_{Fig. 8 - Antivirus check}

VM and BIOS check

_{Fig. 9 - VM and BIOS check}

Operating system and OS language check

_{Fig. 10 - Operating system and OS language check}

_{Fig. 11 - Operating system and OS language check (continued)}

If all the above criteria is satisfied, it creates folder in the HOMEDRIVE network and downloads AutoIt executable and encoded script in the folder and creates a shortcut for that folder in Startup:

_{Fig 12 - AutoIT executable}

The above image shows three URLs, which when browsed, drop file in a system network location:

Hxxps://45[.]40.96.231\/AutoIt3 – AutoIt script
Hxxps://45[.]40.96.231\/AutoIt3.exe – AutoIt executable
Hxxps://45[.]40.96.231\/jama1crt – Some dependency file which is responsible for malicious activity

From here, it creates a shortcut that runs on startup:

_{Fig. 13 - Shortcut runs on startup}

AutoIt encoded and de-coded script and analysis:

_{Fig. 14 - AutoIt encoded header (see top left)}

Decoded Script

The decoded script is huge with lots of checks, primarily doing process injection in memory. A part of decoded script shows injection in a PE file which starts with 0x4D5A header for Executable file followed by a BinaryToString conversion of the hexadecimal code responsible for loading DLL into memory and invoking its export function:

_{Fig. 15 - Decoded script}

On execution of AutoIt encoded file and autoit.exe along with dependency file jama1crt mentioned above, it drops a memory dump file. On statically analyzing the memory dump file, we found it again contained embedded AutoIt file:

_{Fig. 16 - Memory dump file contains AutoIt}

This encoded script does rest of the injection in memory by using process like ALLOCATEEXESPACE, UNMAPVIEWSECTION, ALLOCATEEXESPACEATADDRESS and injects malicious code in one of the Microsoft’s legit Process, mobsync.exe:

_{Fig. 17 - Injecting malicious code in mobsynch}

_{Fig. 18 - Injecting malicious code in mobsync (continued)}

Some important behavior performed by the malware that’s worth noting: 1) It checks system language and location 2) It adds processor information to the registry to detect sandboxing and 3) It checks system info

After execution and performing malicious injection in mobsync.exe, it connects to malicious C2s giving out important information such as Computer Name, System Information, User, and admin details and other important information’s.

Conclusion:

The malware is distributed via geo-fenced URLs embedded in the email with the main motive being to steal the credentials from victim’s system by infecting victim’s system with process injection using the AutoIt script and tools. URLs mostly work in the North and South American regions with the intention to steal banking information and act as banking trojans or infostealers.

Once browsed from the email, the URL drops an archive file that contains an .HTA file. The HTA file then connects to a malicious URL and performs a series of activities, including browsing encoded JS via the browser. It later results in dropping the AutoIt script, executable and dependency payload.

When all are executed together, it performs process injection in memory of the system. Being evasive in nature, the file executes checking the system language, location, and other environment variables. After successful execution, it connects to malicious C2s providing sensitive information to attackers.

Additional Information:

While working on the campaign, it was observed apart from following the pattern which is mentioned before, it also actively stole information by phishing techniques and directly dropping executables in archive file.

Protection Statement

Forcepoint customers are protected against this threat at the following stages of attack:

Stage 2 (Lure) – Delivered via weaponized URL embedded in an email. Emails and embedded URLs are blocked by email analytics, web analytics respectively and Real Time Security Analytics.
Stage 3 (Redirect) – Identified redirections to download multiple payloads are categorized and blocked under security classification.
Stage 5 (Dropper File) - The dropper files are added to Forcepoint malicious database and are blocked.
Stage 6 (Call Home) - The malware contacts command and control servers (C&C) for giving out sensitive user data are categorized and blocked under security classification.

Indicator of Compromise:

Initial URL pattern	https:\/\/\d{2,3}\.\d{2,3}\.\d{2,3}\.\d{2,3}\.host\.secureserver\.net
HTA files	37768083ff57e77850667394e0d27e8717e3eb35 c76eff517bd7c5e6d1f8ede73e9d260195e42c42 354b48288f2cc0eeefef2011e5ab38a7cb20fbf7 70ebed2ed13a350e59faa5c254ee099e2653c61e d3402ca43a7ebf6f2b944bf83e62261312761c53
VBS file	8ae1dfa8e9544c0b9a6079aa18708f5fe5a82ee5 4114fb23a7211f0721f87947e8b5b5258f5ed47a 8655717e2a3ced90d352a7faf2586a73cefea7d8
Obfuscated JScript	e156707c3ee3c40ca64f66447c5e36de3ae90eba
AutoIt Script	c1e2c1fddec0ed9676ed8ce38dbaf2006b50a31e
URLs	hxxp://45.40.96[.]231/AutoIt3 hxxp://45.40.96[.]231/AutoIt3.exe hxxp://45.40.96[.]231/jama1crt hxxps://www.rekemchiwdnas.com\/jm1 hxxps:// 198.148.167[.]72.host.secureserver.net/OQQst11/gV7Pus771.js hxxps://198.148.167[.]72.host.secureserver.net/ VFb51.vbs
C2s	www.rekemchiwdnas[.]com jpmorgan-fisrt.homelinux[.]com

AI 原生 DSPM现已推出

Forcepoint DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint DLP for Email

Data Classification

NGFW

SD-WAN

AI 原生 DSPM+DDR

CASB + DLP

如何全渠道守护数据安全

查看我们的数据检测与响应 (DDR) 软件的运行效果

Forcepoint Data Security Cloud

防止数据丢失

合规准备

面向 AI 的数据安全

AI 数据分类

统一的泄露与事件准备

保护 ChatGPT 中的数据

缓解勒索软件攻击

数据访问治理

自动化内部风险防护

全方位捍卫电子邮件安全

自带设备安全性

确保 Microsoft 365 和 Copilot 安全性

数据风险缓解

金融服务

医疗保健

制造业

零售业

公共部门

以无人能及的方式实现集群化

精准掌握与透明化报告

博客

视频

网络广播

播客

分析报告

客户案例

资源库

培训和认证

Cyber EDU

指南

数据泄露防护实用管理指南

指南

Forcepoint AI Mesh

分析师报告

Gartner: 2025 Market Guide for Data Security Posture Management

RISK ASSESSMENT

获取免费数据风险评估

我们的方法

我们的客户

Forcepoint 与 Varonis

Forcepoint 与 Cyera

关于我们

新闻中心

加入我们

联系我们

Forcepoint Trust Hub

VAKIFBANK 加强安全态势和合规报告

Eczacıbaşı Holding 将安全防护扩展到云端，为远程员工提供保护

Communisis 通过 Risk-Adaptive Protection 实现 Forcepoint DLP 的现代化

Financial Services Blogs & Insights

Reinventing Risk and Compliance for Financial Services

Lionel Menchaca

Unseen Dangers Lurking Behind Evasive Secureserver.net URLs

Prashant Kumar