Unveiling the Inner Workings of DiceLoader

This Sekoia.io report analyzes DiceLoader (Icebot), a small but sophisticated DLL downloader attributed to FIN7 that uses reflective DLL injection, multi-threaded IoCompletionPort queuing, custom linked-list data structures, and two XOR-based obfuscation schemes to communicate with and receive payloads from raw TCP C2 servers; the analysis covers fingerprinting, packet formats, shellcode execution mechanics, and observed C2 infrastructure activity, and maps the behavior to relevant MITRE ATT&CK techniques.