Dissecting a Multi-Stage Side-Loading Stager Abusing Desktop Central RMM

Overview

A recent threat campaign documented across URLhaus entries (#3912778, #3912780, and #3912782) highlights an intriguing multi-stage delivery pipeline. The threat actor combines binary splitting, DLL side-loading, COM moniker UAC auto-elevation, and registry steganography to deploy an abused ManageEngine Desktop Central (UEMS) RMM Agent pointing to rogue command-and-control (C2) infrastructure.

In this deep dive, we reverse-engineer the initial stager binary chain (Document.exe, zip.zip, CmElv64.dll), unpack the COM auto-elevation mechanism and extract the rogue C2 server configuration.

---

CAMPAIGN DOSSIER

DCAgent RMM Side-Loading Campaign

A multi-stage loader campaign utilizing DLL side-loading via WmirvSE.exe, ICMLuaUtil COM auto-elevation, and registry payload loading to deploy an abused ManageEngine Endpoint Central Agent onto target machines.

Primary TargetEnterprise Windows endpoints & admin environments

Delivery VectorStaged Archive (zip.zip) & Extractor (Document.exe)

Primary EffectUnauthorized Remote Monitoring & Management (RMM) Access

Technical Signals & C2 Infrastructure

Protocol & Ports

45.64.52.170:8383HTTPS / TLSDCAgent RMM Protocol

MITRE ATT&CK Techniques Observed

T1574.002 / DLL Side-LoadingT1548.002 / Bypass User Account ControlT1112 / Modify RegistryT1219 / Remote Access Software

---

Execution Chain Analysis

The stager deployment relies on a sequence of evasion tactics before bootstrapping the persistent RMM agent:

Stage 1: Binary Splitting (1.dll + 2.dll)

The initial batch script 1.bat combines two binary halves (1.dll and 2.dll) into %PUBLIC%\Documents\CmElv64.dll using standard command line concatenation (copy /b 1.dll + 2.dll). This splits signature detection across separate non-functional fragments.

Type: Evasion / Binary Concatenation

Stage 2: DLL Side-Loading (WmirvSE.exe)

The archive drops WmirvSE.exe, a standard digitally signed executable that imports CmElv64.dll. When WmirvSE.exe executes, Windows automatically loads the dropped CmElv64.dll into its process space.

Type: Defense Evasion / DLL Side-Loading

Stage 3: Silent UAC Bypass (ICMLuaUtil)

Inside CmElv64.dll, disassembly (0x180001000) reveals the COM Moniker CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (ICMLuaUtil). The stager uses string Elevation:Administrator!new:... to spawn elevated processes (SystemPropertiesAdvanced.exe --evhs=) without triggering UAC prompts.

Type: Privilege Escalation / UAC Bypass

Stage 4: Registry Steganography Loader

CmElv64.dll uses ROR-13 API hashing to dynamically resolve RegOpenKeyExA and RegQueryValueExA. It reads a payload blob stored at HKCU\Software\PngCache\1.png, allocates executable memory via VirtualAlloc, and executes it via CreateThread.

Type: Execution / Registry Payload Loading

---

Technical Deep-Dive & Artifact Evidence

1. Reverse Engineering CmElv64.dll

Static disassembly of CmElv64.dll (c5ab3966dba53f535513dc04e49090293cdbe0e5b9f25e85b718950d94b038b1) highlights two primary subroutines:

COM Moniker Elevation Moniker

Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}

This COM interface (ICMLuaUtil) allows unprivileged code running in a medium-integrity process to request elevated COM objects, which auto-elevates without displaying a UAC prompt under default Windows UAC configurations.

ROR-13 API Hash Resolution

To obfuscate Windows API calls, CmElv64.dll iterates through kernel32.dll and advapi32.dll export tables, calculating a 32-bit ROR-13 hash for each function name:

• 0xec0e4e8e -> RegOpenKeyExA
• 0x7b8f1d82 -> RegQueryValueExA

Once resolved, it reads HKCU\Software\PngCache\1.png. If present, the stager executes the payload in memory.

---

2. Rogue C2 Configuration & Agent Provisioning

In the co-submitted archive (111a.zip / URLhaus #3912782), unpacking the DCAgent payload yields DCAgentServerInfo.json:

{
  "SERVERIPADDRESS": "45.64.52.170",
  "SERVERPORT": "8383",
  "SERVERSECIPADDRESS": "45.64.52.170",
  "SERVERSECUREPORT": "8383",
  "PROTOCOL": "https",
  "CUSTOMERID": "8139897bc4bcf9e2eb5a150b4bc0e2b9",
  "AGENTVERSION": "11.5.2627.36.W"
}

TLS Certificate Forensics

Inspecting the embedded X.509 server root certificate (DMRootCA-Server.crt) reveals exact certificate generation metadata:

• Issuer: C=US, ST=CA, OU=ManageEngine, O=Zoho Corporation, CN=ManageEngineCA
• Validity Start: Aug 18 11:07:51 2026 GMT
• Serial Number: 4205653847814396616 (0x3a5d7be45f3b5ac8)

setup.bat installs this certificate directly into the local host's trusted root authority store via SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt", allowing the agent to communicate back to 45.64.52.170:8383 over HTTPS without certificate warnings.

---

Indicators of Compromise (IOCs)

Artifact / Identifier	Type	Value / Details
zip.zip	SHA256	9498f3d95754de5ec4b9c0649d9ef111e7627c288866cf6a77c017a769c05be8
Document.exe	SHA256	b30a5acfe90e3f42e714e225a32b1cd7dee5388b253a26381ac9afa8b8b3c8d1
CmElv64.dll	SHA256	c5ab3966dba53f535513dc04e49090293cdbe0e5b9f25e85b718950d94b038b1
111a.zip	SHA256	38cd3148ef150ca2d4f1329a2981ccf3d0a59721f3ac204e8dcc921171495287
C2 Server Endpoint	IP:Port	45.64.52.170:8383 (HTTPS)
Customer Auth ID	Token	8139897bc4bcf9e2eb5a150b4bc0e2b9
Registry Key	Path	HKCU\Software\PngCache (1.png)
COM Moniker CLSID	Guid	{3E5FC7F9-9A51-4367-9063-A120244FBEC7} (ICMLuaUtil)