Order-Themed Emails Deliver XLoader Through LuaJIT and Shared-Section Injection
Summary
Morphisec analyzed an order-themed email campaign that uses obfuscated JScript to drop LuaJIT and a Lua loader, execute XLoader in memory, then transfer it into an x86 process via shared-section mapping and thread-context redirection.
Key points
- The observed Greek- and Slovenian-language order and payment lures used RAR archives containing a single obfuscated JScript; the captured messages did not identify a specific intended organization.
- The JScript extracts an x86 LuaJIT-compatible executable and an extensionless Lua loader from embedded data and writes them to the user’s Documents directory; these components are not retrieved from a server.
- The Lua loader decodes and maps a packed PE into LuaJIT. That stage decrypts and runs the XLoader core on the same thread.
- The loader attempts process-local interference with selected AMSI- and ETW-related functions, but successful patching was not observed. Its scheduled-task persistence path is conditional on a marker that the expected first-run JScript does not create.
- XLoader maps a shared section into LuaJIT and a selected x86 target, then redirects a thread’s execution context to the mapped code. The article distinguishes this from process hollowing and remote-thread injection.
- The recovered code includes an HTTP GET command path, Windows Vault enumeration, and cookie-record preparation. The configured endpoint list contains decoys, so it does not establish which endpoint is the active C2.
Article Details
- Attack Vectors
- Business-themed emails delivered RAR or ZIP archives containing an obfuscated JScript; the messages requested order confirmation, a price quote, or payment-related action.
- Windows Script Host ran the JScript, which extracted an x86 LuaJIT-compatible executable and an extensionless Lua loader from embedded data into the user's Documents directory.
- The Lua loader decoded and manually mapped a packed PE into the LuaJIT process, where it decrypted and executed the XLoader core in memory.
- XLoader cloned its stage into a shared section mapped in LuaJIT and a selected x86 process, then redirected a target thread's execution context to the mapped code.
- A conditional persistence branch could create a VBS launcher and a scheduled task named EHFTUOMQDRXVTJSF; the article does not confirm that this task was created during the analyzed chain.
- Defensive Notes
- Correlate order-themed JScript attachments with the dropped EHFTUOMQDRXVTJSF.exe and FSJTVXRDQMOUTFHE files in the user's Documents directory.
- Investigate attempts to modify AMSI- and ETW-related functions, followed by executable shared-section mapping and x86 thread-context redirection; successful security-function patching was not observed.
- Check for the EHFTUOMQDRXVTJSF task and associated VBS launcher, while treating them as conditional persistence indicators rather than confirmed activity in the analyzed execution.
- The JScript embeds the LuaJIT executable and Lua loader; this stage does not retrieve those components from a server.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 05ecf6621bc2f2303db6bab33cdc231cb1cd08895b4d089f7410b98b21c38c24 | SHA-256 of a malicious order-lure RAR archive. |
| SHA256 | 21eb09400f387066649bec4c7fa63e4d4fd2171fb21a2b2ba182941325d76205 | SHA-256 of the malicious ROQ_O 2828-501.zip archive. |
| SHA256 | 33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22 | SHA-256 of a malicious JScript associated with the campaign. |
| SHA256 | 38a498b126f8fc799a4f36f37b6d955fba6410d7eb02a9922eb21767897a8769 | SHA-256 of the malicious 180SW_2828-501.rar archive. |
| SHA256 | 46e8d2bd454926641176ea67b2e357089ff411c89e524def0158a04b6103d7d4 | SHA-256 of a malicious JScript delivered in the order-lure archive. |
| SHA256 | 685c989f4d89b2402c167075d5d6d6e1f4573c0450adc1de3d8c08c65ed8ee9f | SHA-256 of the dropped Lua loader used to advance the XLoader chain. |
