Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
A trojanized installer posing as the LINE messenger setup was observed delivering a ValleyRAT payload. Built with NSIS and signed using a suspicious certificate, the dropper plants multiple DLL and INI components that support code injection and persistence. The malware then communicates with two Hong Kong–hosted C2 servers to fetch additional malicious binaries. The activity appears aimed at Chinese-speaking users and employs advanced tradecraft, including PoolParty Variant 7 process injection.
Investigation
Cybereason analysts conducted static and dynamic analysis of the fake LINE installer and confirmed use of PowerShell, rundll32, and custom DLL loaders. The chain created artifacts in %AppData% and %LocalAppData%, established synchronization via mutexes, and registered persistence through scheduled tasks created over RPC. Post-install behavior included injection into explorer.exe and UserAccountBroker.exe, consistent with a stealth-focused remote access workflow. Network telemetry identified two C2 IP addresses in Hong Kong used for command retrieval and payload staging. Attribution was assessed as consistent with Silver Fox activity and showed code overlap with SADBRIDGE.
Mitigation
Hunt for the NSIS-packed fake installer and alert on the suspicious certificate thumbprint associated with the signing chain. Monitor for creation of the installer’s dropped file set, related registry modifications, and attempts to add Windows Defender exclusions. Block outbound connectivity to the identified C2 IPs and enforce code-signing controls that reject invalid or untrusted certificates. Add EDR detections for PoolParty Variant 7-style injection patterns and for scheduled-task creation sequences consistent with RPC-based persistence.
Response
If suspected activity is detected, isolate the endpoint, terminate malicious processes, and remove the fake installer and all dropped artifacts. Perform a full sweep for additional ValleyRAT modules, restore Defender settings (including removal of unauthorized exclusions), and delete attacker-created scheduled tasks. Review recent user and host activity for signs of lateral movement, then escalate to incident response for memory capture and deeper forensic collection.
"graph TB %% Class definitions classDef technique fill:#99ccff classDef file fill:#ffcc99 classDef process fill:#ff9999 classDef malware fill:#ccffcc classDef network fill:#dddddd %% Nodes tech_user_exec["<b>Technique</b> – <b>T1204 User Execution</b><br/><b>Description</b>: Victim runs a malicious fake installer (LineInstaller.exe) masquerading as a legitimate LINE installer."] class tech_user_exec technique tech_masquerade["<b>Technique</b> – <b>T1036 Masquerading</b><br/><b>Description</b>: Installer mimics legitimate software name and uses a validu2011looking codeu2011signing certificate."] class tech_masquerade technique tech_event_exec["<b>Technique</b> – <b>T1546.016 Event Triggered Execution: Installer Packages</b><br/><b>Description</b>: NSISu2011based installer executes with elevated privileges via UAC."] class tech_event_exec technique tech_powershell["<b>Technique</b> – <b>T1059.001 PowerShell</b><br/><b>Description</b>: PowerShell adds Windows Defender exclusion paths and stages persistence scripts."] class tech_powershell technique tech_regsvr32["<b>Technique</b> – <b>T1218.010 Regsvr32 Proxy Execution</b><br/><b>Description</b>: Scheduled task invokes regsvr32.exe to trigger DllRegisterServer in intel.dll."] class tech_regsvr32 technique tech_rundll32["<b>Technique</b> – <b>T1218.011 Rundll32 Proxy Execution</b><br/><b>Description</b>: rundll32.exe launches intel.dllu2019s DllRegisterServer."] class tech_rundll32 technique tech_sched_task["<b>Technique</b> – <b>T1053 Scheduled Task</b><br/><b>Description</b>: Malicious scheduled tasks created via RPC calls to the Task Scheduler service."] class tech_sched_task technique tech_sandbox_evasion["<b>Technique</b> – <b>T1497.002 Virtualization/Sandbox Evasion</b><br/><b>Description</b>: intel.dll checks file locks and mutexes to detect sandbox environments."] class tech_sandbox_evasion technique tech_pe_injection["<b>Technique</b> – <b>T1055.002 Process Injection: Portable Executable Injection</b><br/><b>Description</b>: intel.dll and sangee.ini inject shellcode into Explorer.exe using PoolParty Variantu00a07."] class tech_pe_injection technique tech_apc_injection["<b>Technique</b> – <b>T1055.004 Process Injection: Asynchronous Procedure Call</b><br/><b>Description</b>: Injection leverages ZwSetIoCompletion with an I/O Completion Port handle."] class tech_apc_injection technique tech_exploit_defense["<b>Technique</b> – <b>T1211 Exploitation for Defense Evasion</b><br/><b>Description</b>: Malware calls SetTcpEntry to delete TCP connections of security components."] class tech_exploit_defense technique tech_obfuscation["<b>Technique</b> – <b>T1027.005 Obfuscated Files: Indicator Removal</b><br/><b>Description</b>: Antiu2011sandbox and antiu2011analysis checks hide artifacts and prevent execution in analysis environments."] class