Critical Vulnerability in HWMonitor Allows DLL Hijacking Attacks

Key Takeaways

• A new campaign leverages the legitimate HWMonitor utility to deliver the sophisticated STX RAT through DLL sideloading.
• Attackers distribute a trojanized HWMonitor ZIP archive that includes a malicious CRYPTBASE.dll.
• The attack chain utilizes multi-stage reflective loading, delivering the STX RAT payload entirely in memory to evade detection.
• The STX RAT enables extensive surveillance, system information gathering, security product evasion, and persistent remote control.

Attackers Weaponize HWMonitor to Deploy Stealthy STX RAT

Cybersecurity researchers have identified a new campaign where threat actors are exploiting the trusted hardware monitoring software, HWMonitor, developed by CPUID. This sophisticated attack vector utilizes DLL sideloading to infect systems with the STX remote access trojan (RAT), turning a legitimate diagnostic tool into a covert surveillance instrument.

The campaign’s initial phase involves distributing a compromised ZIP archive, masquerading as a standard HWMonitor installation package. Victims who download and extract this archive unknowingly unleash both the genuine HWMonitor_x64.exe executable and a malicious DLL named CRYPTBASE.dll into the same directory. This method capitalizes on user trust in widely-used software, establishing a difficult-to-detect initial foothold.

Multi-Stage Delivery Evades Detection

Analysts at Gurucul, who provided a detailed analysis of this threat, revealed that the malicious archive was distributed via a URL hosted on a Cloudflare R2 storage bucket. Their investigation uncovered a complex, multi-stage execution process designed to bypass security defenses and deliver the STX RAT payload directly into memory, leaving minimal forensic traces on compromised systems. This in-memory delivery significantly hinders traditional file-based detection mechanisms.

The impact of this campaign is substantial. Once the STX RAT is operational, attackers gain the ability to capture screen activity, extract comprehensive system information, identify installed security software, and maintain persistent remote control over the victim’s machine. The presence of unique campaign tracking identifiers within the malware suggests that the operators are orchestrating large-scale infection efforts targeting multiple entities simultaneously.

Hackers Abuse Legitimate HWMonitor Binary with DLL Sideloading

The fundamental mechanism behind this attack is DLL sideloading, a well-established technique. When the legitimate HWMonitor_x64.exe is executed, the Windows operating system prioritizes searching for required DLLs, such as CRYPTBASE.dll, within the application’s local directory before consulting the system path. Attackers exploit this predictable search order by placing their malicious CRYPTBASE.dll in the same folder as the legitimate executable. This ensures that the trusted HWMonitor binary loads the attacker-controlled code instead of the authentic Windows system library.

Upon loading, the malicious DLL initiates two separate threads within DllMain. The first thread is responsible for commencing the malicious execution chain, while the second thread discreetly loads the legitimate system DLL. This dual-thread design is a deliberate tactic to ensure HWMonitor continues to function normally, thereby avoiding suspicion from the user while the attack unfolds silently in the background.

STX RAT Multi-Stage Payload Delivery

Following the successful DLL sideloading, the malware proceeds through a multi-stage reflective loading sequence. This process is designed to deliver the final STX RAT payload entirely in memory, bypassing the need to write any files to disk. The malicious DLL extracts obfuscated data from its .rdata section, allocates executable memory using the VirtualAlloc API, and navigates through several decryption stages before the ultimate payload is activated. This in-memory execution strategy makes it considerably more challenging for traditional file-based security solutions to detect the threat.

The STX RAT is engineered with a comprehensive set of capabilities for long-term espionage and data exfiltration. It employs API hashing to dynamically resolve Windows functions at runtime, which obscures its import table and complicates static analysis. Furthermore, the RAT includes anti-analysis measures, such as checking the Process Environment Block for debugger flags, and actively enumerates installed security products, including popular antivirus and EDR solutions like Avast, Bitdefender, SentinelOne, and CarbonBlack. It silently captures screenshots, gathers critical system information (hostname, username, OS details), and communicates with its command-and-control server using JSON-based messages over HTTPS.

What You Should Do

• Monitor DLL Loading: Implement robust monitoring for unusual DLL loading activities, especially when system DLLs are loaded from non-standard application directories instead of the Windows system path.
• Block Unsigned DLLs: Configure systems to block the loading of unsigned or unexpected DLLs to prevent unauthorized code execution.
• Enhance Memory-Based Threat Detection: Deploy and maintain advanced endpoint detection and response (EDR) solutions capable of identifying reflective in-memory execution and other fileless attack techniques.
• Monitor Network Traffic: Scrutinize outbound HTTPS connections for unusual endpoints or suspicious communication patterns that might indicate command-and-control activity.
• Educate Users: Conduct regular user awareness training on safe download practices and the dangers of opening files from untrusted sources, even if they appear to be legitimate software.
• Validate Software Sources: Always download software from official vendor websites or trusted repositories. Avoid third-party download sites or suspicious links received via email or messaging platforms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.