CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT.

Hunt Hypothesis

This hunt hypothesis targets adversaries who deploy the CoralWave loader disguised as a legitimate Lenovo audio DLL to covertly install the Remcos Remote Access Trojan (RAT) on endpoints. Proactive hunting for this specific masquerading behavior in Azure Sentinel is critical because it enables early detection of sophisticated supply chain compromises that could lead to persistent data exfiltration and command-and-control establishment before standard alerts trigger.

YARA Rule

rule MAL_CoralWave_LenovoSPKVOL_RemcosMicDrop {
    meta:
        description = "CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT."
        author = "xstp"
        date = "2026-01-01"
        reference = "https://bazaar.abuse.ch/sample/050edadedd7947bc6418f7856a29df5b7b5550bf5eec7f5f37e9a7e1713036f6/"
        hash = "65302b435a5bc30e8f0215455679635ec50b5b1caba9e55f9258d17c7238be54"
        score = 85

        id = "fddc398d-6283-5819-895a-d520aff7088c"
    strings:
        $stub_1 = "BAyXuHpAGwdG8ebXF3GvZ32vO3ORY" ascii
        $stub_2 = "IK5HT1XPlj3LoFkKi3YC4QwYQs7s" ascii
        $stub_3 = "Xmk61GHDjDfjUjJhNjwDPXxM1Cdg" ascii

        $fake_1 = "GetVolumeLevel" ascii
        $fake_2 = "OpenSpeakerVolumeInterface" ascii
        $fake_3 = "SetMuteState" ascii

        $mutex = "Rmc-245S33" wide ascii
        $log_file = "logs.dat" wide ascii
        $audio_folder = "MicRecords" wide ascii

    condition:
        filesize < 5MB and uint16(0) == 0x5A4D and
        (
            2 of ($stub_*) or
            (2 of ($fake_*) and 1 of ($mutex, $log_file, $audio_folder))
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the CoralWave loader masquerading as Lenovo audio DLL rule, including suggested filters and exclusions:

Scenario: Legitimate IT deployment of Lenovo Vantage or Audio drivers via SCCM/Intune.
- Context: During scheduled maintenance windows, the System Center Configuration Manager (SCCM) client service (ccmexec.exe) installs or updates LenovoAudio.dll on endpoints running Windows 10/11. The installer process drops a temporary DLL that mimics the CoralWave signature before the final installation completes, triggering the detection logic for “dropping Remcos RAT.”
- Suggested Filter: Create an exclusion based on the parent process name ccmexec.exe or Microsoft.IntuneManagementExtension.exe. Additionally, filter out alerts where the dropped file hash matches a known good baseline of the Lenovo Audio installer package (e.g., specific SHA256 hashes stored in your asset management system).
Scenario: Scheduled Group Policy update for audio drivers on Lenovo hardware.
- Context: A nightly scheduled task (Task Scheduler) runs a PowerShell script to push updated audio drivers to all Lenovo ThinkPad devices. This script extracts LenovoAudio.dll into the %SystemRoot%\System32\drivers directory. The extraction process involves writing a new DLL that temporarily resembles the CoralWave loader behavior before being replaced by the final driver version, causing the rule to flag it as a potential RAT drop.
- Suggested Filter: Exclude alerts where the file creation timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 local time) and the destination path is strictly C:\Windows\System32\drivers. You can also add a filter to ignore events where the user context is SYSTEM or a specific service account like `