DBatLoader: Actively Distributing Malwares Targeting European Businesses

Introduction

This Zscaler ThreatLabz research article investigates the latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook. The article provides a detailed analysis of DBatLoader's behavior and its attack process, which includes creating a mock trusted directory, using an executable to load the malicious DLL script, and executing powershell commands in BAT script to exclude Microsoft Defender scanning. The article also highlights the use of different file formats and obfuscation methods to avoid detection from antivirus engines. ThreatLabz in-depth analysis of DBatLoader includes the identification of key indicators of compromise and mapped MITRE ATT&CK techniques used by the attackers. The researchers conclude by recommending that users and organizations stay vigilant against such malspam phishing campaigns and use advanced security solutions to defend against malware.

The ThreatLabz research team at Zscaler remains vigilant in monitoring active threat campaigns. Recently, the team identified a new campaign involving DBatLoader also known as ModiLoader that specifically targets manufacturing companies and various businesses in European countries via phishing emails. The malware payload is distributed through WordPress websites that have authorized SSL certificates, which is a common tactic used by threat actors to evade detection engines. Throughout this campaign, researchers observed multiple techniques employed by the threat actor in the phishing emails to distribute Remcos RAT and Formbook via DBatLoader / ModiLoader.

Key Takeaways

• Zscaler's ThreatLabz Research team identified a new DBatLoader campaign distributing Remcos RAT and Formbook malware.
• The campaign targets manufacturing companies and multiple businesses in European countries through phishing emails.
• The malicious payload is distributed through WordPress sites with authorized SSL certificates.
• Multiple techniques are used in phishing emails to deceive users into downloading the payload, including using courier-themed schemes and disguising PDF attachments as Revised Order Documents, Payment Invoices, Quotations, Sales Orders, and similar items.
• The attackers use multilayer obfuscation techniques and various file formats, such as PDF, HTML, ZIP, and OneNote, to deliver the payload.
• The malwares analyzed during this investigation uses mock trusted directories to bypass Windows User Account Control (UAC) and elevate to higher privileges without displaying a UAC prompt.
• DBatLoader creates a copy of itself and a file with .url extension for persistence and creates an autorun registry key to survive reboots.

Fig.1 - Campaign targeting manufacturing companies - source: Zscaler Cloud

RemcosRAT Campaign Overview 

This diagram illustrates how the Remcos RAT was distributed and executed on the victim's machine during the campaign: 

Fig.2 - Attack chain and execution flow of RemcosRAT

The attack begins with a phishing email titled "Purchase Order SZ5-9-020" that appears to come from a manufacturing company based on a quick examination of the domain and footer. The email is crafted to deceive users into opening the attachments without suspicion. The attached PDF file contains a malicious link labeled "View Secured Document." Clicking on this link downloads a CAB file, which stores installation data and ultimately downloads and executes DBatLoader and Remcos RAT.

Fig.3 - Phishing email with attached malicious PDF

The CAB file that is downloaded includes an LNK file with a PDF extension designed to trick users into opening it. Once the payload is extracted, a PowerShell script is executed to download and run DBatLoader.

Fig.4 - Downloaded CAB file and execution of LNK file

Several similar attacks have been observed from the beginning of this year, all originating from the same WordPress site, using DBatLoader/ModiLoader to download Remcos RAT. The threat actor(s) behind these attacks employs the same attack chain, but pretends to be a different manufacturing company each time to evade detection and deceive victims.

 

Fig.5 - Similar attack chain with different phishing email

During the investigation of active campaigns, various shortcut files with names like "Quotation.pdf.lnk" and "Revised_Order_Document.pdf.lnk" were discovered. These shortcuts were responsible for downloading DBatLoader/ModiLoader with Remcos RAT from the same WordPress site.

Formbook Stealer Campaign Overview 

During investigation, a courier-themed phishing email was discovered, which delivered Formbook via DBatLoader/ModiLoader. The payload was downloaded from a WordPress site with an .eu (European Union) top-level domain and authorized SSL certificate. Multiple malicious PDFs with embedded links were also found, which used a similar trick to the Remcos RAT campaign to download DBatLoader/Formbook from the WordPress site.

