A recent phishing campaign is distributing a variant of the PureLogs malware, designed to steal sensitive data from compromised Windows systems. The campaign employs a multi-stage attack chain involving obfuscated JavaScript, PowerShell, and process hollowing techniques.
The phishing emails are crafted to appear as legitimate purchase orders, a common social engineering tactic to entice recipients into opening malicious attachments. These emails contain a RAR archive, which, when opened, reveals a JavaScript file named "kpankocrs.js."
Upon execution, this JavaScript file decrypts and drops a PowerShell script into a temporary directory. The JavaScript engine, wscript.exe, then launches a PowerShell process to execute this dropped script.
The PowerShell script itself is heavily obfuscated, containing encrypted and Base64-encoded data. After decoding and decryption, it reveals a fileless PowerShell script that utilizes the process hollowing technique. This technique involves injecting malicious code into a legitimate running process. In this campaign, the target process is MsBuild.exe, located in the .NET Framework directory.
The process hollowing is performed by a .NET module, identified as "MAFF," which leverages several Windows APIs, including CreateProcessA, ZwUnmapViewOfSection, ReadProcessMemory, WriteProcessMemory, VirtualAllocEx, GetThreadContext, SetThreadContext, and ResumeThread. This allows the malware to create a suspended MsBuild.exe process and then replace its legitimate code with malicious content.
Once the malicious code is running within the MsBuild.exe process, it extracts another .NET module from its resources. This module, named "Iwnflr.exe," is responsible for decrypting and gunzipping a downloader module, "Rmiyj.dll," which is then loaded into memory.
The downloader module is capable of communicating with a command and control (C2) server to fetch additional plugins. It retrieves C2 server information and an AES encryption key from its configuration resources. The downloader initiates communication by sending a GET request to the C2 server and subsequently sends a POST request containing an AES-encrypted payload to download further modules.
The final stage involves the execution of a fileless PureLogs variant, identified as "zgSGkYYzqVe.dll." This module, residing entirely in memory, is designed to collect sensitive data from the victim's computer. The analysis indicates that this PureLogs variant may be protected by commercial obfuscation tools. The overall severity of this campaign is rated as high due to its ability to exfiltrate sensitive information.
