What We Do
How We Do
Get Started

TRU Positives: Weekly investigation summaries and recommendations from eSentire's Threat Response Unit (TRU)

Persistent Connection Established: Nitrogen Campaign Leverages DLL Side-Loading Technique for C2 Communication

BY eSentire Threat Response Unit (TRU)

June 21, 2023 | 6 MINS READ


Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?


Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In June 2023, we identified and effectively responded to security incidents involving multiple hosts associated with Python-based post-exploitation. We named the campaign Nitrogen after the PDB path and the strings found in the malicious msi.dll employed during the initial infection.

The threat actor(s) established initial access via a drive-by download, wherein the victim downloaded an ISO image from a compromised WordPress website.

Figure 1: Compromised WordPress website hosting the malicious ISO image

Below is a description of the observed initial infection chain.

The process begins with the manual execution of the install file by the end user from within an ISO image. Subsequently, the installer proceeds to load the msi.dll file and decrypts the accompanying data file. A more comprehensive analysis of this campaign will follow this blog.

Figure 2: Contents of an ISO image
Figure 3: Initial Infection Chain (SentinelOne console)

The malicious installer drops an embedded Python distribution as well as the malicious DLL that is used for sideloading (T1574.002) under the “C:\Users\Public\Music\python” path.

Figure 4: Files dropped under C:\Users\Public\Music\python path.

The scheduled task,“OneDrive Security Task-S-1-5-21-5678566754-9123742832-2638705499-2003”, is created as a persistence mechanism to run the pythonw.exe binary. The task is set to trigger at system startup and expires on 12/1/2029 at midnight.

Figure 5: Scheduled Task creation (SentinelOne console)

The threat actor(s) have been observed employing the DLL sideloading technique to execute a malicious payload and establish a persistent connection with C2 servers. The screenshot below reveals the utilization of python310.dll as the DLL for sideloading.

Figure 6: DLL sideloading

We found the code responsible for establishing a connection to a remote host, retrieving compressed and encoded data, and executing it locally.

Figure 7: Code responsible for establishing a remote connection with C2

We were able to extract the C2 from the malicious DLLs:

The threat actor(s) were able to run Bloodhound-py and LaZagne on patient zero via one of the malicious Python files (work2.py). During the investigation, our in-house Incident Response team retrieved a copy of the work2.py script for further analysis.

The Python script contained the Pyramid module; Pyramid is a Python-based HTTP/HTTPS C2 server equipped with the ability to distribute encrypted payloads. Additionally, Pyramid incorporates numerous modules to facilitate the loading of offensive tools such as LaZagne, Bloodhound-py, secretsdumps, and more.

The snippet of the Pyramid module below makes an encrypted HTTP request to a server, providing authorization credentials and executing the received response payload as code.

Figure 8: Snippet of the Pyramid module

Another file that the attacker(s) utilized to drop a Cobalt Strike DLL was work7.py, which contained Python code with a marshal module to execute a payload that has been marshaled or serialized.

Figure 9: work7.py contents

Upon disassembling the bytecode, we were able to retrieve the Cobalt Strike DLL that the attacker(s) ran on one of the hosts. You can find the Cobalt Strike beacon configuration at the end of this article.

It is important to note that within a span of 2 hours, the threat actor(s) engaged in lateral movement, deploying several malicious Python files onto compromised hosts.

Our Threat Response Unit (TRU) conducted further research and identified other samples involved in the Nitrogen campaign, including the malicious DLLs used for sideloading. We were also able to extract additional C2s for the campaign that you can find in the Indicators of Compromise section.

How did we find it?

What did we do?

What can you learn from this TRU positive?

Recommendations from our Threat Response Unit (TRU) Team:

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Indicators of Compromise



ISO image


ISO image


ISO image


ISO image


ISO image






































Yara rule

  "BeaconType": [
  "Port": 8443,
  "SleepTime": 10000,
  "MaxGetSize": 2801745,
  "Jitter": 37,
  "C2Server": "85.217.144[.]234,/jquery-3.3.1.min.js",
  "HttpPostUri": "/jquery-3.3.2.min.js",
  "Malleable_C2_Instructions": [
    "Remove 1522 bytes from the end",
    "Remove 84 bytes from the beginning",
    "Remove 3931 bytes from the beginning",
    "Base64 URL-safe decode",
    "XOR mask w/ random key"
  "HttpGet_Verb": "GET",
  "HttpPost_Verb": "POST",
  "HttpPostChunk": 0,
  "Spawnto_x86": "%windir%\\syswow64\\dllhost.exe",
  "Spawnto_x64": "%windir%\\sysnative\\dllhost.exe",
  "CryptoScheme": 0,
  "Proxy_Behavior": "Use IE settings",
  "Watermark": 587247372,
  "bStageCleanup": "True",
  "bCFGCaution": "False",
  "KillDate": 0,
  "bProcInject_StartRWX": "False",
  "bProcInject_UseRWX": "False",
  "bProcInject_MinAllocSize": 17500,
  "ProcInject_PrependAppend_x86": [
  "ProcInject_PrependAppend_x64": [
  "ProcInject_Execute": [
  "ProcInject_AllocationMethod": "NtMapViewOfSection",
  "bUsesCookies": "True",
  "HostHeader": ""
eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire