Severity
High
Analysis Summary
Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936, with a CVSS v4 score of 8.4. The flaw has been exploited in ClickFix campaigns to execute malicious code on affected systems.
The vulnerability occurs because the application loads dynamic-link libraries (DLLs) from an uncontrolled search path. An authenticated local attacker can place a specially crafted DLL in a directory searched by the application, resulting in arbitrary code execution with the privileges of the affected application. Siemens addressed the issue in Software Center version 4.0.9.8.
Siemens reported that threat actors abused a legitimate, digitally signed copy of Siemens Software Center by placing a malicious DLL named archive.dll alongside the executable. The trusted application then loaded the DLL, allowing attackers to execute malicious code while leveraging the application's legitimate signature.
The attack chain involves msiexec.exe launching AllMyBasic.msi, which subsequently executes SiemensSoftwareCenter.exe. The activity has been linked to Romulus, a ClickFix delivery platform associated with malware distribution, including Legion Loader. Some campaigns have also abused malicious ChatGPT Custom GPTs to direct victims to fraudulent websites hosting ClickFix lures. Victims who follow the instructions and execute the supplied commands trigger PowerShell scripts that download an MSI installer, exploit DLL sideloading, and ultimately deploy a remote access trojan (RAT).
Siemens has shared the following indicators of compromise (IOCs):
- 96.62.218[.]59 – Payload hosting and command-and-control (C2).
- wizardexpensive[.]com – Payload hosting and C2.
- 2.27.248[.]127 – Distribution of AllMyBasic.msi.
Organizations are advised to update Siemens Software Center to version 4.0.9.8 or later and launch the application to apply the update. Security teams should block the identified malicious IP addresses and domain, investigate endpoints for SiemensSoftwareCenter.exe executing from AppData\Local\Programs, particularly when launched by msiexec.exe, and hunt for suspicious MSI installations, PowerShell activity, DLL sideloading, and potential RAT deployment.
Impact
- Unauthorized System Access
- Arbitrary Code Execution
- Potential Data Theft
Indicators of Compromise
IP
96.62.218.59
2.27.248.127
MD5
- f4647249fe4293818dda3c9ba2fd2e0d
- 535291b5263cca14c9e8e6b4025ab80f
SHA-256
- f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a
- 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491
SHA1
- de3d53b264b0255e41d1bad4c1142d01f575c17d
- 63bf1d4d88bfaeb7780b7210995d0605b2364f8b
Remediation
- Update Siemens Software Center to version 4.0.9.8 or later and launch the application to apply the update.
- Block the identified malicious IP addresses and domain at firewalls, proxies, and DNS security controls.
- Hunt for SiemensSoftwareCenter.exe executing from AppData\Local\Programs, particularly when launched by msiexec.exe.
- Investigate suspicious MSI installations, including AllMyBasic.msi, and verify their legitimacy.
- Monitor for suspicious PowerShell execution, DLL sideloading, and unauthorized DLL files such as archive.dll.
- Search endpoint and network telemetry for the provided indicators of compromise (IOCs) and related malicious activity.
- Isolate suspected compromised endpoints and investigate potential RAT infections.
- Educate users to avoid executing commands copied from untrusted websites or following suspicious ClickFix instructions.