Relevant threat intel from LAB52

LAB52 identified a backdoor that is using OneDrive to load a malicious version of sspicli.dll to drop a VBA backdoor and use Outlook to execute the macro.

Analyzing NotDoor: Inside APT28’s Expanding Arsenal

Proof of Concept

A threat actor can craft a malicious version of SSPICLI.dll, write the malicious dll to the same directory as OneDrive.exe and execute a malicious payload.

To test this, I created a benign DLL that could possibly be used for Detection Engineering testing. When loaded, it displays the following popup:

image.png

You can use Dependency Walker to see that OneDrive loads sspicli.dll

image.png

Demo

onedrive-sspicli.dll-poc.mp4

Steps to replicate

  1. Write SSPICLI.dll to the same directory as OneDrive. By default, OneDrive typically sits in %LOCALAPPDATA%\\Microsoft\\OneDrive\\ or %ProgramFiles%\\Microsoft OneDrive\\
  2. Kill OneDrive.exe process
  3. Start OneDrive.exe process
  4. Observe pop-up indicating the POC dll was loaded by OneDrive.exe