Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
A Chinese APT group called Silver Fox conducts a tax‑themed phishing campaign against Indian entities. The initial email contains a PDF that directs victims to a malicious domain and triggers a download of a ZIP file. The ZIP contains an NSIS installer that drops Thunder.exe and a malicious libexpat.dll which performs DLL hijacking, anti‑analysis checks, and loads encrypted shellcode. The final payload is a Valley RAT that receives configuration from a multi‑tier C2 infrastructure.
Investigation
The report details four stages: (1) delivery of a ZIP via a PDF lure, (2) execution of an NSIS installer that drops Thunder.exe and libexpat.dll, (3) a Donut‑generated shellcode loader that injects into explorer.exe, and (4) deployment of Valley RAT with registry‑based persistence and modular plugins. The analysis includes static and dynamic examination of the binaries, enumeration of C2 domains, and mapping to ATT&CK techniques.
Mitigation
Defenders should monitor for signed binaries loading unsigned DLLs from temporary locations, registry writes under HKCUConsole, and abnormal creation of PAGE_EXECUTE_READWRITE memory in explorer.exe. Blocking known C2 domains and IPs, and detecting multi‑tier fallback behavior will reduce exposure. Implement strict application control and sandbox evasion detection to stop the initial NSIS installer.
Response
When an indicator is observed, isolate the affected host, collect volatile memory for process injection analysis, and search for Valley RAT registry keys and plugins. Block all identified C2 infrastructure and reset compromised credentials. Conduct a full forensic review to identify any additional plugins or lateral movement tools.
"graph TB %% Class definitions classDef technique fill:#ddeeff classDef file fill:#ffddaa classDef process fill:#ffccbb classDef action fill:#cce5ff %% Nodes u2013 Techniques initial_phishing["<b>Initial Access – T1566.001</b><br/>Spearphishing Attachment<br/>Victim opens malicious Incomeu2011Tax PDF that redirects to ggwk.cc and triggers a ZIP download"] class initial_phishing technique user_execution["<b>User Execution – T1204.002</b><br/>Malicious File<br/>User runs the downloaded ZIP containing an NSIS installer"] class user_execution technique cmd_scripting["<b>Execution – T1059</b><br/>Command and Scripting Interpreter<br/>NSIS script drives the installation workflow"] class cmd_scripting technique native_api_1["<b>Execution – T1106</b><br/>Native API<br/>Installer calls GetTempPathA, creates a temporary working directory and writes files"] class native_api_1 technique shared_modules["<b>Execution – T1129</b><br/>Shared Modules<br/>Installer drops Thunder.exe (signed) and malicious libexpat.dll"] class shared_modules technique dll_hijack["<b>Defense Evasion – T1574.001</b><br/>DLL Search Order Hijacking<br/>libexpat.dll placed beside Thunder.exe so it is loaded first"] class dll_hijack technique proxy_execution["<b>Defense Evasion – T1218</b><br/>System Binary Proxy Execution<br/>Thunder.exe used as a proxy to execute the malicious DLL"] class proxy_execution technique trusted_proxy["<b>Defense Evasion – T1127</b><br/>Trusted Developer Utilities Proxy Execution<br/>Signed Thunder.exe masks malicious activity"] class trusted_proxy technique dll_injection["<b>Execution – T1055.001</b><br/>Dynamicu2011link Library Injection<br/>libexpat.dll runs antiu2011analysis checks and disables Windows Update service"] class dll_injection technique service_execution["<b>Execution – T1569.002</b><br/>Service Execution<br/>Stops wuauserv service to reduce visibility"] class service_execution technique sandbox_evasion["<b>Defense Evasion – T1497</b><br/>Virtualization/Sandbox Evasion<br/>Antiu2011debug and sandbox detection logic terminates