Dropping Elephant China-Themed Loader Chain Evolution

Rapid7 researchers identified a sophisticated malware campaign attributed to Dropping Elephant (also known as Patchwork) targeting the energy sector with China-themed lure documents. The campaign features a revamped execution chain that uses a legitimate Microsoft binary, Fondue.exe, to side-load a malicious DLL (APPWIZ.cpl), which ultimately loads an in-memory Remote Access Trojan (RAT). This evolution in tradecraft emphasizes evasion, utilizing control-flow flattening and memory-resident execution to bypass traditional disk-based security controls.

The attack begins with a malicious LNK file that initiates a PowerShell downloader, staging payloads in C:\Users\Public. The final 32-bit C++ implant is mapped into memory using the Donut shellcode loader, which also patches AMSI, WLDP, and ETW to blind endpoint telemetry. Code-level analysis confirms the lineage to Dropping Elephant through shared command-handler structures and beaconing patterns, despite the significant obfuscation improvements.

This activity demonstrates the actor's investment in increasing the technical sophistication of their payloads while maintaining established delivery patterns. The use of memory-resident implants and the targeting of critical infrastructure themes necessitate high-fidelity monitoring of PowerShell execution and DLL side-loading behaviors.