Keypoints
- IDAT Loader retrieves encrypted payloads from files by searching PNG IDAT offsets (49 44 41 54) and a marker C6 A5 79 EA, then decrypts and decompresses them.
- Initial delivery occurred via drive-by/download of a Rust binary (AppFile_v1.1.exe) that performs filename, debugger, username and process checks to evade sandboxes.
- The Rust dropper extracts a zip from its .rdata, drops live.exe + msidcrl40.dll + dynatron.mdb, and live.exe sideloads msidcrl40.dll which handles IDAT extraction and injection.
- IDAT Loader uses advanced evasion and injection: Process Doppelgänging, Heaven’s Gate (native syscalls), and code injection into cmd.exe → msbuild.exe to execute SecTop RAT (contacts 152.89.217[.]215).
- Post-exploitation includes a second IDAT deployment under C:ProgramData (rvm.exe + vmtools.dll + spank.mpg), which decrypts a 64-bit payload that RC4-decrypts and uses VirtualAlloc/VirtualProtect and process hollowing to deploy a BruteRatel badger contacting updatenazure[.]com.
- Artifacts and IOCs include file hashes (AppFile_v1.1.exe, msidcrl40.dll, vmtools.dll), domains/URLs for payload retrieval, and the SecTop RAT IP address.
- Detection opportunities include monitoring execution from ProgramData, unusual parent/child process relationships, and network connections to the listed domains/IPs.
MITRE Techniques
- [T1189] Drive-by Compromise – Initial access via redirected webpages and drive-by downloads that deliver AppFile_v1.1.exe (‘threat groups utilize malvertising and drive-by downloads’)
- [T1204.002] User Execution: Malicious File – Execution of the Rust dropper by the user triggered the chain (‘user downloading an application, which subsequently triggered the execution of the IDAT Loader’)
- [T1106] Native API – Use of Heaven’s Gate and direct syscalls to evade detection and create/spawn processes (‘The IDAT injector and IDAT loader are using Heaven’s Gate technique to evade detection’)
- [T1055.013] Process Injection: Process Doppelgänging – Loader implements Process Doppelgänging to load and run SecTop RAT (‘IDAT loader implements Process Doppelgänging technique to load the SecTop RAT’)
- [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – Sideloading of tampered DLLs (msidcrl40.dll / vmtools.dll) by legitimate-named binaries (live.exe / rvm.exe) (‘live.exe sideloads the DLL, msidcrl40.dll’)
- [T1140] Deobfuscate/Decode Files or Information – Loader/DLL decrypts encrypted payload files (dynatron.mdb / spank.mpg) before decompression/execution (‘msidcrl40.dll decrypts dynatron.mdb’)
- [T1036] Masquerading – Encrypted payloads masqueraded as benign media (.mdb/.mpg/.png) to avoid suspicion (‘dynatron.mdb file masqueraded to a .png file’)
- [T1497.003] Virtualization/Sandbox Evasion: Time Based Evasion – Multiple execution delays and environment checks (username/process listing) are used to detect and avoid sandboxes (‘Execution delays are performed by several stages throughout the attack flow’)
- [T1055.012] Process Injection: Process Hollowing – Final 64-bit payload performs process hollowing by spawning notepad.exe and injecting code (‘capability to perform process hollowing by starting a new process, notepad.exe, and injecting the code into the newly created process’)
Indicators of Compromise
- [File name] dropper/DLLs – AppFile_v1.1.exe, msidcrl40.dll (dropped by the Rust binary and used to extract IDAT payloads)
- [File name] encrypted payloads – dynatron.mdb, spank.mpg (IDAT-containing encrypted files parsed by the loader)
- [SHA256] sample hashes – AppFile_v1.1.exe: A3A5E7011335A2284E2D4F73FD464FF129F0C9276878A054C1932BC50608584B, msidcrl40.dll: 02D5E281689EC2D4AB8AC19C93321A09113E5D8FA39380A7021580EA1887B7A5 (and other hashes listed)
- [Domain/URL] payload/C2 domains – hxxps://cdn-network-services-001[.]com/update/minor/1/release.json (Rust downloader), updatenazure[.]com (BRC4 C2)
- [IP address] C2 endpoint – 152.89.217[.]215 (observed SecTop RAT communication)
The Rust dropper (AppFile_v1.1.exe) begins by validating its filename and performing anti-analysis checks (IsDebuggerPresent; username and process blacklist decrypted at runtime). If checks pass, it XOR/subtract-decodes content from a retrieved JSON URL (hxxps://cdn-network-services-001[.]com/…), producing a second Rust binary embedded with a zip in its .rdata. That archive is extracted to %TEMP% and drops live.exe, msidcrl40.dll and an encrypted payload (dynatron.mdb). live.exe sideloads the corrupted msidcrl40.dll, which locates IDAT markers (49 44 41 54 followed by C6 A5 79 EA) inside dynatron.mdb, decrypts and decompresses the payload (RtlDecompressBuffer), and injects code into cmd.exe using syscalls and advanced evasion (Process Doppelgänging and Heaven’s Gate).
The injected cmd.exe code decrypts and stages the final payload into msbuild.exe; using the provided extractor the final payload was identified as SecTop RAT, which contacted 152.89.217[.]215. In a follow-on activity the adversary executed a second IDAT loader from C:ProgramData (rvm.exe renamed from rvmsetup.exe) that loads a tampered vmtools.dll and reads IDAT sections from spank.mpg. That chain decrypts a 64-bit payload which allocates memory (VirtualAlloc), makes it executable (VirtualProtect), RC4-decrypts embedded code, and performs process hollowing (spawn notepad.exe / inject) to run a BruteRatel “badger” that reaches out to updatenazure[.]com and performs domain enumeration (nltest /dclist).
Defensive focus should include detection of execution from ProgramData, DLL sideloading by legitimate-sounding binaries, use of unusual syscalls/Heaven’s Gate patterns, process injection/hollowing activity, and network connections to the listed IPs/domains for timely containment and response.
Read more: https://blog.rapid7.com/2024/03/28/stories-from-the-soc-part-1-idat-loader-to-bruteratel/