Full Report
In this blog, read along as we investigate a malicious foothold and decode the payload step by step.
Analysis Summary
# Tool/Technique: Vawtrak (Variant) / Malicious DLL Loader
## Overview
This tool is a malicious DLL loader used to establish a persistent foothold on a target system. It utilizes native Windows binaries to execute arbitrary code stored in a randomly named DLL file, serving as a precursor to more advanced payloads like banking trojans or info-stealers.
## Technical Details
- **Type:** Malware family (associated with Vawtrak/Troj/Agent-AOZZ)
- **Platform:** Windows
- **Capabilities:** Persistence, Dynamic Code Execution, Network Communication (C2), Evasion
- **First Seen:** Analyzed by Huntress in September 2021 (IP indicators trace back further to Vawtrak campaigns)
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0002 - Execution**
- T1218.010 - System Binary Proxy Execution: Regsvr32
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Persistence:** Establishes itself via a User Run Key in the Windows Registry to ensure execution upon user login.
- **Proxy Execution:** Leverages `regsvr32.exe` to execute the malicious DLL, a technique used to bypass application whitelisting and blend in with legitimate system processes.
- **Dynamic Loading:** The DLL functions as a loader that allocates memory and resolves function addresses dynamically to execute its secondary payload.
### Advanced Features
- **In-Memory Execution:** The malware decodes a hidden payload and calls it directly from a CPU register (e.g., `EBX`), making static analysis of the network code more difficult as the C2 logic is never stored in the clear on disk.
- **Obfuscation via Proxy:** By converting the DLL header flags, the malware can be treated as an executable during analysis, hinting at a modular design meant to evade simple file-type filters.
## Indicators of Compromise
- **File Names:** `C:\ProgramData\xmNusBQH4865.dll` (Note: The filename is typically randomized, e.g., `[RandomStrings].dll`)
- **Registry Keys:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` with values pointing to `regsvr32.exe` and a DLL in `C:\ProgramData\`.
- **Network Indicators:** `91[.]234[.]34[.]44` on port `30970`.
- **Behavioral Indicators:** `regsvr32.exe` making outbound network connections; `regsvr32.exe` loading unsigned DLLs from the `C:\ProgramData` directory.
## Associated Threat Actors
- **Vawtrak Operators:** The TTPs (Registry Run Keys + Regsvr32 + ProgramData) and the C2 infrastructure are historically linked to the Vawtrak banking trojan ecosystem.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific C2 IP (`91.234.34.44`) or specific rare DLL hashes in `C:\ProgramData`.
- **Behavioral detection:**
- Alerting on `regsvr32.exe` using the `/s` (silent) flag to load files from non-standard locations (like `C:\ProgramData` or `C:\Users\Public`).
- Monitoring for new, suspicious Registry Run Key entries containing `regsvr32.exe`.
## Mitigation Strategies
- **Endpoint Hardening:** Restrict the ability of users to write to or execute from common malware staging areas like `C:\ProgramData`.
- **Attack Surface Reduction:** Use Windows Defender Application Control (WDAC) or AppLocker to block the execution of unsigned DLLs or restrict `regsvr32.exe` from accessing the internet.
- **Monitoring:** Implement centralized logging to audit Registry modifications in the `Run` and `RunOnce` keys.
## Related Tools/Techniques
- **Troj/Agent-AOZZ:** A related malware variant often delivered via exploit kits.
- **Living off the Land Binaries (LOLBins):** The use of `regsvr32.exe` is a classic LOLBin technique to evade detection.