# RONINGLOADER: DragonBreath’s New Path to PPL Abuse

DragonBreath's RONINGLOADER trojanized installers abuse a signed driver, thread-pool injection, and ClipUp PPL abuse to disable Defender and Chinese EDRs.

- Payout: Real-world hack
- Severity: high
- Program: DragonBreath RONINGLOADER
- Credited: Jia Yu Chan,Salim Bitam
- Disclosed: 2025-11-15
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/roningloader
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-roningloader
- Tags: domain:desktop impact:integrity impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoint (MSI/NSIS installers, kernel driver, VSS/svchost injection)
**Root cause:** Multi-stage loader drops a legitimately signed kernel driver (ollama.sys) exposing IOCTL 0x222000 to kill arbitrary PIDs, and abuses ClipUp.exe -ppl to overwrite MsMpEng.exe with junk data, plus an unsigned WDAC policy to block rival AVs.
**Steps:**
1. MSI `klklznuah.msi` drops two NSIS installers; malicious one drops `Snieoatwtregoable.dll` + encrypted `tp.png`
2. DllRegisterServer ROR/XOR-decrypts tp.png to shellcode, loads fresh ntdll, executes via NtAllocateVirtualMemory/NtCreateThreadEx
3. Stage 2 elevates via runas, enumerates AV processes (MsMpEng, kxemain, QQPCTray, HipsTray, 360tray)
4. Injects PE driver + shellcode into vssvc.exe via NtCreateSection/NtMapViewOfSection, triggered by thread-pool file-write
5. Shellcode writes driver to `C:\windows\system32\drivers\1912763.temp`, creates service `xererre1`, sends PID to IOCTL 0x222000 to kill 360 processes, deletes service
6. Writes WDAC policy to `C:\Windows\System32\CodeIntegrity\CiPolicies\Active\{31351756-...}.cip` denying 360rp.exe/360sd.exe/ARPProte.exe and Huorong cert TBS
7. Runs `ClipUp.exe -ppl C:\ProgramData\roming\MsMpEng.exe` after mklink to Defender platform dir to corrupt MsMpEng.exe
8. goldendays.dll via regsvr32 injects trustinstaller.bin into TrustedInstaller/elevation_service, which injects Enpug.bin final gh0st RAT beaconing to qaqkongtiao[.]com
**How found:** After August 2025 Zero Salarium PPL-abuse disclosure, Elastic wrote a behavioral rule 'Potential Evasion via ClipUp Execution' and threat-hunted telemetry, finding a live campaign using the technique.
**Exploitation:** Victim runs trojanized Chrome/Teams installer; loader gains admin, kills AV via signed driver IOCTL, corrupts Defender via PPL abuse, blocks rivals via WDAC, then deploys gh0st RAT with keylogger, clipboard hijacker, and crypto-wallet/Telegram tracking to C2 over raw TCP with RC4.
**Escalation:** Chained signed-driver process kill, WDAC policy, PPL abuse, and phantom DLL sideloading (Wow64Log.dll) for redundant AV neutralization before final RAT deployment.
**Insight:** Hunt for ClipUp.exe with -ppl arguments and mklink directory links into Defender's Platform folder; also monitor service creation of short-lived drivers with IOCTL-based process termination and unsigned WDAC .cip writes to CodeIntegrity\Active.