Chinese Malware Delivery Domains Part V

MITRE Techniques

• [T1027] Obfuscated Files or Information – The installers, loader EXEs, DLLs, and batch scripts are heavily obfuscated to hinder analysis (‘heavily obfuscated utilizing OLLVM’, ‘the script is obfuscated’).
• [T1055] Process Injection – The payload is injected into legitimate system processes such as sihost.exe and uhssvc.exe to blend in with normal activity (‘injects the final unpacked DLL payload as a headless PE into a separate, legitimate system process’).
• [T1134.002] Access Token Manipulation: Create Process with Token – The malware uses a UAC bypass to silently elevate privileges through ICMLuaUtil (‘abusing the ICMLuaUtil elevated COM interface’).
• [T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control – The malware bypasses UAC prompts to elevate execution without user interaction (‘silently elevate its privileges without prompting the user’).
• [T1027.016] Junk Code Insertion – The installers are padded with dozens of legitimate files to increase size and frustrate sandboxing (‘artificially padded to sizes ranging from 117MB to over 147MB’).
• [T1105] Ingress Tool Transfer – The campaign delivers payloads via hosted installers and cloud storage locations across multiple legitimate services (‘hosting payloads across major cloud providers’).
• [T1112] Modify Registry – Not observed.
• [T1053.005] Scheduled Task/Job: Scheduled Task – Not explicitly mentioned; persistence instead uses a batch loop and service restart.
• [T1047] Windows Management Instrumentation – The payload uses WMI queries for system enumeration (‘uses WMI queries (ROOTCIMV2) for system enumeration’).
• [T1056.001] Input Capture: Keylogging – The payload uses SetWindowsHookExW and GetAsyncKeyState to capture keystrokes (‘for keylogging’).
• [T1113] Screen Capture – The payload uses GDI/GDI+ functions for screen capture (‘GdipCreateBitmapFromHBITMAP, BitBlt, StretchBlt for screen capture’).
• [T1022] Data Encrypted for Impact – The configuration file is XOR-encrypted with a static key (‘The configuration file is XOR-encrypted using a static 0x62 key’).
• [T1027.003] Steganography – The file masquerades as a PNG image while hiding the payload data (‘masquerade as an 800×600 PNG image’).
• [T1569.002] System Services: Service Execution – The malware registers and launches copies as services to maintain persistence (‘registered and launched as a service via cmd.exe’).
• [T1053.005] Scheduled Task/Job – The watchdog batch file continuously monitors and restarts the malicious service (‘issues an sc start command to restart the obfuscated malicious service’).
• [T1041] Exfiltration Over C2 Channel – The article describes C2 communications but not explicit exfiltration; omitted as not directly stated.
• [T1071.001] Application Layer Protocol: Web Protocols – The payload communicates with C2 using a custom network stack over network channels (‘communicates with its command and control servers’).
• [T1106] Native API – The malware uses VirtualProtect and RtlDecompressBuffer for memory permission changes and unpacking (‘uses VirtualProtect’, ‘uses the RtlDecompressBuffer API’).
• [T1204.002] User Execution: Malicious File – Victims must run fake installers disguised as legitimate software (‘fake installers for DeepSeek and Doubao’).