Hackers Hijack HWMonitor to Sideload Malicious DLL

Hackers are once again exploiting user trust in legitimate software, this time abusing the popular CPUID HWMonitor utility to deliver a stealthy remote access trojan.

The malicious archive mimics a legitimate installer, highlighting how trusted tools remain a powerful lure for initial access.

The weaponized ZIP archive, distributed via a fake download link, contains the genuine HWMonitor executable alongside a malicious DLL named CRYPTBASE.dll.

This setup enables a classic DLL sideloading attack, where the legitimate binary unintentionally loads attacker-controlled code from its local directory instead of the Windows system path.

Security researchers at Gurucul uncovered a trojanized version of HWMonitor after analyzing a Reddit post that pointed to a suspicious download hosted on a Cloudflare R2 endpoint.

Once executed, HWMonitor_x64.exe loads the malicious CRYPTBASE.dll due to Windows’ DLL search order behavior. The injected DLL then quietly restores normal functionality by loading the legitimate system cryptbase.dll, ensuring the application appears to run as expected.

Inside its entry point, the malicious DLL spawns two threads:

• One initiates the attack chain.
• The other loads the clean system DLL to avoid suspicion.

This separation helps prevent crashes and reduces the likelihood of detection during execution.

Hackers Hijack HWMonitor

The malware operates through a sophisticated multi-stage reflective loading mechanism. It extracts obfuscated data from its internal sections and allocates executable memory using APIs like VirtualAlloc. The payload is then decrypted and executed entirely in memory.

The execution chain progresses as follows:

• HWMonitor_x64.exe.
• Malicious CRYPTBASE.dll.
• Stage 1 shellcode loader.
• Stage 2 and 3 reflective loaders.
• Stage 4 final loader.
• STX RAT payload.

Each stage decrypts and loads the next using a TEA-like routine, ensuring no intermediate files are written to disk. This fileless approach significantly reduces forensic visibility and complicates detection.

The final payload delivers STX RAT, a feature-rich remote access trojan designed for stealth and control. It employs several advanced evasion techniques:

• API hashing using a ROR13 algorithm to resolve functions dynamically.
• PEB-based anti-debugging by checking the BeingDebugged flag.
• XOR-based string obfuscation to hide sensitive data.

The malware also performs extensive reconnaissance by collecting system details such as hostname, username, and OS version.

STX RAT actively scans for installed security tools including Avast, CrowdStrike, SentinelOne, Sophos, and Kaspersky. This allows attackers to adapt their behavior based on the victim’s defenses.

More concerning is its hidden desktop monitoring capability. By interacting with the WinSta0 window station, the malware can create a hidden desktop environment and capture user activity.

It enumerates visible windows and uses BitBlt screen capture techniques to steal sensitive data such as credentials and session tokens.

The malware communicates with a remote command-and-control server using structured JSON data. Observed configuration fields include campaign identifiers and callback URLs, enabling operators to track infections and manage compromised systems efficiently.

A known callback endpoint linked to this campaign is:

• hxxps://welcome.supp0v3[.]com/d/callback

Security platforms like Gurucul SIEM can help detect this campaign by monitoring:

• Suspicious DLL sideloading behavior.
• Memory regions with RWX permissions.
• Reflective loading patterns.
• Hidden desktop interactions and screen capture activity.
• Unusual outbound network communications.

This campaign reinforces a critical lesson: even widely trusted software can become a delivery mechanism for advanced malware when distribution channels are compromised.

Users and organizations must validate software sources and implement behavioral detection to defend against increasingly fileless and evasive threats.

Indicators of Compromise (IOCs)

URLs

Type	Indicator
Callback URL	hxxps://welcome.supp0v3[.]com/d/callback
Malware Distribution URL	hxxp://pub-fd67c956bf8548b7b2cc23bb3774ff0c[.]r2[.]dev/hwmonitor_1[.]63[.]zip

File Hashes (MD5)

File	MD5
hwmonitor_1.63_malware.zip	f19f331562052baea0114d5186bbffd4
CRYPTBASE.dll	ab122aa36bfebf4f249c4eb617e4a6cb
Stage 2 Loader	D3C186869F443B6C1BE127A59B0B5A89
Stage 3 Loader	ADAB6C337E403AF0040D77A56DAF3BA0
Stage 4 Loader	9BF17E6525A295FB6E5EB562DEB927AE
STX RAT Payload	C781B1B559A585BB764B10176D64486C

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.