SADBRIDGEMalware
According to Elastic, SADBRIDGE is a malware loader packaged as an MSI executable for delivery and it uses DLL side-loading with various injection techniques to execute malicious payloads. SADBRIDGE abuses legitimate applications such as x64dbg.exe and MonitoringHost.exe to load malicious DLLs like x64bridge.dll and HealthServiceRuntime.dll, which leads to subsequent stages and shellcodes.From MISP Galaxy
Last reported 22 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“| ResolveDoRestoreNLA | Restores the security settings for Remote Desktop Protocol (RDP), enabling Network Level Authentication (NLA) and enforcing SSL/TLS encryption for secure communication.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“These organized campaigns target victims by masquerading as legitimate software such as web browsers or social media messaging services.”
- T1053.005Scheduled Task
“SADBRIDGE integrates a public UAC bypass technique using the IElevatedFactorySever COM object to indirectly create the scheduled task.”
- T1055Process Injection
“SADBRIDGE employs PoolParty, APC queues, and token manipulation techniques for process injection.”
- T1055.004Asynchronous Procedure Call
“It then queues Asynchronous Procedure Calls (APC) to the process's main thread.”
What the reports say
1 report, newest first · the exact sentence from each-
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite“Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite”
Indicators in its reports
named in the reports above- hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/in 1 report
- www.safebreach[.]comin 1 report
- micrornetworks[.]comin 1 report
- opera-x[.]netin 1 report
- teledown-cn[.]comin 1 report
- 15af8c34e25268b7…0276700ecc39in 1 report
- accd651f58dd3f7e…aa6db4291de7in 1 report
- 7964a9f1732911e9…73011bc54210in 1 report
- ferp.googledns[.]ioin 1 report
- hk-dns.secssl[.]comin 1 report
- hk-dns.winsiked[.]comin 1 report
- hk-dns.wkossclsaleklddeff[.]isin 1 report
- hk-dns.wkossclsaleklddeff[.]ioin 1 report
- hxxps://zcgonvh[.]com/post/Advanced_Windows_Task_Scheduler_Playbook-Part.2_from_COM_to_UAC_bypass_and_get_SYSTEM_dirtectly.htmlin 1 report
- zcgonvh[.]comin 1 report
- hxxps://www.sonicwall[.]com/blog/project-androm-backdoor-trojanin 1 report
- hxxps://gist.github[.]com/api0cradle/d4aaef39db0d845627d819b2b6b30512in 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.