A malicious ZIP named China’s Governance of Rare Earths and its Global Implications.zip contained a password-protected PDF and a lure executable (SecurityKey.exe) that displays the PDF password and then loads shellcode to download further payloads. The loader uses PEB walking, a modified FNV API-hashing routine, wininet.dll for retrieving a payload from www.global-reia[.]com, and executes downloaded shellcode via a fiber. #SecurityKey #global-reia
Keypoints
- The ZIP archive (China’s Governance of Rare Earths and its Global Implications.zip) contained a password-protected PDF and an executable named SecurityKey.exe used as the lure.
- When run, SecurityKey.exe displays the PDF password (202511) and then allocates executable memory, copies embedded shellcode from its .rdata section into that buffer, and executes it.
- The initial shellcode walks the Process Environment Block (PEB) to find the base of ntdll.dll and resolves APIs via a modified FNV-1a 32-bit hashing algorithm.
- wininet.dll is loaded and used to download additional shellcode from www.global-reia[.]com/image-directory/da.mp3 (domain impersonates global-reia.org related to REIA).
- The downloaded stage is executed in an allocated PAGE_EXECUTE_READWRITE buffer and scheduled using fibers (SwitchToFiber), a less common execution technique.
- At the time of analysis the next-stage payload was unavailable, and the analyst did not find sufficient evidence for attribution despite geopolitical context involving rare-earth strategic value and regional submissions from Singapore.
MITRE Techniques
- [T1204 ] User Execution – The campaign relies on tricking the victim into running SecurityKey.exe to retrieve the PDF password (‘…the victim tries to open the PDF, and, when prompted for a password, they are led to running the executable to get the key to unprotect it.’)
- [T1105 ] Ingress Tool Transfer – The shellcode downloads additional shellcode/payload from a remote host using wininet functions (‘…use wininet.dll functions to download additional shellcode from the www.global-reia[.]com/image-directory/da.mp3.’)
- [T1055 ] Process Injection (Local code execution) – The loader allocates PAGE_EXECUTE_READWRITE memory, copies embedded shellcode into it and executes by dereferencing a function pointer (‘…allocates memory with PAGE_EXECUTE_READWRITE permissions…shellcode embedded in the .rdata section…is then copied to the newly allocated buffer and is executed by dereferencing a function pointer to it.’)
- [T1027 ] Obfuscated Files or Information – The malware resolves APIs by hashing with a modified FNV-1a algorithm to hide API names and behavior (‘…API hashing algorithm used by this shellcode seems to be a modified version of the Fowler–Noll–Vo (FNV) algorithm…Modified offset…Modified prime…’)
- [T1106 ] Native API (or Use of Native APIs for stealthy execution) – The shellcode walks the PEB and uses low-level native approaches to locate module bases and resolve functions (‘…walks the Process Environment Block (PEB) to get the base address of ntdll.dll:Once the base address of ntdll.dll is located, it is used to retrieve additional functions using API hashing.’)
- [T1053 ] Scheduled Execution (Fibers as manual scheduling) – The final stage uses fibers and SwitchToFiber to schedule and execute shellcode within the process context (‘…created a fiber and switching to it via the SwitchToFiber API. A fiber is a unit of execution that must be manually scheduled by the application…’)
Indicators of Compromise
- [File hash ] Submitted artifacts – 818dbb421dcb451e41e266be43cfe238dd88c5ac6ce34622f85a9e67551c7583 (China’s Governance of Rare Earths and its Global Implications.zip), 87dd99cb495afb0e3705ff762dfde2da8bc3c3986ba5f84d1df8624aa2e117c2 (SecurityKey.exe)
- [File hash ] Additional binaries – 365cb5c973b7caa106dc112de3e084130ba8c13ae9388d20e5d267a19686b2f7 (embedded shellcode), 037d5d2662a773ecf2f061ffdf1fc0cd6749bcbb3e2bb5bbbaa4a99666d6403e (PDF)
- [Domain ] Host delivering payload – www.global-reia[.]com (payload path: /image-directory/da.mp3) impersonating global-reia.org (Rare Earth Industry Association).
- [IP address ] Infrastructure resolution – 45.93.8[.]97 (domain resolved to this IP during analysis)
- [File name ] Lure filenames – SecurityKey.exe (executable lure), China’s Governance of Rare Earths and its Global Implications.pdf (password-protected document used as bait)
Read more: https://dmpdump.github.io/posts/Reia/