PureLogs Delivered Through PawsRunner Steganography

Summary

The campaign relies on a phishing email carrying a TXZ archive that delivers a JavaScript loader, which sets environment variables and launches conhost.exe in headless mode. The loader then decrypts a .NET assembly known as PawsRunner, which retrieves PNG images containing hidden encrypted content through steganographic techniques. From those images, the malware extracts the final payload: the PureLogs .NET infostealer. Once active, PureLogs connects to a remote command-and-control server over HTTPS and exfiltrates browser credentials along with system information.

Investigation

Analysis showed that the JavaScript loader pulls commands from process environment variables, launches PowerShell with a hidden window flag, and decrypts an AES-encrypted payload that is executed through .NET reflection. PawsRunner rotates between three network APIs and three different user-agent strings while fetching PNG files, then parses iTXt and IEND chunks to locate the concealed data and decrypts the next stage with RC4. PureLogs in turn uses TripleDES and Gzip to load a downloader DLL, makes TLS-protected HTTP requests to specific endpoints, and collects a broad set of browser-related data from the victim system.

Mitigation

Organizations should block TXZ attachments at the email gateway, monitor for conhost.exe instances running without a visible window, and detect PowerShell launched with the -w hidden flag. Security teams should also deploy signatures for both PawsRunner and PureLogs, restrict outbound traffic to the identified command-and-control domain and IP address, and limit execution of unsigned .NET assemblies. Where possible, steganography detection should be applied to suspicious inbound image files.

Response

If this activity is detected, isolate the affected endpoint, terminate suspicious conhost.exe and PowerShell processes, and remove any dropped .NET binaries from the system. Compromised credentials should be revoked, multi-factor authentication enforced, and stored browser passwords reset. Investigators should also perform network forensics to confirm that no additional command-and-control communication occurred and apply remediation steps to prevent reinfection.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands

  1. Stage 1 – Prepare the encrypted payload
     • The attacker creates a small dummy payload ("secret"), encrypts it with AES‑256 using a known key, Base64‑encodes the ciphertext, and stores it in an environment variable ENC_PAYLOAD.
  2. Stage 2 – Execute the PowerShell decryption loader
     • A one‑liner reads ENC_PAYLOAD, decodes the Base64 string, constructs a .NET AesCryptoServiceProvider, derives the key/IV, decrypts the data, and optionally executes the plaintext.
  3. Stage 3 – Generate detection telemetry
     • The PowerShell command includes the literal word “AES” (e.g., New-Object System.Security.Cryptography.AesCryptoServiceProvider) and is logged as EventID 4104, satisfying the detection rule.

• Regression Test Script

  # -------------------------------------------------
  # PowerShell AES Decryption Simulation (Triggers detection)
  # -------------------------------------------------
  # 1. Define a static 256‑bit key and IV (for demo purposes)
  $key = [byte[]](0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0x10,
                     0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f,0x20)
  $iv  = [byte[]](0xa1,0xa2,0xa3,0xa4,0xa5,0xa6,0xa7,0xa8,0xa9,0xaa,0xab,0xac,0xad,0xae,0xaf,0xb0)
  
  # 2. Plaintext payload (example)
  $plain = [System.Text.Encoding]::UTF8.GetBytes("secret data")
  
  # 3. Encrypt the payload using AES (CBC, PKCS7)
  $aes = [System.Security.Cryptography.AesCryptoServiceProvider]::new()
  $aes.Key = $key
  $aes.IV  = $iv
  $aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
  $aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
  $encryptor = $aes.CreateEncryptor()
  $cipherBytes = $encryptor.TransformFinalBlock($plain,0,$plain.Length)
  $cipherB64 = [Convert]::ToBase64String($cipherBytes)
  
  # 4. Store ciphertext in an environment variable
  
  # 5. Decryption loader – the exact line that will be logged (contains "AES")
  $loader = @"
  `$enc = [System.Environment]::GetEnvironmentVariable('ENC_PAYLOAD')
  `$bytes = [Convert]::FromBase64String(`$enc)
  `$aes = New-Object System.Security.Cryptography.AesCryptoServiceProvider
  `$aes.Key = $($key -join ',')
  `$aes.IV  = $($iv -join ',')
  `$decryptor = `$aes.CreateDecryptor()
  `$plain = `$decryptor.TransformFinalBlock(`$bytes,0,`$bytes.Length)
  `$result = [System.Text.Encoding]::UTF8.GetString(`$plain)
  Write-Output `"Decrypted: `$result`"
  "@
  
  # Execute the loader (will be captured as EventID 4104)
  Invoke-Expression $loader

• Cleanup Commands

  # Remove the environment variable
  
  # Clear any temporary variables from the session
  Remove-Variable -Name key,iv,plain,cipherBytes,cipherB64,loader -ErrorAction SilentlyContinue

Post‑Simulation Validation

1. Run the validation query (KQL example above) but filter for ScriptBlockText contains "AES" to confirm the detection fired.
2. Review the alert details in the SIEM; verify that the alert name matches the rule (if defined) and that severity is reported as High.

Closing Remarks

• The rule successfully detects the straightforward “AES” usage scenario.
• Adversaries can evade by splitting the word (e.g., "AE"+"S"), loading the .NET class via reflection, or performing decryption within compiled binaries.
• Enhancing the rule with behavioral indicators (use of environment variables for ciphertext, high‑entropy strings, creation of AesCryptoServiceProvider objects, and subsequent TransformFinalBlock calls) will improve resilience to simple obfuscation.