| SHA256 | 6d7aaf1e563032ba46d8e0f1c8eab2b91d383fb2e5d00a1d4fff891f78a3572b | SHA-256 of a captured email associated with the order-lure delivery. |
| SHA256 | 78cb203de34c4a4c1961fe0e3700e6c76ab9b8b71dae9e2de408197fbc82733e | SHA-256 of an order-themed RAR archive containing the JScript chain. |
| SHA256 | 78f08bdefb127c96a64229b591de7b3f984a451796ad132cb26ff54c76d073d4 | SHA-256 of a captured email associated with the order-lure delivery. |
| SHA256 | 896a4ddd93ab1d6fda5d57e71c5b2cf5db32970093350a1111396b2e80dc6686 | SHA-256 of a captured email associated with the malware delivery. |
| SHA256 | be40d790d265afba64626b4e10fa2ff06e80119eb0056974407cf7d8e834745e | SHA-256 of a captured email associated with the malware delivery. |
| SHA256 | d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49 | SHA-256 of the dropped LuaJIT-compatible executable used to run the loader. |
| SHA256 | d87299e4a6457caccb6960c351003cb109748be9ab378cf31611461fce30ac28 | SHA-256 of a malicious order-lure RAR archive. |
| SHA256 | e834ea9cd3025f8070778cf7ef8219976568cc28085feaf974912b64e5b77bc8 | SHA-256 of the RAR archive attached to both captured messages. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JScript used obfuscated strings and embedded encoded components; the Lua loader and native payload also used encoded or encrypted content.T1053.005 · Scheduled TaskA conditional loader branch could create a scheduled task named EHFTUOMQDRXVTJSF to run a VBS launcher every ten minutes; task creation was not confirmed in the analyzed chain.T1055.003 · Thread Execution HijackingXLoader redirected a selected x86 target thread's execution context to a bootstrap in a shared section mapped into the target process.T1059.005 · Visual BasicThe conditional persistence path used a VBS launcher invoked through wscript.exe; the article does not confirm execution of that launcher during the analyzed chain.T1059.007 · JavaScriptWindows Script Host ran the obfuscated JScript that extracted and launched the next-stage components.T1071.001 · Web ProtocolsThe recovered XLoader stage implemented HTTP GET and POST-related network handling, with configured endpoint candidates; the article notes that the real C2 among those candidates was not identified.T1106 · Native APIThe loader and packer used Windows APIs for memory allocation, protection changes, thread creation, and thread-context manipulation.T1140 · Deobfuscate/Decode Files or InformationThe JScript decoded embedded Base64 components, and the Lua loader decoded an embedded packed PE before mapping it into memory.T1555.004 · Windows Credential ManagerThe recovered XLoader code included a Windows Vault enumeration routine.T1562.001 · Disable or Modify ToolsThe Lua loader attempted to interfere with AMSI and ETW by modifying related strings and patching selected ntdll exports; successful patching was not observed.T1566.001 · Spearphishing AttachmentThe campaign delivered malicious JScript in RAR or ZIP attachments to business-themed order and quotation emails.T1620 · Reflective Code LoadingThe Lua loader manually mapped the decoded PE into LuaJIT memory, where the packed PE decrypted and executed the XLoader core.
Malware
Agent TeslaBeyond the chain analyzed here, the campaign also delivered several other payloads, including Agent Tesla, Remcos, and XWorm.RemcosBeyond the chain analyzed here, the campaign also delivered several other payloads, including Agent Tesla, Remcos, and XWorm.XLoaderIn recent months, Morphisec has observed increased XLoader activity using a range of business-themed email lures.XWormBeyond the chain analyzed here, the campaign also delivered several other payloads, including Agent Tesla, Remcos, and XWorm.
Vendors
Products
Automated Moving Target Defense (AMTD)Morphisec Automated Moving Target Defense (AMTD) is designed to prevent malicious in-memory execution, including shellcode and reflective injection techniques.LuaJITThis investigation focuses on a distinct execution chain: an archive containing a single obfuscated JScript that embeds an x86 LuaJIT interpreter, a Lua loader, and an encoded native payload.