_{Fig. 8 - Antivirus check}

VM and BIOS check

_{Fig. 9 - VM and BIOS check}

Operating system and OS language check

_{Fig. 10 - Operating system and OS language check}

_{Fig. 11 - Operating system and OS language check (continued)}

If all the above criteria is satisfied, it creates folder in the HOMEDRIVE network and downloads AutoIt executable and encoded script in the folder and creates a shortcut for that folder in Startup:

_{Fig 12 - AutoIT executable}

The above image shows three URLs, which when browsed, drop file in a system network location:

Hxxps://45[.]40.96.231\/AutoIt3 – AutoIt script
Hxxps://45[.]40.96.231\/AutoIt3.exe – AutoIt executable
Hxxps://45[.]40.96.231\/jama1crt – Some dependency file which is responsible for malicious activity

From here, it creates a shortcut that runs on startup:

_{Fig. 13 - Shortcut runs on startup}

AutoIt encoded and de-coded script and analysis:

_{Fig. 14 - AutoIt encoded header (see top left)}

Decoded Script

The decoded script is huge with lots of checks, primarily doing process injection in memory. A part of decoded script shows injection in a PE file which starts with 0x4D5A header for Executable file followed by a BinaryToString conversion of the hexadecimal code responsible for loading DLL into memory and invoking its export function:

_{Fig. 15 - Decoded script}

On execution of AutoIt encoded file and autoit.exe along with dependency file jama1crt mentioned above, it drops a memory dump file. On statically analyzing the memory dump file, we found it again contained embedded AutoIt file:

_{Fig. 16 - Memory dump file contains AutoIt}

This encoded script does rest of the injection in memory by using process like ALLOCATEEXESPACE, UNMAPVIEWSECTION, ALLOCATEEXESPACEATADDRESS and injects malicious code in one of the Microsoft’s legit Process, mobsync.exe:

_{Fig. 17 - Injecting malicious code in mobsynch}

_{Fig. 18 - Injecting malicious code in mobsync (continued)}

Some important behavior performed by the malware that’s worth noting: 1) It checks system language and location 2) It adds processor information to the registry to detect sandboxing and 3) It checks system info

After execution and performing malicious injection in mobsync.exe, it connects to malicious C2s giving out important information such as Computer Name, System Information, User, and admin details and other important information’s.

Conclusion:

The malware is distributed via geo-fenced URLs embedded in the email with the main motive being to steal the credentials from victim’s system by infecting victim’s system with process injection using the AutoIt script and tools. URLs mostly work in the North and South American regions with the intention to steal banking information and act as banking trojans or infostealers.

Once browsed from the email, the URL drops an archive file that contains an .HTA file. The HTA file then connects to a malicious URL and performs a series of activities, including browsing encoded JS via the browser. It later results in dropping the AutoIt script, executable and dependency payload.

When all are executed together, it performs process injection in memory of the system. Being evasive in nature, the file executes checking the system language, location, and other environment variables. After successful execution, it connects to malicious C2s providing sensitive information to attackers.

Additional Information:

While working on the campaign, it was observed apart from following the pattern which is mentioned before, it also actively stole information by phishing techniques and directly dropping executables in archive file.

Protection Statement

Forcepoint customers are protected against this threat at the following stages of attack:

Stage 2 (Lure) – Delivered via weaponized URL embedded in an email. Emails and embedded URLs are blocked by email analytics, web analytics respectively and Real Time Security Analytics.
Stage 3 (Redirect) – Identified redirections to download multiple payloads are categorized and blocked under security classification.
Stage 5 (Dropper File) - The dropper files are added to Forcepoint malicious database and are blocked.
Stage 6 (Call Home) - The malware contacts command and control servers (C&C) for giving out sensitive user data are categorized and blocked under security classification.

Indicator of Compromise:

Initial URL pattern	https:\/\/\d{2,3}\.\d{2,3}\.\d{2,3}\.\d{2,3}\.host\.secureserver\.net
HTA files	37768083ff57e77850667394e0d27e8717e3eb35 c76eff517bd7c5e6d1f8ede73e9d260195e42c42 354b48288f2cc0eeefef2011e5ab38a7cb20fbf7 70ebed2ed13a350e59faa5c254ee099e2653c61e d3402ca43a7ebf6f2b944bf83e62261312761c53
VBS file	8ae1dfa8e9544c0b9a6079aa18708f5fe5a82ee5 4114fb23a7211f0721f87947e8b5b5258f5ed47a 8655717e2a3ced90d352a7faf2586a73cefea7d8
Obfuscated JScript	e156707c3ee3c40ca64f66447c5e36de3ae90eba
AutoIt Script	c1e2c1fddec0ed9676ed8ce38dbaf2006b50a31e
URLs	hxxp://45.40.96[.]231/AutoIt3 hxxp://45.40.96[.]231/AutoIt3.exe hxxp://45.40.96[.]231/jama1crt hxxps://www.rekemchiwdnas.com\/jm1 hxxps:// 198.148.167[.]72.host.secureserver.net/OQQst11/gV7Pus771.js hxxps://198.148.167[.]72.host.secureserver.net/ VFb51.vbs
C2s	www.rekemchiwdnas[.]com jpmorgan-fisrt.homelinux[.]com

AI 原生 DSPM立即提供

Forcepoint DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint DLP for Email

Data Classification

NGFW

SD-WAN

AI 原生 DSPM + DDR

CASB + DLP

如何保護您所有位置的資料

觀看我們的 Data Detection & Response (DDR) 軟體實際運作

Forcepoint Data Security Cloud

防止數據丟失

合規準備情況

AI 的數據安全

AI 資料分類

統一的違規和事件準備

保護 ChatGPT 中的資料

緩解勒索軟體

數據訪問治理

自動化內部風險防護

全面的電子郵件安全

BYOD 安全性

保護 Microsoft 365 和 Copilot

資料風險緩解

金融服務業

醫療保健

製造業

零售業

公共部門

以一種其他人無法做到的方式進行集羣

精確度和透明的報告

影片

部落格

網路廣播

播客

分析師報告

顧客故事

資源庫

訓練與認證

Cyber EDU

指南

資料遺失防護的實際執行指南

指南

Forcepoint AI Mesh

分析報告

Gartner: 2025 Market Guide for Data Security Posture Management

RISK ASSESSMENT

獲取免費的資料風險評估

我們的方法

我們的客戶

Forcepoint 與 Varonis 比較

Forcepoint 與 Cyera 比較

關於我們

新聞中心

與我們共事

聯絡我們

Forcepoint Trust Hub

VAKIFBANK 加強安全態勢和合規性報告

Eczacıbaşı Holding 將安全擴展到雲端，以保護遠端員工

Communisis 透過 Risk-Adaptive Protection 實現 Forcepoint DLP 的現代化

Financial Services Blogs & Insights

Reinventing Risk and Compliance for Financial Services

Lionel Menchaca

Unseen Dangers Lurking Behind Evasive Secureserver.net URLs

Prashant Kumar