TLDR Tech / InfoSec
Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain
Rapid7 traced a Dropping Elephant campaign that opens with a China energy-sector lure (GRES3001.lnk) spawning obfuscated PowerShell, stages renamed payloads in C:\Users\Public, and abuses the legitimate Microsoft binary Fondue.exe to side-load APPWIZ.cpl (RunFODW), which AES-256-CBC-decrypts editor.dat into a Donut loader that maps a 32-bit RAT entirely in memory while patching AMSI, WLDP, and ETW. The reworked implant hardens C2 to gcl-power[.]org over HTTPS with Salsa20-protected fields, control-flow flattening, and runtime API reconstruction, yet Diaphora confirmed lineage through shared command-handler, screenshot (BitBlt/WIC), and WININET patterns. Defenders should hunt the durable behaviors over IOCs: an LNK spawning PowerShell, the GoogleErrorReport scheduled task running every minute, Fondue.exe loading APPWIZ.cpl from C:\Users\Public, and in-memory AMSI/WLDP/ETW tampering, while blocking chinagreenenergy[.]org and gcl-power[.]org.
Read the full story