Investigating a Persistent Foothold and Uncovering Its Malware Payload
Summary
Huntress analysts traced a suspicious Run Key to a DLL that contacted an IP address associated with Vawtrak. Static analysis and debugging exposed the decoded network-communication payload.
Key points
- A suspicious Run Key launched regsvr32.exe to load a randomly named DLL from C:\ProgramData; the DLL’s hash had not previously appeared in VirusTotal.
- Strings and imports suggested the DLL acted as a loader.
- Dynamic analysis showed the DLL loading WinSock and attempting to connect to 91.234.34.44 on port 30970.
- The IP had previously been associated with Troj/Agent-AOZZ and the Vawtrak banking trojan; Huntress said the similar persistence method made Vawtrak a likely attribution.
- Using WinDbg, analysts found the decoded payload in memory and confirmed it contained WinSock functions and the connection IP.
Article Details
- Attack Vectors
- A user Run Key launched regsvr32.exe to load a randomly named DLL from C:\ProgramData.
- The DLL attempted to connect to 91.234.34.44 on port 30970.
- Defensive Notes
- The analysts dynamically analyzed the payload in an isolated VM.
- The team notified its partner and provided instructions to remove the foothold; specific removal steps are not included in the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]234[.]34[.]44 | IP address the DLL attempted to contact; the article says it was previously affiliated with Troj/Agent-AOZZ and the Vawtrak banking trojan. |