QUILTED_TIGER__2019__Malware_analysis_about_sample_of_APT_Patchwork.pdf

This report presents a technical analysis of an APT (Patchwork) campaign leveraging an InPage INP exploit (CVE-2017-12824) to deliver a two-stage Windows payload that extracts to temp, establishes persistence via RunOnce, performs anti-debug and anti-analysis checks, and uses process hollowing to load a C2-connected loader; the report includes IOCs (file hashes, domain, IP), MITRE ATT&CK mappings, and contextual targeting information suggesting ties to Pakistan-related lures.