vermillion-hunter

LoadLibraryW(LPCWSTR lpLibFileName)
LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
GetProcAddress(HMODULE hModule, LPCSTR lpProcName)

1. Identify signed exe with weak DLL reference
2. Copy exe to attacker-controlled directory
3. Place malicious DLL with expected name
4. Execute → DLL loads in trusted context

RegQueryValueExW → CLSID\{GUID}\InProcServer32

1. Monitor COM object instantiation
2. Create HKCU shadow of HKLM CLSID entry
3. Point InProcServer32 to malicious DLL
4. Application loads attacker DLL on COM call

# Single target
python wfh.py -t .\mspaint.exe -m dll

# Batch (copy exes to WFH dir first)
python wfh.py -t * -m dll

# Verbose with timeout
python wfh.py -t * -m dll -v -timeout 30

python wfh.py -t "C:\Program Files\Internet Explorer\iexplore.exe" -m com -v

# Requires MinGW G++ in PATH
python wfh_dridex.py
# Outputs: results.csv with validated sideloads

# Copy all signed Windows binaries
Get-ChildItem c:\ -File | ForEach-Object {
    if($_ -match '.+?exe$') {Get-AuthenticodeSignature $_.fullname}
} | Where {$_.IsOSBinary} | ForEach-Object {Copy-Item $_.path .}

# Hunt
python wfh.py -t * -m dll
python wfh.py -t * -m com

<!-- DLL Sideloading: Signed exe from non-standard path -->
<RuleGroup name="DLL Sideload" groupRelation="and">
  <ImageLoad onmatch="include">
    <ImageLoaded condition="contains">\Users\</ImageLoaded>
    <Signed condition="is">true</Signed>
  </ImageLoad>
</RuleGroup>

<!-- COM Hijack: HKCU InProcServer32 modification -->
<RuleGroup name="COM Hijack" groupRelation="or">
  <RegistryEvent onmatch="include">
    <TargetObject condition="contains">CLSID</TargetObject>
    <TargetObject condition="contains">InProcServer32</TargetObject>
  </RegistryEvent>
</RuleGroup>

Skill Trit: MINUS (-1) = Validator/Constrainer
Color Hue: Vermillion (0-60° warm, warning spectrum)
Conservation: Pairs with PLUS skill for balanced execution

pip install frida frida-tools
# For WFH Dridex:
# MinGW G++ 64-bit with g++.exe in PATH