JOHN DANKOjohn@danko:~/projects/malware-incident-response
OPEN TO SOC ROLES
~ / projects / malware-incident-response
Real incident · My own Windows PC · Oct 19, 2026 (follow-up Oct 21)

Malware Incident Response Investigation.

While reviewing Task Manager, I noticed an unfamiliar process using ~4.2 GB of RAM with an outbound connection on port 443. It turned out to be DLL-sideloaded malware with two persistence mechanisms, and a reminder that an antivirus alert is not the same as a resolved incident.

OWNERJohn Danko
PATH~/projects/malware-incident-response
REPOjohn-danko-cyber/Malware-Incident-Response
TYPECase study
Illustration of the investigation workflow: Defender alerts, Task Manager triage, Run key and scheduled task persistence, defanged IOCs, 5 ATT&CK techniques mapped, 4 sideloading folders removed
01

Scenario & My Role

Scenario

A personal Windows gaming PC (single user, home network) running Microsoft Defender. ON1Photoshop.exe and SWGVC.exe were running from folders made to look like AppData\Local. Defender had raised behavior alerts on Oct 7, but both programs kept running and auto-starting for 12 more days.

My role

I spotted the suspicious process myself. The investigation and containment commands were carried out with the help of an AI assistant; I reviewed the findings at each step and approved every containment action before it ran.

02

Tools

  • Task Manager
  • Microsoft Defender detection history
  • Windows command-line queries
  • Authenticode signature checks
  • Registry Run keys
  • Scheduled Tasks
  • SHA256 hashing
  • MITRE ATT&CK

Follow-up checks also covered services, WMI subscriptions, IFEO, Winlogon, AppInit_DLLs, Startup folders, and RunMRU.

03

Investigation Steps

  1. DetectAbnormal memory use (~4.2 GB) and an outbound connection to 212.43.156[.]149:443 from a photo-editing-named process I hadn't installed.
  2. Check the pathAppData\Localrazerlocalpro: a missing backslash, so it's a separate look-alike folder, not AppData\Local.
  3. Identify techniqueSigned SWGVC.exe (valid SonicWall cert) next to ~22 DLLs; ON1Photoshop.exe next to ~26 DLLs: DLL sideloading.
  4. Find persistenceEach program had both an HKCU Run value and a scheduled task.
  5. Review Defender historyBehavior alerts on Oct 7 marked as executed, yet persistence was never removed.
  6. Contain (Oct 19)Stopped processes, moved folders to quarantine, renamed .exe/.dll to .quarantined, collected SHA256 hashes, removed Run values, disabled tasks.
  7. Follow up (Oct 21)Found two more sideloading folders (Stardock, LocalLogiProUpdater), removed them, deleted the disabled tasks, and traced likely initial access to a ClickFix fake-captcha command pasted into Win+R.
  8. VerifyRun keys, tasks, services, WMI, IFEO, Winlogon checked clean; no connection to the initial-access host; no NetSupport RAT found.
04

Evidence

05

Findings & IOCs (defanged)

TypeIndicatorNotes
IP:Port212.43.156[.]149:443Outbound connection from ON1Photoshop.exe
IP86.109.75[.]7Likely initial-access host (written as decimal 1450003207 in the ClickFix command)
SHA256CAC4F3B0…6CEADBSWGVC.exe (validly signed, SonicWall Inc.) – full hash in report
FolderAppData\LocalrazerlocalproON1Photoshop.exe + ~26 DLLs
FolderAppData\LocalRazerUploadProfile\swSWGVC.exe + ~22 DLLs
FolderAppData\Local\Programs\Stardock Smart DeElevation ToolSigned DeElevate64.exe + planted DLLs; active Run key & task
FolderAppData\LocalLogiProUpdaterSigned SyncoveryCL.exe + planted DLLs; dormant
Run key / TaskSonicWall Virtual Network Manager · ON1 Graph BuilderPersistence for both programs
DetectionsYomal, Malgent, DLLHijack.DAB, Kepavll, ClickFix, SuspEtherRpcConn.B, SuspSmsScanConn.ADefender names recorded
06

MITRE ATT&CK Mapping

T1204.004Malicious Copy and PasteClickFix command pasted into Win+R
T1059.001PowerShell-ExecutionPolicy Bypass, irm to %TEMP%\12.ps1
T1574.002DLL Side-LoadingSigned EXEs loading planted DLLs
T1547.001Registry Run KeysHKCU Run values
T1053.005Scheduled TaskMatching logon tasks
07

Timeline

  1. Sep 26Payload files created in Stardock folder
  2. Late SepLikely initial access: ClickFix command in Win+R
  3. Oct 5SWGVC.exe created
  4. Oct 7Defender behavior alerts on both programs
  5. Oct 7–19Programs keep running and auto-starting
  6. Oct 19Detected in Task Manager; contained
  7. Oct 21Follow-up: 2 more folders removed; verified clean
08

What I Learned

  • A valid signature doesn't equal trust: the DLLs a signed EXE loads are what matter.
  • Behavior alerts need follow-up: Defender detected both programs, but they ran 12 more days because persistence stayed.
  • Check every autostart: each program had two, and removing one would have left the machine infected.
  • Look closely at paths: one missing backslash was the clearest sign the folders were fake.
  • Quarantining one DLL isn't removal: remove the loader, payloads, and persistence together, then verify.
View GitHub RepositoryRead Full Incident Report (PDF)← All Projects