SLEEPWALKER Backdoor Uses Magic Packet, DLL Side-Loading and In-Memory Shellcode Execution

A newly documented Windows backdoor named SLEEPWALKER combines passive network monitoring, DLL side-loading, and encrypted bytecode to remain dormant until attackers deliver a precisely crafted trigger packet.

The malware does not beacon to a conventional command-and-control server, making it particularly difficult to identify through outbound-traffic monitoring alone.

The 59,904-byte unsigned file masquerades as Microsoft’s dpapi.dll and is designed to be side-loaded by ERAAgent.exe, the executable associated with ESET Management Agent.

It copies ESET version-resource information and exports the same seven functions as the legitimate Windows DPAPI library, helping it blend into a trusted security-management environment.

That configuration contains just one instruction: monitor every available network interface indefinitely for a valid magic packet. The implant does not embed a ready-to-run second-stage payload, hard-coded domains, IP addresses or URLs.

Unlike conventional backdoors that initiate outbound connections to attacker infrastructure, SLEEPWALKER puts network interfaces into promiscuous mode and inspects packets traversing the host.

A packet must satisfy several framing checks, including length validation, a checksum condition and a CRC-32 check, before the malware attempts to decrypt it. Valid tasks are encrypted and authenticated with AES-256-CCM.

This design creates a small network footprint. A compromised endpoint can remain idle without generating suspicious connections or exposing a default listening port.

The operational trigger can be delivered through ordinary IP traffic, and the malware’s code also includes a DNS-based trigger mechanism, although the analyzed sample enables only raw-packet monitoring.

The approach is especially concerning for systems such as gateways, VPN servers access or multi-homed hosts.

Because the packet sniffer can inspect traffic crossing watched interfaces, it may receive an attacker trigger intended for another system on the same network path.

R136a1 analysis said that, SLEEPWALKER activates only after confirming its host process is named ERAAgent.exe. Once running, it starts a background worker, allocates a 128 KB staging buffer, and decrypts its embedded bootstrap configuration.

SLEEPWALKER Backdoor

SLEEPWALKER processes decrypted tasks through a proprietary command language with 23 instructions.

Rather than delivering readable commands, operators send encrypted bytecode programs that must be both decrypted and reverse engineered before their intended actions can be understood.

Its instruction set supports task scheduling, repeated execution, TCP and UDP communications, ICMP-based data transfer, named-pipe communications, staged payload delivery, SHA-256 verification, decompression and in-memory shellcode execution.

The RUN_SHELLCODE instruction allocates writable memory, changes its protection to executable through VirtualProtect, and invokes attacker-supplied machine code directly in the context of the ESET Management Agent process.

The backdoor can also use VMware Virtual Machine Communication Interface (VMCI) channels, allowing communications between guests and hosts through the virtualization layer rather than standard network adapters.

That capability could complicate monitoring because conventional packet captures may not observe VMCI traffic.

SLEEPWALKER includes SMB named-pipe capabilities that can support credentialed lateral movement.

More notably, its named-pipe server functionality modifies Windows settings to enable anonymous access, setting EveryoneIncludesAnonymous and adding a pipe to NullSessionPipes.

These registry changes should be assessed against a known-good baseline, as they may also exist in legitimate configurations.

The malware appears to be a post-compromise persistence tool, not an initial-access vector.

Deploying the malicious dpapi.dll beside ERAAgent.exe requires sufficient local privileges, while the side-loading mechanism relies on Windows DLL search order rather than a vulnerability in ESET software.

Defenders should investigate any unexpected dpapi.dll or dpapisvc.dll file in the directory containing ERAAgent.exe. The latter is particularly suspicious because dpapisvc.dll is not a standard Windows component.

The analyzed sample has SHA-256 hash d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60.

Organizations should also review DLL-load telemetry for ESET Management Agent, monitor for promiscuous-mode interfaces, audit changes to anonymous SMB settings, and hunt for anomalous named pipes.

Reichel has not attributed SLEEPWALKER to a known threat actor or identified confirmed victims, but its passive architecture, layered command protection and in-memory execution model indicate a potentially targeted and well-resourced operation.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide