Full Report
As a follow-up to our previous post, we recently uncovered a really peculiar piece of malware that works through a lot of different layers of abstraction.
Analysis Summary
# Tool/Technique: Multi-Stage DNS-over-HTTPS (DoH) PowerShell Downloader
## Overview
This is a sophisticated, multi-stage malware delivery mechanism that utilizes layers of abstraction to evade detection. Its primary purpose is to establish a foothold and download subsequent payloads by masquerading as legitimate network traffic, specifically leveraging Google's DNS-over-HTTPS (DoH) service and spoofed DKIM (DomainKeys Identified Mail) records.
## Technical Details
- **Type:** Malware Variant / Downloader
- **Platform:** Windows
- **Capabilities:** Obfuscated PowerShell execution, DNS-over-HTTPS communication, payload extraction from TXT records, and masquerading (DKIM).
- **First Seen:** Reported August 20, 2020.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- **T1059.001:** PowerShell
- **T1053.005:** Scheduled Task/Job: Scheduled Task
- **TA0005 - Defense Evasion**
- **T1027:** Obfuscated Files or Information
- **T1140:** Deceptive Component (Masquerading as DKIM)
- **T1202:** Indirect Command Execution
- **TA0011 - Command and Control**
- **T1071.004:** Application Layer Protocol: DNS (DNS-over-HTTPS)
## Functionality
### Core Capabilities
- **Indirect Execution:** Uses a scheduled task to launch `BfeOnService.exe` (a renamed or utilized system binary) to trigger `cmd.exe` and `engine.exe`, eventually executing PowerShell code.
- **De-obfuscation:** Carves out a PowerShell payload from a local decoy file (`a.chk`) by converting decimal values into characters.
- **DoH Communication:** Utilizes `dns.google.com` to resolve TXT records, bypassing traditional DNS filters that only monitor port 53.
### Advanced Features
- **Protocol Masquerading:** The stage-3 payload is delivered via a DNS TXT record formatted to look like a legitimate **DKIM** email authentication record.
- **Complex Delimitation:** Instead of a standard Base64 string, the payload uses forward slashes (`/`) as delimiters within the DKIM `p=` field to hide its true structure from automated decoders.
## Indicators of Compromise
- **File Names:**
- `C:\Windows\a.chk` (Contains decimal-encoded payload)
- `C:\Windows\system32\engine.exe` (Likely a renamed PowerShell or legitimate binary used for execution)
- `C:\Windows\system32\BfeOnService.exe`
- **Network Indicators:**
- `dns.google[.]com/resolve?name=dmarc.jqueryupdatejs[.]com&type=txt`
- `jqueryupdatejs[.]com`
- **Behavioral Indicators:**
- Scheduled tasks executing complex `vbscript:CreateObject` commands.
- PowerShell processes performing web requests to Google's DoH service.
- Unusual decimal-to-char conversion logic in PowerShell command lines.
## Associated Threat Actors
- Not specifically attributed in the article, but the TTPs align with sophisticated actors focusing on long-term persistence and stealth.
## Detection Methods
- **Signature-based detection:** Scan for the specific `a.chk` file structure and the scheduled task string involving `BfeOnService.exe`.
- **Behavioral detection:** Monitor for `cmd.exe` or `powershell.exe` making outbound connections to `dns.google.com`.
- **YARA Rule Strategy:** Look for strings related to the specific DNS query (`dmarc.jqueryupdatejs.com`) or the unique decoding logic `split('x')[-1]`.
## Mitigation Strategies
- **Prevention measures:** Implement strict execution policies for PowerShell and monitor/restrict the use of Scheduled Tasks by non-admin users.
- **Hardening recommendations:**
- Monitor or block access to public DoH providers (like `dns.google`) at the firewall level if the business does not require it.
- Use Endpoint Detection and Response (EDR) to alert on parent-child process anomalies (e.g., a service binary launching `cmd.exe` to run PowerShell).
## Related Tools/Techniques
- **DNS Tunneling:** Similar in concept but uses DoH to remain stealthier.
- **Living off the Land (LotL):** Heavy reliance on legitimate Windows binaries to execute malicious code.
- **App Domain Manager Injection:** Mentioned as a related "hiding in plain sight" technique.