execution in analysis environments"] class sandbox_evasion technique native_api_2["<b>Execution – T1106</b><br/>Native API<br/>Uses VirtualAllocEx and WriteProcessMemory to inject shellcode into explorer.exe"] class native_api_2 technique process_hollowing["<b>Defense Evasion – T1055.012</b><br/>Process Hollowing<br/>Explorer.exe launched in suspended state and payload hollowed into it"] class process_hollowing technique reflective_loading["<b>Execution – T1620</b><br/>Reflective Code Loading<br/>Donutu2011generated loader runs a managed payload entirely in memory"] class reflective_loading technique registry_persistence["<b>Persistence – T1547.001</b><br/>Registry Run Keys / Startup Folder<br/>Valley RAT stores plugin modules in HKCU\Console\* as REG_BINARY values"] class registry_persistence technique modify_registry["<b>Persistence – T1112</b><br/>Modify Registry<br/>Configuration parameters (C2 addresses, feature flags) written to the registry"] class modify_registry technique c2_web["<b>Command and Control – T1071.001</b><br/>Web Protocols<br/>Primary C2 communication over HTTP/HTTPS"] class c2_web technique c2_raw_tcp["<b>Command and Control – T1095</b><br/>Nonu2011Application Layer Protocol<br/>Supports raw TCP fallback when HTTP fails"] class c2_raw_tcp technique encrypted_channel["<b>Command and Control – T1573</b><br/>Encrypted Channel<br/>All C2 traffic and configuration payloads are encrypted"] class encrypted_channel technique fallback_channels["<b>Command and Control – T1008</b><br/>Fallback Channels<br/>Threeu2011tier C2 hierarchy with automatic failover"] class fallback_channels technique keylogging["<b>Collection – T1056.001</b><br/>Input Capture: Keylogging<br/>Keylogger capability enabled via configuration flag"] class keylogging technique obfuscation["<b>Defense Evasion – T1027</b><br/>Obfuscated Files or Information<br/>Payload stored encrypted in box.ini and decrypted at runtime"] class obfuscation technique code_signing["<b>Defense Evasion – T1553.002</b><br/>Subvert Trust Controls: Code Signing<br/>Legitimate signed Thunder.exe masks malicious activity"] class code_signing technique appcert_dll["<b>Defense Evasion – T1546.009</b><br/>Event Triggered Execution: AppCert DLLs<br/>Malicious libexpat.dll leverages DLL hijacking for execution"] class appcert_dll technique %% Nodes u2013 Files / Processes file_zip["<b>File</b><br/>Malicious ZIP containing NSIS installer"] class file_zip file nsis_installer["<b>File</b><br/>NSIS installer executed by the user"] class nsis_installer file thunder_exe["<b>File</b><br/>Signed Thunder.exe used as proxy"] class thunder_exe file libexpat_dll["<b>File</b><br/>Malicious libexpat.dll"] class libexpat_dll file box_ini["<b>File</b><br/>Encrypted configuration payload (box.ini)"] class box_ini file explorer_exe["<b>Process</b><br/>explorer.exe (target for injection)"] class explorer_exe process donut_loader["<b>File</b><br/>Donutu2011generated reflective loader"] class donut_loader file %% Connections u2013 Attack Flow initial_phishing –>|downloads| file_zip file_zip –>|contains| nsis_installer nsis_installer –>|executes| user_execution user_execution –>|triggers| cmd_scripting cmd_scripting –>|uses| native_api_1 native_api_1 –>|writes| shared_modules shared_modules –>|drops| thunder_exe shared_modules –>|drops| libexpat_dll thunder_exe –>|enables| dll_hijack dll_hijack –>|facilitates| proxy_execution proxy_execution –>|leverages| trusted_proxy trusted_proxy –>|loads| dll_injection dll_injection –>|disables| service_execution service_execution –>|reduces visibility| sandbox_evasion sandbox_evasion –>|continues| native_api_2 native_api_2 –>|injects into| explorer_exe explorer_exe –>|hollowed by| process_hollowing process_hollowing –>|runs| reflective_loading reflective_loading –>|uses| donut_loader donut_loader –>|establishes| registry_persistence registry_persistence –>|stores| modify_registry modify_registry –>|configures| c2_web c2_web –>|fallback to| c2_raw_tcp c2_raw_tcp –>|secured by| encrypted_channel encrypted_channel –>|supports| fallback_channels fallback_channels –>|delivers| keylogging keylogging –>|records input| obfuscation obfuscation –>|protects| code_signing code_signing –>|masks| appcert_dll appcert_dll –>|executes via| dll_hijack %% Styling class initial_phishing,user_execution,cmd_scripting,native_api_1,shared_modules,dll_hijack,proxy_execution,trusted_proxy,dll_injection,service_execution,sandbox_evasion,native_api_2,process_hollowing,reflective_loading,registry_persistence,modify_registry,c2_web,c2_raw_tcp,encrypted_channel,fallback_channels,keylogging,obfuscation,code_signing,appcert_dll technique class file_zip,nsis_installer,thunder_exe,libexpat_dll,box_ini,donut_loader file class explorer_exe process "
Attack Flow
Detections
Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)
View
Suspicious Command and Control by Unusual Top Level Domain (TLD) DNS Request (via dns)
View
Suspicious Process without Arguments (via cmdline)
View
IOCs (SourceIP) to detect: Silver Fox Targeting India Using Tax Themed Phishing Lures
View
IOCs (HashSha256) to detect: Silver Fox Targeting India Using Tax Themed Phishing Lures
View
IOCs (DestinationIP) to detect: Silver Fox Targeting India Using Tax Themed Phishing Lures
View
Detection of DLL Hijacking via Thunder.exe and Process Injection into Explorer.exe [Windows Process Creation]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands:
An adversary delivers a malicious DLL alongside a dropped “Thunder.exe” to the victim’s%TEMP%directory. To avoid user suspicion, the payload is launched via the already‑runningexplorer.exeprocess using the WindowsShellExecuteAPI, which results in a process‑creation event whereexplorer.exeappears as the parent. The maliciousThunder.exesubsequently loads the malicious DLL (DLL hijacking) and injects shellcode into theexplorer.exeprocess (process injection), achieving code execution with the user’s token. -
Regression Test Script:
# ------------------------------------------------- # Regression script to trigger the Sigma detection # ------------------------------------------------- # 1. Prepare a fake Thunder.exe (copy of notepad.exe) $tempDir = "$env:TEMP" $thunderPath = Join-Path -Path $tempDir -ChildPath "Thunder.exe" Copy-Item -Path "$env:SystemRootsystem32notepad.exe" -Destination $thunderPath -Force # 2. (Optional) Drop a malicious DLL next to it to mimic hijacking $malDll = Join-Path -Path $tempDir -ChildPath "malicious.dll" # For demonstration we just create an empty file; in a real test this would be a crafted DLL. New-Item -Path $malDll -ItemType File -Force | Out-Null # 3. Launch Thunder.exe via explorer.exe using ShellExecute (simulated with Start-Process -Verb RunAs) $explorer = (Get-Process -Name explorer).Id # Use PowerShell to start the process with explorer as the parent (requires low‑level API; here we approximate) Start-Process -FilePath $thunderPath -ArgumentList "" -PassThru | Out-Null # 4. Wait a short period to allow logs to be generated Start-Sleep -Seconds 5 # 5. Clean‑up (handled in the next section) -
Cleanup Commands:
# ------------------------------------------------- # Cleanup after the simulation # ------------------------------------------------- # Remove the fake Thunder.exe and dummy DLL from %TEMP% Remove-Item -Path "$env:TEMPThunder.exe" -Force -ErrorAction SilentlyContinue Remove-Item -Path "$env:TEMPmalicious.dll" -Force -ErrorAction SilentlyContinue # Optionally terminate any lingering Thunder.exe processes Get-Process -Name "Thunder" -ErrorAction SilentlyContinue | Stop-Process -Force