{
  "family": "adkdllwrapper",
  "sample_count": 7,
  "category": "trojan",
  "description": "Trojan:Win32/Adkdllwrapper is a persistent, stealthy trojan (often associated with wrapping adware or secondary payloads) designed to breach endpoint defenses and securely deliver its payload.<br><br><b>Understanding Adkdllwrapper</b><br>To an end-user, an Adkdllwrapper infection is typically invisible until the secondary payload executes (often manifesting as aggressive adware or a browser hijacker). For threat intelligence analysts, this wrapper is a critical staging mechanism. It utilizes DLL side-loading or injection techniques to securely bypass endpoint defenses and ensure the successful execution of its bundled payload.<br><br><b>Execution and Evasion Strategies</b><br>Adkdllwrapper is commonly distributed via deceptive software bundlers or exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. Its defining characteristic is its use of DLL wrapper techniques (`T1574.001`)—often replacing legitimate system DLLs with malicious proxies, or injecting its payload into legitimate processes (`T1055`) to mask its execution. It establishes persistence by modifying the Registry Run keys or utilizing COM hijacking. <br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or the loading of unsigned DLLs by core system processes. Network logs will often reveal the wrapper reaching out to compromised domains to pull down the final payload. Memory analysis is necessary to extract the injected modules and determine what payloads were executed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1574.001",
    "T1055",
    "T1027",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.001",
      "name": "Hijack Execution Flow: Search Order Hijacking (DLL Wrapping)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the wrapper from downloading and executing its secondary payloads.",
    "Audit the Windows Registry (specifically looking for COM hijacking or Run keys) to identify and remove the persistence mechanisms.",
    "Review firewall logs to identify the C2 domains the wrapper attempted to contact.",
    "Capture a live memory image (RAM dump) to extract the injected modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial wrapper was quarantined; always verify if secondary payloads were deployed.",
    "Avoid relying solely on manual file deletion, as injected processes will likely recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}