Fig.6 - Formbook campaign attack chain

Other Observed Techniques in DBatLoader Campaign

Several other phishing emails were discovered during the course of investigating this campaign, using malicious files in various formats such as HTML and OneNote as attachments. These are described below.

In an HTML-based campaign, the threat actor employs a multi-layered obfuscated HTML file as an attachment to deploy the DBatLoader payload on the targeted system.

Fig.7 - HTML-based attachment campaign

Flow of HTML file to drop ISO file which contains DBatLoader payload:

• HTML -> Base64 Javascript -> Base64 ISO -> Drop ISO File -> DBatLoader payload 

The flow of the HTML file involves dropping an ISO file that contains the DBatLoader payload. The HTML file is first processed through Base64 Javascript, which then leads to the Base64-encoded ISO file. Finally, the ISO file is dropped to execute the DBatLoader payload.

Fig.8 - HTML obfuscation to drop ISO file

In a OneNote attachment campaign, threat actors utilized OneNote attachments to drop the DBatLoader in a campaign targeting various businesses. The latest technique involved hiding the embedded malicious payload behind a fake button, deceiving users into running the malware. Since November 2022, an increase in the use of OneNote files as initial vectors for malware distribution has been observed. To learn more, check out the Zscaler ThreatLabz research blog on OneNote released earlier this month for more detailed information on related campaigns and obfuscation techniques.

Two phishing attacks with the same malspam sender name were discovered in this campaign, and the attached OneNote files contained the embedded DBatLoader payload.

Fig.9 - OneNote attachment campaign

Technical Analysis of DBatLoader/ModiLoader

DBatLoader/ModiLoader/NatsoLoader is a Delphi compiled binary that drops final payloads like Formbook, Remcos RAT, Netwire RAT, and Warzone RAT. It uses multi-layer obfuscation and image steganography techniques to hide the initial stage from detection engines and download obfuscated later stage payloads from public cloud services like OneDrive and Google Drive. The Loader doesn't use any Anti-Debug/Anti-VM/Anti-Sandbox techniques.

 

Stage 1:

In the first stage, four steps are followed: Extraction, Decoding, Allocation, and Execution. 

 

Step 1 - Extraction:

In this stage Form has been created via the ‘TFormSplash_FormCreate’ in this there is a function named ‘Oncreate()’ which contains the actual Code for the Loader.

Fig.10 -Function Oncreate() contains the Loadercode

DBatLoader's resource section contains a GIF image as the second stage encrypted payload.

Fig.11 - Encrypted GIF payload in resource section

The following function in DBatLoader is responsible for reading encoded data from the 'uski' resource name within the file and subsequently loading it into memory.

 

Step 2 - Decoding:

Fig.13 - Decoding function

The following is an explanation of the function's logic:

• The encrypted byte from the resource section is added to the number 79.
• If the resulting value exceeds 255, an Overflow occurs, and the excess amount is ignored and stored in a variable.
• Otherwise, the result is stored in the same variable.
• The resulting value is then converted from hexadecimal to string, and individual bytes are retrieved to decode the second stage DLL payload.

Example python script used to decode the payload:

Fig.14 - Python script to decode payload

 

Step 3 - Allocation:

Once the payload has been decoded, the F_Execution_main function is responsible for allocating the decoded payload into memory.

Fig.15 -Function for memory allocation

The decrypted payload will be allocated in the memory of the DBatLoader's own process through the use of the 'VirtualAlloc' API. This decrypted payload constitutes the second stage DLL, which carries out additional malicious activities of the DBatLoader. It is worth noting that the second stage payload can take the form of either a DLL or an executable (EXE) file.

Fig.16 - VirtualAlloc API used for memory allocation

 

Step 4 - Execution:

The main function calls another function, passing the decoded value of the second stage as an argument, in order to execute the final payload.

Fig.17 - Function for execution

 

Stage 2:

Once the first-stage DBatLoader loads the decoded second-stage payload into memory, the second-stage payload drops four files on the infected system's disk path 'C:\Users\Public\Libraries'. The dropped files include two batch files named 'XdfiifagO.bat' and 'KDECO.bat', one DLL file named 'netutils.dll', and one executable file named 'easinvoker.exe'.

