Technique:  Hijack Execution Flow:DLL Side-Loading
It launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.
It has been known to side load DLLs with a valid version of Chrome with one of their tools.
It ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).
It used legitimate executables to perform DLL side-loading of their malware.
BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.
DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.
It has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.
It has used legitimate applications to side-load malicious DLLs.
Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL  and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.
It has used side loading to place malicious DLLs in memory.
Chinoxy can use a digitally signed binary ("Logitech Bluetooth Wizard Host Process") to load its dll into memory.
Clambling can store a file named mpsvc.dll, which opens a malicious mpsvc.mui file, in the same folder as the legitimate Microsoft executable MsMpEng.exe to gain execution.
Denis exploits a security vulnerability to load a fake DLL and execute its code.
Dridex can abuse legitimate Windows executables to side-load malicious DLL files.
It has placed a malicious payload in %WINDIR%\SYSTEM32\oci.dll so it would be sideloaded by the MSDTC service.
Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.
Egregor has used DLL side-loading to execute its payload.
It has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).
FinFisher uses DLL side-loading to load malicious programs.
It used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
A gh0st RAT variant has used DLL side-loading.
Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.
It’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.
HTTPBrowser has used DLL side-loading.
HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.
Kerrdown can use DLL side-loading to load malicious DLLs.
It has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.
LookBack side loads its communications module as a DLL into the libcurl.dll loader.
It has used legitimate executables such as winword.exe and igfxem.exe to side-load their malware.
It has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.
metaMain can support an HKCMD sideloading start method.
Metamorfo has side-loaded its malicious DLL file.
It maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.
It has used a legitimately signed executable to execute a malicious payload within a DLL file.
It has used DLL side-loading to load malicious DLL's into legitimate executables.
Nebulae can use DLL side-loading to gain execution.
During Operation CuckooBees, the threat actors used the legitimate Windows services IKEEXT and PrintNotify to side-load malicious DLLs.
Pandora can use DLL side-loading to execute malicious payloads.
A It .dll that contains BADNEWS is loaded and executed using DLL side-loading.
PlugX has used DLL side-loading to evade anti-virus.
PowGoop can side-load Goopdate.dll into GoogleUpdate.exe.
QakBot has the ability to use DLL side-loading for execution.
RainyDay can use side-loading to run malicious executables.
RCSession can be installed via DLL side-loading.
Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.
It has used a malicious loader DLL file to execute the credwiz.exe process and side-load the malicious payload Duser.dll.
It has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.
SysUpdate can load DLLs through vulnerable legitimate executables.
During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.
It has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as rc.exe, a legitimate Microsoft Resource Compiler.
It has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.
Waterbear has used DLL side loading to import and load a malicious DLL loader.
Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.
ZeroT has used DLL side-loading to load malicious payloads.