tech_obfuscation technique tech_web_service["<b>Technique</b> – <b>T1102 Web Service</b><br/><b>Description</b>: Final payload ValleyRat retrieved from remote C2 servers over standard TCP."] class tech_web_service technique file_lineinstaller["<b>File</b> – <b>Name</b>: LineInstaller.exe<br/><b>Type</b>: NSIS installer"] class file_lineinstaller file file_inteldll["<b>File</b> – <b>Name</b>: intel.dll<br/><b>Type</b>: DLL used for proxy execution and injection"] class file_inteldll file file_sangee["<b>File</b> – <b>Name</b>: sangee.ini<br/><b>Purpose</b>: Configuration for injection routines"] class file_sangee file file_policyxml["<b>File</b> – <b>Name</b>: policyManagement.xml<br/><b>Purpose</b>: Defines scheduled task details"] class file_policyxml file file_updatedps1["<b>File</b> – <b>Name</b>: updated.ps1<br/><b>Purpose</b>: PowerShell persistence script"] class file_updatedps1 file malware_valleyrat["<b>Malware</b> – <b>Name</b>: ValleyRat<br/><b>Role</b>: Final payload delivered to victim"] class malware_valleyrat malware process_regsvr32["<b>Process</b> – <b>Name</b>: regsvr32.exe"] class process_regsvr32 process process_rundll32["<b>Process</b> – <b>Name</b>: rundll32.exe"] class process_rundll32 process process_explorer["<b>Process</b> – <b>Name</b>: Explorer.exe"] class process_explorer process network_c2["<b>Network</b> – <b>C2 Servers</b>: 143.92.38.217:18852, 206.238.221.165:443"] class network_c2 network %% Connections tech_user_exec –>|initiates| file_lineinstaller file_lineinstaller –>|triggers| tech_masquerade tech_masquerade –>|enables| tech_event_exec tech_event_exec –>|elevates to| process_regsvr32 process_regsvr32 –>|calls| file_inteldll file_inteldll –>|registered via| tech_regsvr32 tech_regsvr32 –>|also uses| process_rundll32 process_rundll32 –>|loads| file_inteldll tech_rundll32 –>|also loads| file_inteldll file_inteldll –>|creates| tech_sched_task tech_sched_task –>|creates task using| file_policyxml tech_sched_task –>|executes| file_updatedps1 file_updatedps1 –>|runs PowerShell commands for| tech_powershell tech_powershell –>|adds exclusions and prepares| tech_sandbox_evasion tech_sandbox_evasion –>|checks environment before| tech_pe_injection tech_pe_injection –>|injects into| process_explorer tech_pe_injection –>|uses| tech_apc_injection tech_apc_injection –>|leverages| tech_exploit_defense tech_exploit_defense –>|disrupts security tools| file_sangee tech_obfuscation –>|hides artifacts for| malware_valleyrat malware_valleyrat –>|retrieved from| network_c2 network_c2 –>|delivers payload via| tech_web_service tech_web_service –>|final delivery to| process_explorer "
Attack Flow
Detections
Possible Scheduled Task Creation (via powershell)
View
Suspicious Scheduled Task (via audit)
View
Rundll32 Dll Suspicious Path Execution (via process_creation)
View
Windows Defender Preferences Suspicious Changes (via powershell)
View
LOLBAS Regsvr32 (via cmdline)
View
IOCs (DestinationIP) to detect: Fake Installer: Ultimately, ValleyRAT infection
View
IOCs (HashSha1) to detect: Fake Installer: Ultimately, ValleyRAT infection
View
IOCs (SourceIP) to detect: Fake Installer: Ultimately, ValleyRAT infection
View
Fake Installer Detection Using Windows Defender Exclusions and Scheduled Tasks [Windows Powershell]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
-
Attack Narrative & Commands:
An attacker who has already compromised a low‑privilege account wishes to stage a payload on the compromised host while evading antivirus scanning. The attacker:- Uses PowerShell to add a Windows Defender exclusion that covers the entire C: drive, ensuring any malicious binaries placed there are invisible to Defender.
- In the same PowerShell invocation, registers a scheduled task that will launch the hidden payload (
C:Malwarepayload.ps1) every time a specific legitimate process (e.g.,explorer.exe) starts, providing persistence. - Because both actions are combined into a single command line, the telemetry matches the Sigma rule’s
selection1 and selection2condition, causing an alert.
-
Regression Test Script:
# ------------------------------------------------- # Fake Installer Simulation – Triggers Sigma Rule # ------------------------------------------------- # 1. Define exclusion path (entire C: drive) $exclusion = "C:" # 2. Define scheduled task details $taskName = "UpdateScheduler" $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File C:Malwarepayload.ps1" $trigger = New-ScheduledTaskTrigger -AtLogOn # 3. Combine both commands into a single PowerShell command line $combined = "Add-MpPreference -ExclusionPath `"$exclusion`"; Register-ScheduledTask -TaskName `"$taskName`" -Action `$action -Trigger `$trigger -Force" # 4. Invoke the combined command Invoke-Expression $combined -
Cleanup Commands:
# ------------------------------------------------- # Cleanup – Remove exclusion and scheduled task # ------------------------------------------------- # Remove the Defender exclusion for C: Remove-MpPreference -ExclusionPath "C:" # Delete the scheduled task Unregister-ScheduledTask -TaskName "UpdateScheduler" -Confirm:$false