We saw a Waterbear loader named "ociw32.dll" inside one of the folders in the %PATH% environmental variable. This DLL name is hardcoded inside "mtxoci.dll" which is loaded by the MSDTC service during boot-up. mtxoci.dll” first tries to query the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value "OracleOciLib" exists. If so, it retrieves the data inside it and loads the corresponding library. If the value doesn't exist, “mtxoci.dll” tries to load "ociw32.dll" instead. During our investigation, we noticed that the value "OracleOciLib" was deleted from the victim's machine, as shown in Figure 2. Hence, the malicious loader "ociw32.dll" was loaded and successfully executed on the host