_{Fig. 8 - Antivirus check}

VM and BIOS check

_{Fig. 9 - VM and BIOS check}

Operating system and OS language check

_{Fig. 10 - Operating system and OS language check}

_{Fig. 11 - Operating system and OS language check (continued)}

If all the above criteria is satisfied, it creates folder in the HOMEDRIVE network and downloads AutoIt executable and encoded script in the folder and creates a shortcut for that folder in Startup:

_{Fig 12 - AutoIT executable}

The above image shows three URLs, which when browsed, drop file in a system network location:

Hxxps://45[.]40.96.231\/AutoIt3 – AutoIt script
Hxxps://45[.]40.96.231\/AutoIt3.exe – AutoIt executable
Hxxps://45[.]40.96.231\/jama1crt – Some dependency file which is responsible for malicious activity

From here, it creates a shortcut that runs on startup:

_{Fig. 13 - Shortcut runs on startup}

AutoIt encoded and de-coded script and analysis:

_{Fig. 14 - AutoIt encoded header (see top left)}

Decoded Script

The decoded script is huge with lots of checks, primarily doing process injection in memory. A part of decoded script shows injection in a PE file which starts with 0x4D5A header for Executable file followed by a BinaryToString conversion of the hexadecimal code responsible for loading DLL into memory and invoking its export function:

_{Fig. 15 - Decoded script}

On execution of AutoIt encoded file and autoit.exe along with dependency file jama1crt mentioned above, it drops a memory dump file. On statically analyzing the memory dump file, we found it again contained embedded AutoIt file:

_{Fig. 16 - Memory dump file contains AutoIt}

This encoded script does rest of the injection in memory by using process like ALLOCATEEXESPACE, UNMAPVIEWSECTION, ALLOCATEEXESPACEATADDRESS and injects malicious code in one of the Microsoft’s legit Process, mobsync.exe:

_{Fig. 17 - Injecting malicious code in mobsynch}

_{Fig. 18 - Injecting malicious code in mobsync (continued)}

Some important behavior performed by the malware that’s worth noting: 1) It checks system language and location 2) It adds processor information to the registry to detect sandboxing and 3) It checks system info

After execution and performing malicious injection in mobsync.exe, it connects to malicious C2s giving out important information such as Computer Name, System Information, User, and admin details and other important information’s.

Conclusion:

The malware is distributed via geo-fenced URLs embedded in the email with the main motive being to steal the credentials from victim’s system by infecting victim’s system with process injection using the AutoIt script and tools. URLs mostly work in the North and South American regions with the intention to steal banking information and act as banking trojans or infostealers.

Once browsed from the email, the URL drops an archive file that contains an .HTA file. The HTA file then connects to a malicious URL and performs a series of activities, including browsing encoded JS via the browser. It later results in dropping the AutoIt script, executable and dependency payload.

When all are executed together, it performs process injection in memory of the system. Being evasive in nature, the file executes checking the system language, location, and other environment variables. After successful execution, it connects to malicious C2s providing sensitive information to attackers.

Additional Information:

While working on the campaign, it was observed apart from following the pattern which is mentioned before, it also actively stole information by phishing techniques and directly dropping executables in archive file.

Protection Statement

Forcepoint customers are protected against this threat at the following stages of attack:

Stage 2 (Lure) – Delivered via weaponized URL embedded in an email. Emails and embedded URLs are blocked by email analytics, web analytics respectively and Real Time Security Analytics.
Stage 3 (Redirect) – Identified redirections to download multiple payloads are categorized and blocked under security classification.
Stage 5 (Dropper File) - The dropper files are added to Forcepoint malicious database and are blocked.
Stage 6 (Call Home) - The malware contacts command and control servers (C&C) for giving out sensitive user data are categorized and blocked under security classification.

Indicator of Compromise:

Initial URL pattern	https:\/\/\d{2,3}\.\d{2,3}\.\d{2,3}\.\d{2,3}\.host\.secureserver\.net
HTA files	37768083ff57e77850667394e0d27e8717e3eb35 c76eff517bd7c5e6d1f8ede73e9d260195e42c42 354b48288f2cc0eeefef2011e5ab38a7cb20fbf7 70ebed2ed13a350e59faa5c254ee099e2653c61e d3402ca43a7ebf6f2b944bf83e62261312761c53
VBS file	8ae1dfa8e9544c0b9a6079aa18708f5fe5a82ee5 4114fb23a7211f0721f87947e8b5b5258f5ed47a 8655717e2a3ced90d352a7faf2586a73cefea7d8
Obfuscated JScript	e156707c3ee3c40ca64f66447c5e36de3ae90eba
AutoIt Script	c1e2c1fddec0ed9676ed8ce38dbaf2006b50a31e
URLs	hxxp://45.40.96[.]231/AutoIt3 hxxp://45.40.96[.]231/AutoIt3.exe hxxp://45.40.96[.]231/jama1crt hxxps://www.rekemchiwdnas.com\/jm1 hxxps:// 198.148.167[.]72.host.secureserver.net/OQQst11/gV7Pus771.js hxxps://198.148.167[.]72.host.secureserver.net/ VFb51.vbs
C2s	www.rekemchiwdnas[.]com jpmorgan-fisrt.homelinux[.]com

AI ネイティブ DSPM新機能

Forcepoint DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint DLP for Email

Data Classification

NGFW

SD-WAN

AI ネイティブ DSPM + DDR

CASB + DLP

あらゆる場所でデータを保護する方法

データ検出＆対応（DDR）ソフトウェアの動画を見る

Forcepoint Data Security Cloud

データ損失防止

コンプライアンスの準備

AI向けのデータセキュリティ

AIによるデータ分類

統合型侵害・インシデント対応準備

ChatGPTのデータ保護

ランサムウェアリスクを抑制

データアクセスガバナンス

内部者リスク保護の自動化

総合的なメールセキュリティ

BYODセキュリティ

Microsoft 365とCopilotの保護

データリスク軽減

金融サービス

医療

製造業

小売業

公共機関

他社ができない方法でクラスタリング

高精度で透明性の高いレポート

ビデオ

ブログ

Webキャスト

ポッドキャスト

分析レポート

顧客事例

リソースライブラリ

トレーニングと認定資格

Cyber EDU

ガイド

データ損失防止のための実践的エグゼクティブガイド

ガイド

Forcepoint AI Mesh

分析レポート

Gartner: 2025 Market Guide for Data Security Posture Management

RISK ASSESSMENT

無料のデータリスクアセスメントのお申込み

当社のアプローチ

当社のお客様

Forcepoint vs. Varonis

Forcepoint vs. Cyera

当社について

ニュースルーム

採用情報

各種お問い合わせ

Forcepoint Trust Hub

VAKIFBANK：セキュリティ体制とコンプライアンスレポートを強化

Eczacıbaşı Holding：セキュリティをクラウドに拡張し、リモートスタッフを保護

Communisis：リスク適応型保護（Risk-Adaptive Protection）によりForcepoint DLPを最新化

Financial Services Blogs & Insights

Reinventing Risk and Compliance for Financial Services

Lionel Menchaca

Unseen Dangers Lurking Behind Evasive Secureserver.net URLs

Prashant Kumar