Rancor APT: DDKong Plugin “King Kong Ain’t Got Nothin’ on Our Network”

Rancor’s DDKong Plugin Technical Deep Dive

Below is an expanded, technical explanation of how the DDKong plugin campaign operates, what to hunt for in logs and forensic artifacts, and additional detection / mitigation content you can drop directly into tooling. This is intended for defenders and incident responders it avoids offensive details while giving practical, actionable detection and remediation guidance.

Typical attack flow (technical view)

Initial access

Targeted phishing or watering‑hole compromises. Lures often mimic regional government or telecom communications.

Delivery payloads commonly arrive as a staged archive (malicious installer, signed‑looking loader, or trojanized update).

Staging & loader

A loader or installer writes a plugin module (DLL or plugin file) and a lightweight persistence stub.

The loader may use obfuscation/packing to evade static detection (simple packers, string obfuscation, or custom XOR).

Plugin installation & injection

DDKong installs as a plugin or side‑loaded module into a legitimate host process (e.g., browser, office process, or custom vendor software).

Common injection techniques observed for similar plugins: DLL side‑loading, reflective DLL injection, or CreateRemoteThread + WriteProcessMemory sequences. The plugin aims to run under a benign parent to blend with normal process trees.

Persistence

Multiple mechanisms for resilience:

• Scheduled Tasks with encoded commands.
• Service registration or service DLLs.

Registry autoruns (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run, or service ImagePath with appended loader arguments).

Planted files in %ProgramData%, %AppData%, or legitimate application subfolders to avoid suspicion.

Discovery & credential harvesting

• Local reconnaissance: enumerates drives, network shares, running services, installed software.
• Harvests browser cookies, saved credentials, Windows credential files, and configuration files of local apps.
• May enumerate domain controllers, AD objects, and perform LDAP queries when run in privileged contexts.

Beaconing & C2

Periodic encrypted beaconing to domain-based C2 or IP C2 (199.247.6[.]253, supplied domains).

C2 traffic resembles normal HTTPS but can use custom encryption or layered encoding (base64 over HTTP POST, custom headers, or DNS tunneling where HTTP is blocked).

Uses GUID-like paths or plugin-specific URL endpoints for tasking and version checks.

Tasking & payload retrieval

• C2 issues tasks (exfil, execute shell commands, upload files).
• Binary update and modular plugin downloads pulled from dynamic domains.

Exfiltration & cleanup

• Exfiltration over encrypted channels (HTTPS POST, SFTP, or tunneled DNS).
• Attempts to remove obvious artifacts and may delete logs or alter timestamps to hinder analysis.

Malware capabilities & indicators to hunt for

Capabilities

• DLL/plugin loading into trusted processes
• Credential harvesting (browsers, RDP, local caches)
• File discovery and selective exfiltration
• Encrypted C2 beaconing and modular updates
• Persistence via scheduled tasks / services / registry
• Process injection / reflective loading

Artifacts & Indicators

New or unusual DLLs in program folders (especially in vendor app directories)

Scheduled tasks with Base64/encoded command arguments or references to nonstandard binaries

Registry autorun entries pointing to unexpected executables or DLL hosts

Unexpected network connections to the supplied domains/IPs, especially POSTs with small encrypted blobs

Processes with suspicious parent-child relationships (e.g., explorer.exe → networked plugin process)

Presence of the supplied SHA-256 hashes on disk or in EDR telemetry

Forensic collection checklist (if you suspect compromise)

Isolate affected host(s) from the network (preserve logs and disk images first).

Collect:

• Memory dump (volatile memory), reveals injected modules, unpacked strings, and network artifacts.
• Full disk image or targeted file copies of suspicious DLLs/executables and scheduled task XMLs.
• Windows event logs (Security, System, Application, Microsoft-Windows-Sysmon if present).
• Browser histories, cookie stores, and credential vault artifacts.
• Network captures (PCAP) if available, focus on flows to the listed IP/domain.

Extract:

• Loaded modules and DLL lists from memory images.
• Strings and configuration blobs from memory (C2 domains, GUIDs, mutexes).
• Process tree and parent process information.

Indicators of Compromise (IOCs) to Block

Quick summary, what to watch for now

• Outbound connections to 199.247.6[.]253 and the kfesv[.]xyz / bafunpda[.]xyz domains.
• Presence of the provided SHA‑256 hashes on disk.
• DLL/plugin files placed in vendor program directories or %ProgramData%.
• Scheduled tasks, services, or registry autoruns created by non-admin installers or with encoded command lines.
• Unusual process injection or side‑loading activity.