LausivLoader Analysis: Tracking Data Across Multi-Stage Malware Execution

Summary

A malspam campaign distributes a malicious JavaScript file inside an archive to deploy LausivLoader malware. The attack chain uses an unusual technique to transfer data between stages through process environment variables and temporary files. The infection ultimately progresses through multiple .NET loaders and steganography before delivering the final payload.

Investigation

The analyst identified a JavaScript file inside a .r01 archive that used obfuscated code to launch a PowerShell command through conhost.exe. Further analysis showed that environment variables Kv7408 and Kv562 are used to pass file paths into the PowerShell stage, which then decrypts a .NET executable. A later loader stage uses steganography to extract another payload from a PNG image.

Mitigation

Organizations should enforce strict SPF and DMARC controls to reduce email impersonation. Endpoint protection should detect suspicious WScript and PowerShell activity, especially encoded commands or manipulation of environment variables. Security teams should also monitor for unusual scheduled task creation and conhost.exe execution with the --headless flag.

Response

If LausivLoader activity is detected, affected hosts should be isolated immediately to prevent additional payload execution or lateral movement. Responders should perform memory forensics to identify injected .NET assemblies and inspect %TEMP% and %LOCALAPPDATA% for residual malicious files. Scheduled tasks should also be reviewed for unauthorized entries such as MicrosoftEdgeUpdateTaskCore.

Simulation Execution

• Attack Narrative & Commands: The adversary intends to bypass simple keyword-based command line inspection. To do this, they prepare a Base64 encoded command that performs a simple action (in this case, writing a dummy file to simulate payload deployment). By using the -EncodedCommand parameter, they attempt to hide the cleartext string Write-Output 'Compromised' from casual observation and basic security filters.

• Regression Test Script: This script generates a Base64 encoded version of a simple command and executes it using the exact flag targeted by the detection rule.

  # 1. Define the command to be obfuscated
  $command = "Write-Output 'Detection Test: Encoded Command Executed'"
  
  # 2. Convert the command to Base64 (UTF-16LE is required for PowerShell)
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
  $encodedCommand = [Convert]::ToBase64String($bytes)
  
  # 3. Execute the command using the -EncodedCommand flag to trigger the rule
  Write-Host "Executing encoded command: $encodedCommand"
  Start-Process powershell.exe -ArgumentList "-EncodedCommand $encodedCommand" -Wait

• Cleanup Commands:

  # No persistent artifacts were created by the simulation script.
  # If files were created, they should be deleted here.
  Write-Host "Simulation cleanup complete. No artifacts left."