Redosdru Malware Hides an Encrypted DLL Payload to Evade On-Disk Detection
Summary
Huntress analyzed a packed Redosdru dropper that downloaded an encrypted DLL, decrypted it in memory, and exposed capabilities including keylogging, clipboard harvesting, and user and group management.
Key points
- Huntress found a UPX-packed wshom.exe in a partner’s network and unpacked it for analysis.
- The dropper fetched NetSyst88.dll from hxxp://xiqiao2[.]f3322[.]org over port 2014 and placed it in Program Files\AppPatch.
- The DLL lacked standard MZ and PE headers, which the researchers interpreted as evidence of encryption or obfuscation to evade on-disk scanning.
- The researchers identified a decryption routine in wshom.exe and extracted the DLL from memory because it was not written to disk in decrypted form.
- Analysis of the decrypted payload found capabilities for recording keystrokes, managing users and groups, killing programs, and harvesting clipboard data.
- Huntress said it used the findings to advise its affected partner about the attacker’s capabilities, client risks, and other locations to inspect.
Article Details
- Attack Vectors
- A UPX-packed executable, wshom.exe, acted as a dropper and downloaded NetSyst88.dll from hxxp://xiqiao2.f3322.org over port 2014 into Program Files\AppPatch.
- The downloaded DLL was encrypted or obfuscated to avoid on-disk signature detection; wshom.exe decrypted it in memory before use.
- Defensive Notes
- Inspect for wshom.exe in C:\Windows\System32 and NetSyst88.dll in Program Files\AppPatch.
- Analyze process memory when a suspicious DLL is not written to disk in decrypted form.
- Review for keystroke recording, clipboard harvesting, user and group management, and program-termination capabilities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xiqiao2[.]f3322[.]org | Reported host from which wshom.exe downloaded the malicious NetSyst88.dll payload. |
| SHA256 | 3394755e45b6cba8fd63160512a847533de89cd88bd8eec3251623e85f67e987 | SHA-256 of the encrypted NetSyst88.dll payload. |
| SHA256 | e62d433e662bff743e8d0fc554c2308db6c72fa500e64091d76e127445f337e1 | SHA-256 of the UPX-packed wshom.exe dropper. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Redosdru-related DLL was encrypted or obfuscated to evade security products inspecting files on disk.T1056.001 · KeyloggingThe decrypted DLL included a capability for recording keystrokes.T1098 · Account ManipulationThe decrypted DLL included a capability for managing users and groups.T1115 · Clipboard DataThe decrypted DLL included a capability for harvesting clipboard data.T1140 · Deobfuscate/Decode Files or Informationwshom.exe decrypted the DLL in memory before the payload was used.
Malware
Tools
Process ExplorerRather than spend time stepping through with a debugger, we simply ran the executable and inspected wshom.exe’s strings in memory with Sysinternal’s Process Explorer.ProcmonWe also verifiedd this with ProcMon and Wireshark:UPXBy manually inspecting the file’s header within a hex editor, we noticed it had been packed with UPX.WiresharkWe also verifiedd this with ProcMon and Wireshark: