November 25, 2019 By David Bisson 2 min read

A malicious downloader known as DePriMon uses the “Windows Default Print Monitor” name to avoid detection on Windows machines.

Active since at least 2017, DePriMon attracted the attention of ESET after infecting a private company based in Central Europe along with dozens of computers in the Middle East. The security firm subsequently examined the malicious downloader and learned a great deal about the threat’s second and third stages. Even so, researchers weren’t able to weigh in on DePriMon’s compromise vector(s) or what it uses for its final payload at the time of writing.

In the second stage of its infection chain, DePriMon abuses its system privileges to download the third-stage DLL to memory as a port monitor by creating a registry key. The threat thereby became the first documented malware family to leverage port monitors, an installation technique described in the MITRE ATT&CK framework. Once loaded, the third stage downloaded DePriMon’s final payload(s) from its operators.

Ties to the Longhorn Threat Actor

ESET detected ColoredLambert malware on a few of the computers infected by this most recent malicious downloader. As it turns out, ColoredLambert is just one of the members of the Lambert family. According to Kaspersky Lab, the Longhorn advanced threat actor has been using this suite of malware with zero-day vulnerability attacks since at least 2014. When Symantec investigated Longhorn, they found that many of its tools have been in use since 2011, some of which even appeared in the Vault 7 leak.

Defending Against a Fileless Malicious Downloader

Security professionals can help defend their organizations against fileless malicious downloaders like DePriMon by disabling PowerShell and other Windows processes if they are not needed. Otherwise, attackers can abuse these processes to infect the network with malware without raising any red flags. Companies should also invest in creating a robust security awareness training program that can educate employees about some of the most common social engineering attacks used by cybercriminals to distribute threats like DePriMon.

More from

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything.But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists in…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today