Beware of phishing emails disguised as purchase order confirmation requests (Xloader)
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as requests to confirm purchase orders. The email body prompts recipients to open a malicious DOCX file disguised as a purchase order to verify the order.
[Figure 1] Phishing email body
When a user downloads and opens the attached DOCX file, a malicious RTF document embedded within the Word file is executed by exploiting Word’s “Import Content from Another Document (altChunk)” feature, as shown in [Figure 2].
[Figure 2] Path of the malicious RTF document contained in altChunk
[Figure 3] Malicious RTF document inside the Word file
While Word is processing the malicious RTF document, a malicious VBS file contained within an OLE object inside the document is created at the path `%TMP%\724812.vbs`. Subsequently, an OLE object that exploits CVE-2017-11882—a known vulnerability in the Equation Editor—performs command execution on the VBS file.
Execution command
- CmD.exe/Ccscript %tmp%\724812.vbs
[Figure 4] OLE object embedded in the malicious RTF file
[Figure 5] Command execution for the malicious VBS file embedded in the OLE object
The executed malicious VBS file contains Base64-encoded data, which it saves as a file at the path %TMP%\Quisque.Dal. It also executes the first-stage PowerShell script embedded within it. The generated data file has the structure shown in [Table 1].
[Figure 6] Data inside the malicious VBS file
[Figure 7] Base64-encoded data file
| Start Offset | End Offset | Length | Description |
|---|---|---|---|
| 0X0 | 0X284 | 0X285 | Loader |
| 0X285 | 0X57A7C | 0X577F8 | Payload |
| 0X57A7D | 0X5C997 | 0X4F1B | Secondary PowerShell script |
[Table 1] Data File Structure (Upon Decoding)
When executed, the primary PowerShell script stores the PowerShell execution path and the script itself in the TORO and Laboris registry values, respectively, as shown in [Table 2]. It then ensures persistence by registering the “Cupidatat” value under the “Run” key, causing the stored PowerShell script to execute automatically when the user logs in.
[Figure 8] Registry Registration
| Registry Path | Value Name | Value Data |
|---|---|---|
| HKCU\Environment | TORO | PowerShell.exe Path |
| HKCU\SOFTWARE\AppDataLow | Laboris | Primary PowerShell script |
| HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Cupidatat | %TORO% -w 1 $inwindi=(Get-ItemProperty -Path ‘HKCU:\SOFTWARE\AppDataLow\’).Laboris;%TORO% ($inwindi) |
[Table 2] List of Registry Entries
Subsequently, the first PowerShell script decrypts the file `%TMP%\Quisque.Dal` and executes the second PowerShell script. The second PowerShell script executes the loader malware, passing the encrypted payload as an argument during this process. The loader malware uses an XOR operation to decrypt the received payload and then executes it in memory.
XOR Key
- 0X6B506102
[Figure 9] Execution of the secondary PowerShell script
[Figure 10] Loader Malware Code Execution
[Figure 11] XOR decryption routine of the loader malware
The malware ultimately executed is XLoader, an Infostealer-type malware. XLoader steals sensitive information—such as PC details and browser data—from infected systems and performs various malicious functions, including downloading additional malware.
C2
- Hxxp://www.dumbsplash[.]com/ilto/
[Figure 12] XLoader version information (8.9)
Response Guide
1. Verify the Sender
- Verify that the sender’s email address belongs to an official domain.
2. Check Hyperlinks and Attachments
- If the email prompts you to click on an image attached to the body of the message, check the linked URL first before clicking. Suspicious URLs often lead through non-official paths before finally redirecting to a legitimate page, so you should examine them carefully. Additionally, if there are attachments, check for suspicious file extensions (.Exe, .Vbs, .Js, etc.).
3. Be Cautious When Entering Sensitive Information
- If you are asked to provide sensitive information, such as login credentials, always verify that the page’s URL corresponds to the official website before entering any information. If the page is not official, it is highly likely to be a suspicious URL, so caution is required. In particular, check the page’s security certification (HTTPS, padlock icon) before entering sensitive information, and never enter any information if you have any doubts.
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
