Rapid7’s MDR analyzes the MSIX-based delivery chain for the IDAT Loader, detailing how a Room Planner MSIX installer is used to download and execute the IDAT Loader via a Telegram bot to fetch stages and bypass AMSI. The findings cover typosquatting, malvertising, PowerShell, DLL sideloading, Process Doppelgänging, and Heaven’s Gate used to load SecTop RAT, with IP and domain indicators of compromise. #IDATLoader #RoomPlanner
Keypoints
- The IDAT Loader is a malware loader that retrieves data from PNG offsets starting with 49 44 41 54 (IDAT).
- An MSIX installer flow (Room_Planner-x86.msix) delivered through a typosquatted site leads to the IDAT Loader’s download and execution.
- The infection chain begins with typo-squatted URLs and SEO poisoning to lure users into downloading the malicious MSIX.
- PowerShell scripts (notably 1.ps1) perform asset fingerprinting, IP collection, and fetch of the next-stage payload from a Telegram bot.
- The Telegram API bot delivers a next-stage PowerShell script that fingerprints the host, exfiltrates data, and downloads a GPG-encrypted payload that is decrypted and unpacked for execution.
- The IDAT Loader uses advanced techniques like Process Doppelgänging and Heaven’s Gate to load a final payload (SecTop RAT) into msbuild.exe, with C2 contacting 91.215.85[.]66.
- Rapid7 notes detections and recommends Insight Agent deployment to improve visibility and coverage for the described techniques.
MITRE Techniques
- [T1059.001] Command and Scripting Interpreter – PowerShell – “1.ps1 is used to fingerprint compromised machine and execute additional PowerShell scripts.” ‘1.ps1 is used to fingerprint compromised machine and execute additional PowerShell scripts’
- [T1106] Native API – Heaven’s Gate – “The IDAT injector and IDAT loader are using Heaven’s Gate technique to evade detection.” ‘The IDAT injector and IDAT loader are using Heaven’s Gate technique to evade detection’
- [T1204.002] User Execution: Malicious File – “User executes the binary Room_Planner-x86.msix.” ‘User executes the binary Room_Planner-x86.msix’
- [T1036.005] Masquerading – Match Legitimate Name or Location – “Malicious MSIX masquerades as legitimate Room Planner installer.” ‘Malicious MSIX masquerades as legitimate Room Planner installer’
- [T1140] Deobfuscate/Decode Files or Information – “gpg.exe used to decrypt cr.tar.gpg.” ‘gpg.exe used to decrypt cr.tar.gpg’
- [T1574.001] DLL Search Order Hijacking – “run.exe loads a malicious wbxtrace.dll.” ‘run.exe loads a malicious wbxtrace.dll’
- [T1620] Reflective Code Loading – “PowerShell script loads a binary hosted at kalpanastickerbindi[.]com/1.jpg.” ‘PowerShell script loads a binary hosted at kalpanastickerbindi[.]com/1.jpg’
- [T1055] Process Injection – “IDAT injector implements NtCreateSection + NtMapViewOfSection Code Injection technique to inject into cmd.exe process.” ‘IDAT injector implements NtCreateSection + NtMapViewOfSection Code Injection technique to inject into cmd.exe process’
- [T1055.013] Process Doppelgänging – “IDAT loader implements Process Doppelgänging technique to load the SecTop RAT.” ‘IDAT loader implements Process Doppelgänging technique to load the SecTop RAT’
- [T1497.003] Virtualization/Sandbox Evasion: Time Based Evasion – “Execution delays are performed by several stages throughout the attack flow.” ‘Execution delays are performed by several stages throughout the attack flow’
Indicators of Compromise
- [File] – Room_Planner-x86.msix – 6f350e64d4efbe8e2953b39bfee1040c8b041f6f212e794214e1836561a30c23, and 2 more items (e.g., Run.exe, Dharna.7z)
- [Hash] – 1.ps1 – 928bd805b924ebe43169ad6d670acb2dfe45722e17d461ff0394852b82862d23
- [DLL] – wbxtrace.dll – 1D0DAF989CF28852342B1C0DFEE05374860E1300106FF7788BBA26D84549B845
- [Archive] – Dharna.7z – B7469153DC92BF5DE9BF2521D9550DF21BC4574D0D0CFC919FF26D1071C000B2
- [URL] – read-holy-quran[.]group/ld/cr.tar.gpg – Hosts GPG file containing RAR file
- [URL] – kalpanastickerbindi[.]com/1.jpg – Hosts .NET executable downloaded from API Bot PowerShell script
- [Domain/IP] – 91.215.85[.]66 – SecTop RAT domain/C2