cyber.hendryadrian.com
Threat Research · forcepoint.com

Researchers Detail ValleyRAT Campaign Using Signed Overwolf Binary to Sideload Malware

· Original article ↗

Summary

Forcepoint researchers dissected an India-focused ValleyRAT campaign using fake tax notices and a signed Overwolf executable to sideload a DLL; the malware runs in memory, persists via a logon task, and injects into svchost.exe.

Key points

  • The campaign targeted organizations in India with bilingual phishing emails impersonating the Income Tax Department and linking to a spoofed assessment notice at dnfyb[.]vip.
  • The downloaded ZIP contained a legitimately signed Overwolf executable alongside hidden malicious DLL and encrypted .bin files; running the executable sideloaded the DLL.
  • Analysis found the DLL was UPX-packed and modified with Astral-PE. Its loader decrypted and reflectively loaded the ValleyRAT core into memory.
  • The researchers identified a custom RC4-like routine using a 115-byte key for the core payload and a five-byte constant to decrypt the configuration.
  • ValleyRAT checks for administrator privileges, copies its components into a hidden system-folder staging location, and persists through a scheduled task at user logon.
  • The malware hollows svchost.exe and uses it to connect to a C2 endpoint; that endpoint was unresponsive during analysis.
  • Forcepoint says its email analytics, URL categorization, and malicious-file protections block stages of the campaign.

Article Details

Attack Vectors
  • A bilingual phishing email impersonated the Indian Income Tax Department and linked to a spoofed notice page that delivered a ZIP archive.
  • The archive contained a signed Overwolf executable that sideloaded a malicious DLL, which decrypted and reflectively loaded the ValleyRAT core from an accompanying .bin file.
  • ValleyRAT copied the components to C:\Program Files\Common Files, marked them read-only, hidden, and system, and established persistence with a scheduled task at user logon.
  • The malware hollowed svchost.exe and used the resulting process to connect to its C2 endpoint over TCP.
Defensive Notes
  • The article reports that email security analytics identify and block phishing emails associated with these attacks.
  • The article reports that staging URLs are categorized and blocked.
  • The article reports that the dropper files are added to the Forcepoint malicious database and blocked.
  • The article reports that C2 servers are categorized under a security category and blocked.

Indicators of compromise

TypeIndicatorContext
DOMAINcpxxw[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINdnfyb[.]vipStaging site impersonating an Indian tax notice and delivering the ZIP archive.
DOMAINdywwl[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINkangyue[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINkejiwei[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINnsseo[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINrpaai[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINshhswz[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINsuoguan[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINtanlianmeng[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINtaobaoker[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINusheng[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINwayaya[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINyakin[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
DOMAINzbrhcggp[.]vipListed as an embedded download domain found in telemetry associated with the campaign.
IPV4103[.]240[.]196[.]115C2 endpoint contacted by the hollowed process over TCP on port 1234; it was unresponsive during analysis.
SHA1061f3e304c65f3f062f2aacc41b6d6f8a4f43816Hash of the unpacked, Astral-PE-mutated malicious DLL.
SHA107846091fdeb1011cbd80d9ca45fd7dcb40b5c40Hash of the decrypted configuration extracted from the ValleyRAT sample.
SHA12d830905581ae5c29d1e6bad27c6b63a097f79d7Hash of the encrypted configuration extracted from the ValleyRAT sample.
SHA17de942da8993a45a5a7547de0a883f9b13f2f71cHash of teamspeak_control.bin, the encrypted file holding the ValleyRAT core and configuration.
SHA1ab530af5603ce3f98b51b3c6f612074e020f572eHash of the extracted reflective-loader content from Record 1 of the .bin file.
SHA1d03fb03e8969e7ecbd763aa4bdc67a4629e19b10Hash of the file containing the 115-byte key used with the encrypted ValleyRAT payload.
SHA1f062e682ee38b33141ba03b17880b9cacca0e376Hash of teamspeak_control.dll, identified as the malicious loader executed via DLL sideloading.

MITRE ATT&CK

T1027.002 · Software PackingThe malicious DLL was packed with UPX before execution.T1027.013 · Encrypted/Encoded FileThe ValleyRAT payload and configuration were stored in encrypted records in the .bin file.T1036.004 · Masquerade Task or ServiceThe scheduled task masqueraded as a OneDrive entry.T1053.005 · Scheduled TaskThe malware established persistence with a scheduled task configured to run at user logon.T1055.012 · Process HollowingThe RAT hollowed svchost.exe and executed under the appearance of a legitimate Windows service host.T1095 · Non-Application Layer ProtocolThe hollowed process connected to the C2 endpoint over TCP.T1105 · Ingress Tool TransferThe staging page delivered a ZIP archive containing the executable and companion files.T1204.002 · Malicious FileExecution of the downloaded archive's signed executable triggered DLL sideloading.T1564.001 · Hidden Files and DirectoriesThe malware marked its staged components read-only, hidden, and system.T1566.002 · Spearphishing LinkThe phishing email impersonated the Indian Income Tax Department and included a link to a spoofed notice page.T1574.002 · DLL Side-LoadingThe signed executable searched its own folder for dependencies and loaded the attacker-controlled teamspeak_control.dll.T1620 · Reflective Code LoadingA reflective loader decrypted and mapped the ValleyRAT core into memory without writing the core to disk.

People

RaghuIdentified as a senior security researcher with Forcepoint X-Labs whose work includes URL, email, and malware threat research.

Malware

ValleyRATDuring routine threat hunting, we identified an active ValleyRAT campaign targeting organizations in India by impersonating the Indian Income Tax Department. The phishing email contains a link to a spoofed notice page

Vendors

Overwolfnotice page that downloads a ZIP archive. The archive includes a legitimately signed executable from Overwolf, a company that makes overlay software for PC gamers, and two hidden companion files: a malicious DLL

Products

Overwolfnotice page that downloads a ZIP archive. The archive includes a legitimately signed executable from Overwolf, a company that makes overlay software for PC gamers, and two hidden companion files: a malicious DLL

Tools

Astral-PEUPX-packed and Astral-PE-mutated DLLunicornWe executed the file's own unpacking stub inside Unicorn, a CPU emulator that interprets instructions in a private address space without an operating system behind it. Execution was halted as soon as control reached theUPXUPX-packed and Astral-PE-mutated DLL

Countries

IndiaDuring routine threat hunting, we identified an active ValleyRAT campaign targeting organizations in India by impersonating the Indian Income Tax Department. The phishing email contains a link to a spoofed notice page

Related Articles