BRONZE SANDCASTLE deploys modified Meterpreter shells

    Wednesday, October 21, 2026 In: Threat Research Print

    Date: 10/21/2026

    Severity: Medium

    Summary

    Threat actors used legitimate Sandboxie executables alongside a malicious `sbiedll.dll` to execute attacker-controlled code through DLL sideloading. This recurring technique serves as a potential group identifier, although other executable and DLL combinations are also used. The sideloaded DLLs decrypt and execute payloads stored in `config.ini` files, reducing static detection opportunities. This approach allows attackers to modify payload behavior without replacing the DLL, while renamed legitimate executables help them blend into victim environments. Execution triggers in-memory shellcode activity, and a sample archive (`aez.zip`) contained `javaw.exe` as the loader, `jli.dll` as the sideloaded DLL, and `config.ini` holding the encrypted payload.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    dc.cathaypacifice.com

    net.dpworldto.com

    Hash

    07ed4b9470b2395ad5f969a501761ab8

    1f74838581e8bef12cb7df2d70099cd6865ef238

    7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756

    25ee87bb42d88bf00f60c4064c376846

    e98c54ce736a607803e89144daa679fccd4f7521

    b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842

    dd89cfd1f0b13addfc43cae758130b6a

    f7db825aeee21d6326fa9c31512d090720546341

    7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03

    615a6089ab073115ed0b8bcfcfbdc966

    dae5a4489671e2d9d2189a830b17ff144f8ab904

    ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28

    4e916e024ea0c0eb16bd91f054d22444

    ffe58ea274af642a3fc1d50e823cb01f61dc8dae

    dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290

    e63ec733393e4e7e3424cbff918003a3

    cd1a262f8c2624700440b0aa464b7a2b42e23511

    95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9

    2a39552543f84aa3a7a562d9bb54fc00

    536d6a8fa98a566079a459b16df1e29622dd8af5

    548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989

    8c32bf3711b237e3c781a00b5c526695

    4e6d600ce7a9cf6414e738d8f39260ae961602f0

    592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc

    f771159881bc82217d30a64a7716e613

    624da53bd827ca27b66d8a42a9524b0b48e882b4

    2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060

    3addd7c803b9570fc0b1ee6899444c66

    56b1258c4553fb549fca9215727be1e5cd1efe4e

    425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b

    a0fa0893e1adde6b93063ab2c7369536

    1abe25d3255679bdc1c35c070da40e3c4572bb4a

    72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238

    0a7464945e1994a7fc5ee2b86ce48c94

    2f399541445cc1aade0e7a2148853fe41be57827

    2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2

    e43a7c1169cf1d4ce8b22c1301ca100c

    120d204d253293d594d6fcbe681797942fb74f7a

    fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052

    5ac863a8bffbcca5647284e088d401dc

    0ed62f00b9e7c5780c9bd05b096eee13a160480f

    e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc

    b695542718a7cc373112852d97d1811e

    c2811a0fa539e4cd6633f32349fb34b0455bcba6

    6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d

    4cf187200a4e639e314b7f96a33f161e

    1fc7350e215759b4d66ab6458244271b5e2cfa90

    91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b

    32151547d912488ac5242731057170a3

    24ede364f5eabe991c866e92ffa396bcb894eb14

    437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e

    c15c10589e671094185311e358b8903b

    6204c6342c5dfb67bdc29d45a524c3ac3a99aa01

    c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30

    5910e874fccc9b37239b00b993393994

    ffd5cfbd5274a351315ba1e922d795f872f7ff9b

    c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834

    0ff9ecbaf18e45cd7b4943b21d5c6cf1

    8964de054bfb70c5560ebabe224bb45723f60b37

    e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e

    ebf221383c234ea2361ed54e6df6ddfc

    ab86a6b71582e16a7da14533fe9407d7a2bc525c

    5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection  

    Detection Query 1 :

    domainname like "dc.cathaypacifice.com" or url like "dc.cathaypacifice.com" or siteurl like "dc.cathaypacifice.com" or domainname like "net.dpworldto.com" or url like "net.dpworldto.com" or siteurl like "net.dpworldto.com"

    Detection Query 2 :

    md5hash IN ("0a7464945e1994a7fc5ee2b86ce48c94","0ff9ecbaf18e45cd7b4943b21d5c6cf1","e63ec733393e4e7e3424cbff918003a3","4e916e024ea0c0eb16bd91f054d22444","f771159881bc82217d30a64a7716e613","e43a7c1169cf1d4ce8b22c1301ca100c","5ac863a8bffbcca5647284e088d401dc","ebf221383c234ea2361ed54e6df6ddfc","3addd7c803b9570fc0b1ee6899444c66","4cf187200a4e639e314b7f96a33f161e","2a39552543f84aa3a7a562d9bb54fc00","8c32bf3711b237e3c781a00b5c526695","b695542718a7cc373112852d97d1811e","dd89cfd1f0b13addfc43cae758130b6a","a0fa0893e1adde6b93063ab2c7369536","07ed4b9470b2395ad5f969a501761ab8","25ee87bb42d88bf00f60c4064c376846","615a6089ab073115ed0b8bcfcfbdc966","32151547d912488ac5242731057170a3","c15c10589e671094185311e358b8903b","5910e874fccc9b37239b00b993393994")

    Detection Query 3 :

    sha1hash IN ("24ede364f5eabe991c866e92ffa396bcb894eb14","1fc7350e215759b4d66ab6458244271b5e2cfa90","6204c6342c5dfb67bdc29d45a524c3ac3a99aa01","536d6a8fa98a566079a459b16df1e29622dd8af5","1abe25d3255679bdc1c35c070da40e3c4572bb4a","ab86a6b71582e16a7da14533fe9407d7a2bc525c","ffd5cfbd5274a351315ba1e922d795f872f7ff9b","f7db825aeee21d6326fa9c31512d090720546341","ffe58ea274af642a3fc1d50e823cb01f61dc8dae","cd1a262f8c2624700440b0aa464b7a2b42e23511","624da53bd827ca27b66d8a42a9524b0b48e882b4","8964de054bfb70c5560ebabe224bb45723f60b37","56b1258c4553fb549fca9215727be1e5cd1efe4e","4e6d600ce7a9cf6414e738d8f39260ae961602f0","1f74838581e8bef12cb7df2d70099cd6865ef238","e98c54ce736a607803e89144daa679fccd4f7521","dae5a4489671e2d9d2189a830b17ff144f8ab904","2f399541445cc1aade0e7a2148853fe41be57827","120d204d253293d594d6fcbe681797942fb74f7a","0ed62f00b9e7c5780c9bd05b096eee13a160480f","c2811a0fa539e4cd6633f32349fb34b0455bcba6")

    Detection Query 4 :

    sha256hash IN ("592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc","e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc","95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9","548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989","437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e","2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2","fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052","c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834","e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e","5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91","91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b","2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060","c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30","dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290","7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03","72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238","6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d","425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b","7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756","b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842","ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28")

    Reference:   

    DLL Sideloading and Payload Execution                                                            


    Tags

    Threat ActorDLLSideLoadingShellcodeLoader

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.