Dissecting a Multi-Stage Side-Loading Stager Abusing Desktop Central RMM
Overview
A recent threat campaign documented across URLhaus entries (#3912778, #3912780, and #3912782) highlights an intriguing multi-stage delivery pipeline. The threat actor combines binary splitting, DLL side-loading, COM moniker UAC auto-elevation, and registry steganography to deploy an abused ManageEngine Desktop Central (UEMS) RMM Agent pointing to rogue command-and-control (C2) infrastructure.
In this deep dive, we reverse-engineer the initial stager binary chain (Document.exe, zip.zip, CmElv64.dll), unpack the COM auto-elevation mechanism and extract the rogue C2 server configuration.
DCAgent RMM Side-Loading Campaign
A multi-stage loader campaign utilizing DLL side-loading via WmirvSE.exe, ICMLuaUtil COM auto-elevation, and registry payload loading to deploy an abused ManageEngine Endpoint Central Agent onto target machines.
zip.zip) & Extractor (Document.exe)Execution Chain Analysis
The stager deployment relies on a sequence of evasion tactics before bootstrapping the persistent RMM agent:
Stage 1: Binary Splitting (1.dll + 2.dll)
The initial batch script 1.bat combines two binary halves (1.dll and 2.dll) into %PUBLIC%\Documents\CmElv64.dll using standard command line concatenation (copy /b 1.dll + 2.dll). This splits signature detection across separate non-functional fragments.
Stage 2: DLL Side-Loading (WmirvSE.exe)
The archive drops WmirvSE.exe, a standard digitally signed executable that imports CmElv64.dll. When WmirvSE.exe executes, Windows automatically loads the dropped CmElv64.dll into its process space.
Stage 3: Silent UAC Bypass (ICMLuaUtil)
Inside CmElv64.dll, disassembly (0x180001000) reveals the COM Moniker CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (ICMLuaUtil). The stager uses string Elevation:Administrator!new:... to spawn elevated processes (SystemPropertiesAdvanced.exe --evhs=) without triggering UAC prompts.
Stage 4: Registry Steganography Loader
CmElv64.dll uses ROR-13 API hashing to dynamically resolve RegOpenKeyExA and RegQueryValueExA. It reads a payload blob stored at HKCU\Software\PngCache\1.png, allocates executable memory via VirtualAlloc, and executes it via CreateThread.
Technical Deep-Dive & Artifact Evidence
1. Reverse Engineering CmElv64.dll
Static disassembly of CmElv64.dll (c5ab3966dba53f535513dc04e49090293cdbe0e5b9f25e85b718950d94b038b1) highlights two primary subroutines:
COM Moniker Elevation Moniker
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
This COM interface (ICMLuaUtil) allows unprivileged code running in a medium-integrity process to request elevated COM objects, which auto-elevates without displaying a UAC prompt under default Windows UAC configurations.
ROR-13 API Hash Resolution
To obfuscate Windows API calls, CmElv64.dll iterates through kernel32.dll and advapi32.dll export tables, calculating a 32-bit ROR-13 hash for each function name:
0xec0e4e8e->RegOpenKeyExA0x7b8f1d82->RegQueryValueExA
Once resolved, it reads HKCU\Software\PngCache\1.png. If present, the stager executes the payload in memory.
2. Rogue C2 Configuration & Agent Provisioning
In the co-submitted archive (111a.zip / URLhaus #3912782), unpacking the DCAgent payload yields DCAgentServerInfo.json:
{
"SERVERIPADDRESS": "45.64.52.170",
"SERVERPORT": "8383",
"SERVERSECIPADDRESS": "45.64.52.170",
"SERVERSECUREPORT": "8383",
"PROTOCOL": "https",
"CUSTOMERID": "8139897bc4bcf9e2eb5a150b4bc0e2b9",
"AGENTVERSION": "11.5.2627.36.W"
}
TLS Certificate Forensics
Inspecting the embedded X.509 server root certificate (DMRootCA-Server.crt) reveals exact certificate generation metadata:
- Issuer:
C=US, ST=CA, OU=ManageEngine, O=Zoho Corporation, CN=ManageEngineCA - Validity Start:
Aug 18 11:07:51 2026 GMT - Serial Number:
4205653847814396616(0x3a5d7be45f3b5ac8)
setup.bat installs this certificate directly into the local host's trusted root authority store via SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt", allowing the agent to communicate back to 45.64.52.170:8383 over HTTPS without certificate warnings.
Indicators of Compromise (IOCs)
| Artifact / Identifier | Type | Value / Details |
|---|---|---|
zip.zip | SHA256 | 9498f3d95754de5ec4b9c0649d9ef111e7627c288866cf6a77c017a769c05be8 |
Document.exe | SHA256 | b30a5acfe90e3f42e714e225a32b1cd7dee5388b253a26381ac9afa8b8b3c8d1 |
CmElv64.dll | SHA256 | c5ab3966dba53f535513dc04e49090293cdbe0e5b9f25e85b718950d94b038b1 |
111a.zip | SHA256 | 38cd3148ef150ca2d4f1329a2981ccf3d0a59721f3ac204e8dcc921171495287 |
| C2 Server Endpoint | IP:Port | 45.64.52.170:8383 (HTTPS) |
| Customer Auth ID | Token | 8139897bc4bcf9e2eb5a150b4bc0e2b9 |
| Registry Key | Path | HKCU\Software\PngCache (1.png) |
| COM Moniker CLSID | Guid | {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (ICMLuaUtil) |