Ponmocup Bot DLL

Hunt Hypothesis

This detection identifies the execution of the Ponmocup Bot DLL, a behavior indicative of an adversary establishing persistence or initiating data exfiltration through legitimate bot processes within the Azure environment. Proactively hunting for this activity allows the SOC team to distinguish between benign automation and potential low-severity footholds that could evolve into more significant threats if left unmonitored.

YARA Rule

rule Trj_Ponmocup_dll {
        meta:
                author = "Centro Criptológico Nacional (CCN)"
                ref ="https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
                description = "Ponmocup Bot DLL"
        strings:
                $mz = { 4d 5a }
                $pck = { 00 81 23 00 33 3E 00 00 3B F4 56 00 00 00 7D 00 }
                $upk = { 68 F4 14 00 10 A1 6C C0 02 10 FF D0 59 59 E9 7A }
        condition:
                ($mz at 0) and ($pck at 0x8a50) and ($upk at 0x61f)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Ponmocup Bot DLL detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Real-Time Scanning by CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor performs routine real-time file system monitoring. When a user downloads or opens a legitimate document (e.g., .xlsx or .pdf) containing macros, the sensor’s csfalcon.exe process injects its own DLL into the target process to scan for threats. This injection mimics the behavior of the Ponmocup Bot DLL loading mechanism.
  • Suggested Filter: Exclude events where the parent process is csfalcon.exe (CrowdStrike) and the loaded module path contains \Program Files\CrowdStrike\.

• Scheduled System Health Check via Microsoft SCCM (Configuration Manager)

  • Scenario: A nightly scheduled task (Task Scheduler) triggers a system health inventory job using the ccmexec.exe service. During this window, SCCM loads specific diagnostic DLLs to analyze hardware and software configurations across the domain. The Ponmocup rule may flag these legitimate configuration DLLs as suspicious bot activity due to similar naming conventions or loading sequences.
  • Suggested Filter: Create an exclusion for events triggered by ccmexec.exe where the command line arguments include /TaskName:HealthCheck or occur during the maintenance window (e.g., 02:00–04:00 UTC).

• Adobe Acrobat Reader DC Macro Execution

  • Scenario: Finance department users frequently open complex PDF invoices with embedded macros. When AcroRd32.exe executes these macros, it loads a series of internal DLLs to render the content and handle data processing. The Ponmocup detection logic may interpret this standard macro execution chain as an