Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns

MITRE Techniques

• [T1566.001 ] Phishing: Spearphishing Attachment – Targeted phishing emails with malicious attachments masquerading as Purchase Orders (‘masquerading as legitimate Purchase Order communications from business partners’).
• [T1190 ] Exploit Public-Facing Application – Use of an exploit for CVE-2017-11882 in Microsoft Equation Editor to weaponize Office documents (‘exploiting CVE-2017-11882’).
• [T1204.002 ] User Execution: Malicious File – Victims open JavaScript, VBScript, or LNK files delivered in archives (‘Extraction of the RAR archive reveals a first-stage malicious JavaScript payload, PO No 602450.js’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – Heavily obfuscated JavaScript reconstructs strings and spawns PowerShell to retrieve second-stage payloads (‘The de-obfuscated JavaScript creates a hidden PowerShell process’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – Hidden PowerShell instance retrieves steganographic payloads and decodes assemblies for reflective loading (‘The decoded PowerShell script functions as a second-stage loader, retrieving a malicious PNG file’).
• [T1047 ] Windows Management Instrumentation – WMI objects used to spawn hidden PowerShell processes (‘creates a hidden PowerShell process using WMI objects (winmgmts:rootcimv2)’).
• [T1027 ] Obfuscated Files or Information – Multi-layer obfuscation including base64 and string manipulation used throughout the chain (‘Multi-layer obfuscation using base64 encoding and string manipulation’).
• [T1027.003 ] Steganography – Payloads steganographically embedded in PNG images hosted on Archive.org and other services (‘malicious payload hidden within PNG image files’).
• [T1620 ] Reflective Code Loading – .NET assembly loaded reflectively in memory to avoid disk writes (‘reflected in memory via Reflection.Assembly::Load’).
• [T1055.012 ] Process Injection: Process Hollowing – Loader creates a suspended RegAsm.exe and injects the decoded payload into its memory (‘creates a new suspended RegAsm.exe process and injects the decoded payload into its memory space’).
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – Execution through legitimate Windows utilities and trojanized libraries to blend with normal activity (‘weaponizing the legitimate open-source TaskScheduler library’ and use of RegAsm/AddInProcess32).
• [T1548.002 ] Abuse Elevation Control Mechanism: Bypass User Account Control – UAC bypass that monitors process creation and triggers prompts to gain elevated PowerShell execution (‘monitors process creation events and opportunistically triggered UAC prompts’).
• [T1497.003 ] Virtualization/Sandbox Evasion: Time-Based Evasion – Use of a 5-second sleep delay to evade automated sandbox analysis (‘with a 5-second sleep delay’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – Extraction of credentials from stored files and browser databases (‘Extraction of credentials from browser databases and configuration files’).
• [T1555.003 ] Credentials from Password Stores: Credentials from Web Browsers – Harvesting saved passwords, cookies, and tokens from multiple browser types (‘Data harvested from a wide range of Chromium-based browsers… Firefox-based browsers’).
• [T1555 ] Credentials from Password Stores – Extraction from password manager applications and browser-based password stores (‘Extraction of credentials from password manager applications’).
• [T1082 ] System Information Discovery – Collection of hardware, OS, and network information for fingerprinting (‘Collection of hardware, OS, and network information’).
• [T1518.001 ] Security Software Discovery – Enumeration of installed antivirus and security products (‘Enumeration of installed antivirus products’).
• [T1005 ] Data from Local System – Collection of cryptocurrency wallets, VPN configs, and email data (‘Collection of cryptocurrency wallets, VPN configs, and email data’).
• [T1114 ] Email Collection – Harvesting email credentials and configurations from desktop email clients (‘Harvesting email credentials and configurations from email clients’).
• [T1102 ] Web Service – Abuse of Archive.org and other web services to host steganographic payloads (‘retrieving a malicious PNG file from Archive.org’).
• [T1041 ] Exfiltration Over C2 Channel – Exfiltration of stolen data to C2 infrastructure at 38.49.210[.]241 (‘Data exfiltration to C2 server at 38.49.210.241’).