SourTrade Campaign Delivers Browser-Assembled Malware

Summary

SourTrade is a sophisticated malvertising campaign that impersonates cryptocurrency and trading platforms to target retail investors. Rather than downloading a complete malware payload, the landing page uses a ServiceWorker and SharedWorker to assemble a unique executable directly in the victim’s browser memory from a clean Bun runtime and AES-CTR encrypted blobs. This approach helps bypass traditional file fingerprinting and static hash-based detection.

Investigation

Researchers analyzed the complete execution chain and identified a multi-stage assembly process that relies on a /config endpoint to provide build instructions. The investigation showed that the malware is constructed locally within the browser, generating a unique hash for each victim. The campaign also abuses same-origin ServiceWorker paths to make the malicious download appear as a legitimate file originating from the landing page domain.

Mitigation

Organizations should enforce strong browser security controls and monitor for suspicious ServiceWorker registrations or unusual SharedWorker activity. Improving detection of malvertising through monitoring of programmatic ad delivery patterns can also help reduce exposure. Because the malware is assembled in memory, endpoint behavioral detection is more effective than relying solely on file-based scanning.

Response

If SourTrade activity is detected, affected endpoints should be isolated immediately to prevent further execution of the assembled binary. Investigators should examine browser artifacts, particularly ServiceWorker caches and in-memory blobs. Network logs should also be reviewed for connections to known SourTrade domains and for any unauthorized cryptocurrency transactions originating from the compromised environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary leverages a malvertising link to trigger a drive-by download. Instead of dropping a traditional malware executable, the script downloads a legitimate Bun runtime. To evade static analysis, the payload is assembled dynamically. In this simulation, we mimic the final stage of the SourTrade campaign: the browser (Chrome) is forced to spawn a specially crafted process named browser.exe (the assembled malware) to carry out its malicious instructions. This creates the specific parent-child relationship (chrome.exe -> browser.exe) defined in the detection rule.

• Regression Test Script:

    # Simulation of SourTrade Browser-Assembled Malware
    # 1. Create a dummy 'browser.exe' in a temporary directory to simulate the assembled malware
    $tempPath = "$env:TEMPSourTradeSim"
    if (!(Test-Path $tempPath)) { New-Item -ItemType Directory -Path $tempPath }
    $malwarePath = Join-Path $tempPath "browser.exe"
    New-Item -ItemType File -Path $malwarePath -Force
  
    # 2. Simulate the Chrome process (if not running, we launch it; if running, we use existing PID)
    $chromeProcess = Get-Process chrome -ErrorAction SilentlyContinue
    if ($null -eq $chromeProcess) {
        $chromeProcess = Start-Process "chrome.exe" -PassThru
        Start-Sleep -Seconds 2
    } else {
        $chromeProcess = $chromeProcess[0]
    }
  
    # 3. Execute the 'malware' through the browser process to trigger the rule
    # Note: In a real scenario, this is achieved via browser exploitation/vulnerabilities
    # Here we use Start-Process to simulate the process tree lineage
    Start-Process -FilePath $malwarePath -WorkingDirectory $tempPath
  
    Write-Host "Simulation complete. Check Security Event Logs for Event ID 4688."

• Cleanup Commands:

    # Cleanup simulation artifacts
    Stop-Process -Name "browser" -ErrorAction SilentlyContinue
    Remove-Item -Path "$env:TEMPSourTradeSim" -Recurse -Force -ErrorAction SilentlyContinue