Fig.18 - Initial Bat script

The first 'XdfiifagO.bat' batch file then leverages a well-known technique of bypassing Windows User Account Control (UAC) called the 'Mock Trusted Directories Method' to escalate privileges without displaying a UAC prompt. This method involves creating a fake directory with extra whitespace and the same name to a legitimate trusted location, such as "C:\Windows \System32", and copying the required files to it.

Since the mock directory cannot be created through the Windows Explorer User Interface, the attacker uses a script to create it. Once the directory is created, the batch file copies the legitimate ‘easinvoker.exe’ executable, the malicious ‘netutils.dll’, and the ‘KDECO.bat’ script into it. The script then executes ‘easinvoker.exe’ from the mock directory and adds a delay using the 'ping 127.0.0.1 -n 6 > nul' command. Finally, the mock directory is deleted.

The auto-elevated ‘easinvoker.exe’ executable is vulnerable to the 'relative path DLL Hijack' variant of DLL Hijacking. Windows automatically elevates this process without displaying a UAC prompt if it is located in a trusted directory. Therefore, the attacker copies ‘easinvoker.exe’ to the mock directory and uses it to load the malicious ‘netutils.dll’, which in turn executes the ‘KDECO.bat’ script.

Fig.19 - Second Bat script

The script 'KDECO.bat' includes PowerShell commands that exclude the 'C:\Users' directory from being scanned by Microsoft Defender.

 

Fig.20 - Function to create .url file

DBatLoader achieves persistence by creating a copy of itself and a file called ‘gafiifdX.url’ in the 'C:\Users\Public\Libraries' directory. The 'gafiifdX.url' file is an internet shortcut that executes the dropped malicious payload on the system. By using this file, DBatLoader creates an autorun registry key under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to survive a reboot.

Here is the content of the 'gafiifdX.url' file:

[InternetShortcut]

URL=file:"C:\\Users\\Public\\Libraries\\Xdfiifag.exe"

IconIndex=13

HotKey=49

Conclusion

In conclusion, DBatLoader is a sophisticated malware that is actively targeting various businesses, primarily in European countries, with the Remcos RAT. It uses multiple file formats and obfuscation methods to avoid detection from antivirus engines. DBatLoader drops several files, including DLLs, EXEs, and batch files, to perform its malicious activities. The malware is distributed through a phishing campaign that continuously adapts to new distribution mechanisms. Zscaler's Threat Labs team analyzed the behavior of various files associated with DBatLoader using the MITRE ATT&CK framework and displayed the threat scores and techniques triggered. The team is continuously monitoring the campaign and will bring to light any new findings they discover. Organizations must remain vigilant and employ best practices to protect against such threats, including security awareness training and implementing multi-layered security defenses.

Zscaler Sandbox Coverage

Zscaler Sandbox was used to analyze the behavior of different files during the investigation of this campaign, the results show the threat scores and the specific MITRE ATT&CK techniques triggered as shown in the screenshots below.

Fig.21 - DBatLoader/ModiLoader Zscaler sandbox report

Zscaler’s multilayered cloud security platform detects payloads with following threat names:

• Win32.Downloader.ModiLoader
• Win32.Backdoor.RemcosRAT
• Win32.PWS.Formbook

MITRE ATT&CK Techniques

Indicators Of Compromise (IOCs)

Remcos RAT Campaign

 

Formbook Stealer Campaign

 

HTML Attached Campaign

 

OneNote Attached Campaign 

 

DBatLoader/ModiLoader IoCs

Appendix

Python script to decode encrypted resource section of DBatLoader -

 

with open("<YourencodedFile>", "rb") as f:

  bytes_read = f.read()

with open ("my_file.dll","wb"):

  pass

for b in bytes_read:

  newb = b + 79

  if newb > 255:

    lower_bytes = (newb - 256)

  else:

    lower_bytes = newb

  new_format = format(lower_bytes,'x')

  if len(new_format) == 1:

    new_format = "0" + new_format

  print(new_format)

  with open("my_file.dll", "ab") as binary_file:

    binary_file.write(bytes.fromhex(new_format))