Rapid7 researchers have uncovered a sophisticated new malware campaign orchestrated by the threat group known as Dropping Elephant.
The attackers are leveraging advanced evasion techniques, including DLL side-loading via a legitimate Microsoft binary (Fondue.exe), to deploy an in-memory Remote Access Trojan (RAT).
By running the final payload entirely in memory, the threat actors effectively bypass traditional disk-based security controls.
The attack sequence begins with a malicious Windows shortcut file disguised as a PDF contract for a Chinese energy project.
When a victim clicks this shortcut, it triggers an obfuscated PowerShell script that downloads a decoy document to avoid raising suspicion.
In the background, the script silently stages several files in the C:\Users\Public\ directory, including the legitimate Microsoft Fondue.exe, a malicious loader named APPWIZ.cpl, and an encrypted payload.
Fondue.exe Sideloads Elephant Malware
To maintain persistence on the compromised machine, the script creates a scheduled task called “GoogleErrorReport” that executes Fondue.exe every minute.
This triggers a classic DLL side-loading attack. Because Fondue.exe expects a specific file, it mistakenly loads the malicious APPWIZ.cpl staged alongside it instead of the safe Windows version.
Once executed, the malicious loader decrypts the hidden payload and deploys “Donut” shellcode. Donut is responsible for mapping the final 32-bit RAT directly into the system’s memory without ever writing it to the hard drive.
Before the RAT even runs, Donut patches built-in Windows security features like AMSI and Event Tracing for Windows (ETW), effectively blinding the system’s telemetry and reducing the chance of detection.
Once active in memory, the RAT aggressively checks for debugging tools and analysis software. It then securely connects to its command-and-control server using the Salsa20 encryption cipher.
From there, attackers can execute shell commands, capture screenshots, and exfiltrate sensitive files.
According to Rapid7 research, because the final RAT never touches the disk and heavily modifies its code structure to complicate analysis, relying on traditional file hashes for defense is insufficient.
Security teams must pivot to behavioral detection to spot the early stages of this attack chain. Defenders should actively monitor for the following suspicious behaviors:
- Shortcut files unexpectedly spawn PowerShell commands with basic string obfuscation.
- System files and encrypted payloads are being staged in the C:\Users\Public\ directory.
- The creation of scheduled tasks named “GoogleErrorReport” that are set to execute frequently.
- Fondue.exe is loading APPWIZ.cpl from non-standard directories rather than the legitimate Windows system folder.
While Dropping Elephant frequently changes their infrastructure and file signatures, their execution path remains highly recognizable.
Organizations should ensure their endpoint protection tools have strong memory-level visibility to detect injected payloads and alert on tampering with native security controls.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
