certificate was valid at signing time
Key Behavioral Indicators
- defender.exe or Sang.exe executing from C:\Program Files\Microsoft\Windows Defender\
- libngs.dll loaded by a Sangfor application from a non-standard directory
- Scheduled task named 'Microsoft\Windows\Windows Defender Advanced Threat Protection Service'
- Windows service named 'media_updaten' executing Sang.exe with 'work' parameter
- Kernel driver msagent.sys loaded from a non-standard path (not C:\Windows\System32\drivers)
- Registry values under HKLM\SYSTEM\RNG with names starting with 'Wid_H1de' or 'Hid_'
- Process injection into synchost.exe from a non-standard parent process
- IOCTL codes 0x222120, 0x2221E0, 0x2220F0 sent to device \Device\ToolTool
- wmic commands adding Defender exclusions for paths containing 'Microsoft\Windows Defender'
- Registry value 'goopdate' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run launching Sang.exe with 'work' parameter
- DLL export table in libngs.dll where all exports call OutputDebugStringA followed by ExitProcess
- 360 Total Security process checks (360sd.exe, zhudongfangyu.exe, 360desktopservice64.exe) performed by malware before service installation
False Positive Assessment
Low - the identified file hashes, C2 domains, and registry keys are specific to this malware campaign. Individual indicators such as filenames (defender.exe) and file paths (C:\Program Files\Microsoft\Windows Defender) may produce false positives in isolation, but the combination of indicators and behavioral patterns provides high confidence for detection.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the identified file hashes, C2 domains, and registry indicators listed in the report.
- If your EDR supports host isolation, consider isolating any systems where msagent.sys or the identified CoolClient components are detected.
- Consider checking Microsoft Defender exclusion lists for unauthorized entries referencing Windows Defender paths or defender.exe.
Infrastructure Hardening
- Evaluate whether your organization can enforce driver signature requirements and block loading of drivers signed with expired or untrusted certificates.
- Consider implementing network-level blocking for the identified C2 domains if supported by your DNS filtering or firewall infrastructure.
- Evaluate whether restricting WMI namespace access to the Defender namespace would reduce the risk of unauthorized exclusion additions.
- Consider enabling Sysmon driver loading events (Event ID 6) if not already deployed, to detect kernel driver loading from non-standard paths.
User Protection
- Consider deploying enhanced monitoring for systems in the targeted regions (Asia, Russia) if your organization operates there.
- Evaluate whether your EDR can detect DLL sideloading scenarios involving legitimate applications in atypical directories.
- Consider enabling boot-time scanning or offline scanning capabilities if available, as the rootkit may not be active during boot-time checks.
Security Awareness
- Consider incorporating awareness of PlugX as an initial access vector into existing security training programs, as it is used as a precursor to CoolClient deployment.
- If applicable, consider educating IT staff about the risk of unauthorized Microsoft Defender exclusion additions via WMI.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Additional IOCs
- Domains:
freeread[.]casacam[.]net- C2 domain used by CoolClient backdoorus[.]lenovoappstore[.]com- C2 domain used by CoolClient backdoorsundanish[.]freeddns[.]org- C2 domain used by CoolClient backdoortorinarlabs[.]webredirect[.]org- C2 domain used by CoolClient backdoornews[.]dursamjbataar[.]org- C2 domain used by CoolClient backdoorvideo[.]dursamjbataar[.]org- C2 domain used by CoolClient backdoorwhatismybestthing[.]com- C2 domain used by CoolClient backdoor
- File Hashes:
9460E150E1981D5C165043520C5C12FE(MD5) - MD5 hash of msagent.sys kernel-mode rootkit driver (second variant)F518D8E5FE70D9090F6280C68A95998F(MD5) - MD5 hash of libngs.dll first-stage loader (second variant)EB79558B037669792652A816E2C669DE(MD5) - MD5 hash of ctxmui.dll listed in CoolClient IOCs
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run- AutoRun persistence key where CoolClient creates value 'goopdate' to launch Sang.exe with 'work' parameter at user logonHKLM\SYSTEM\CurrentControlSet\Services\media_updaten- Windows service registry key for CoolClient persistence, configured to execute Sang.exe with 'work' parameterHKLM\SYSTEM\CurrentControlSet\Services\msagent- Windows service registry key for msagent.sys kernel driver, also contains minifilter Instances subkey\Registry\Machine\SYSTEM\CurrentControlSet\Services\media_updaten- Kernel-mode path for media_updaten service, registered with driver for protection via IOCTL 0x2220F0
- File Paths:
C:\Program Files\Microsoft\Windows Defender\- Fake Windows Defender installation directory used by CoolClient for malware componentsC:\Program Files\windows media player\mediares\- Alternative CoolClient installation directory observed in intrusionsC:\ProgramData\symantecdir\- Alternative CoolClient installation directory observed in intrusionsC:\ProgramData\virtualstore\- Alternative CoolClient installation directory observed in intrusionsC:\Windows\identitycrl\production\- Alternative CoolClient installation directory observed in intrusionsC:\Windows\serviceprofiles\networkservice\- Alternative CoolClient installation directory observed in intrusionsC:\Program Files\common files\microsoft shared\office14\- Alternative CoolClient installation directory observed in intrusionsC:\programdata\msdn\- Alternative CoolClient installation directory observed in intrusions
- Command Lines:
- Purpose: Adding Microsoft Defender exclusion paths for fake Windows Defender directory and sideloader executable | Tools:
wmic.exe| Stage: Defense Evasion - Purpose: Creating scheduled task for SYSTEM-level persistence of defender.exe at system startup | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /sc onstart /tn <taskname> /tr <path> /ru "system" /F - Purpose: Starting the CoolClient Windows service after creation | Tools:
sc.exe| Stage: Execution |sc start <servicename>
- Purpose: Adding Microsoft Defender exclusion paths for fake Windows Defender directory and sideloader executable | Tools:
- Other:
media_updaten- Windows service name used by CoolClient for persistence, configured to execute Sang.exe with 'work' parameter\Device\ToolTool- Kernel device object created by msagent.sys rootkit driver for IOCTL communication with user-mode CoolClient\DosDevices\ToolTool- Symbolic link created by msagent.sys driver, accessible as \.\msagent from user modeE:\work\南京实验室\2024项目\张雪杰云南m\研发\FTool\Tool\x64\Release\FTool.pdb- PDB path embedded in msagent.sys driver, references Nanjing Laboratory and developer name Zhang Xuejie3E 62 DC 5D 8D 61 2A 26 33 E7 6B DF D6 07 19 DD- Serial number of expired digital certificate (valid Aug 2013 to Sep 2014) issued to 'Nanjing Ranyi Technology Co., Ltd.' used to sign msagent.sys driver201ef99a-7fa0-444c-9399-19ba84f12a1a- RPC interface GUID used by CoolClient for RPC-based UAC bypass via ncalrpc endpointloadcert.ini- Encrypted second-stage DLL implementing core CoolClient functionality including command handling, process injection, driver deployment, and persistencecert.ini- Final-stage encrypted DLL implant responsible for C2 communication and backdoor functionalitytime.ini- CoolClient configuration file containing service configuration and C2 address, encrypted with XOR keystreamdefender.exe- Renamed legitimate Sangfor executable (Sang.exe) used as DLL sideloader for CoolClient deploymentctxmui.dll- Filename listed in CoolClient IOCs\Microsoft\Windows\Windows Defender Advanced Threat Protection Service- Scheduled task name used by CoolClient for SYSTEM-level persistence, mimicking legitimate Windows Defender service