This Zscaler ThreatLabz research article investigates the latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook. The article provides a detailed analysis of DBatLoader's behavior and its attack process, which includes creating a mock trusted directory, using an executable to load the malicious DLL script, and executing powershell commands in BAT script to exclude Microsoft Defender scanning. The article also highlights the use of different file formats and obfuscation methods to avoid detection from antivirus engines. ThreatLabz in-depth analysis of DBatLoader includes the identification of key indicators of compromise and mapped MITRE ATT&CK techniques used by the attackers. The researchers conclude by recommending that users and organizations stay vigilant against such malspam phishing campaigns and use advanced security solutions to defend against malware.
The ThreatLabz research team at Zscaler remains vigilant in monitoring active threat campaigns. Recently, the team identified a new campaign involving DBatLoader also known as ModiLoader that specifically targets manufacturing companies and various businesses in European countries via phishing emails. The malware payload is distributed through WordPress websites that have authorized SSL certificates, which is a common tactic used by threat actors to evade detection engines. Throughout this campaign, researchers observed multiple techniques employed by the threat actor in the phishing emails to distribute Remcos RAT and Formbook via DBatLoader / ModiLoader.
- Zscaler's ThreatLabz Research team identified a new DBatLoader campaign distributing Remcos RAT and Formbook malware.
- The campaign targets manufacturing companies and multiple businesses in European countries through phishing emails.
- The malicious payload is distributed through WordPress sites with authorized SSL certificates.
- Multiple techniques are used in phishing emails to deceive users into downloading the payload, including using courier-themed schemes and disguising PDF attachments as Revised Order Documents, Payment Invoices, Quotations, Sales Orders, and similar items.
- The attackers use multilayer obfuscation techniques and various file formats, such as PDF, HTML, ZIP, and OneNote, to deliver the payload.
- The malwares analyzed during this investigation uses mock trusted directories to bypass Windows User Account Control (UAC) and elevate to higher privileges without displaying a UAC prompt.
- DBatLoader creates a copy of itself and a file with .url extension for persistence and creates an autorun registry key to survive reboots.
Fig.1 - Campaign targeting manufacturing companies - source: Zscaler Cloud
RemcosRAT Campaign Overview:
This diagram illustrates how the Remcos RAT was distributed and executed on the victim's machine during the campaign:
Fig.2 - Attack chain and execution flow of RemcosRAT
The attack begins with a phishing email titled "Purchase Order SZ5-9-020" that appears to come from a manufacturing company based on a quick examination of the domain and footer. The email is crafted to deceive users into opening the attachments without suspicion. The attached PDF file contains a malicious link labeled "View Secured Document." Clicking on this link downloads a CAB file, which stores installation data and ultimately downloads and executes DBatLoader and Remcos RAT.
Fig.3 - Phishing email with attached malicious PDF
The CAB file that is downloaded includes an LNK file with a PDF extension designed to trick users into opening it. Once the payload is extracted, a PowerShell script is executed to download and run DBatLoader.
Fig.4 - Downloaded CAB file and execution of LNK file
Several similar attacks have been observed from the beginning of this year, all originating from the same WordPress site, using DBatLoader/ModiLoader to download Remcos RAT. The threat actor(s) behind these attacks employs the same attack chain, but pretends to be a different manufacturing company each time to evade detection and deceive victims.
Fig.5 - Similar attack chain with different phishing email
During the investigation of active campaigns, various shortcut files with names like "Quotation.pdf.lnk" and "Revised_Order_Document.pdf.lnk" were discovered. These shortcuts were responsible for downloading DBatLoader/ModiLoader with Remcos RAT from the same WordPress site.
Formbook Stealer Campaign Overview:
During investigation, a courier-themed phishing email was discovered, which delivered Formbook via DBatLoader/ModiLoader. The payload was downloaded from a WordPress site with an .eu (European Union) top-level domain and authorized SSL certificate. Multiple malicious PDFs with embedded links were also found, which used a similar trick to the Remcos RAT campaign to download DBatLoader/Formbook from the WordPress site.
Fig.6 - Formbook campaign attack chain
Other Observed Techniques in DBatLoader Campaign:
Several other phishing emails were discovered during the course of investigating this campaign, using malicious files in various formats such as HTML and OneNote as attachments. These are described below.
In an HTML-based campaign, the threat actor employs a multi-layered obfuscated HTML file as an attachment to deploy the DBatLoader payload on the targeted system.
Fig.7 - HTML-based attachment campaign
Flow of HTML file to drop ISO file which contains DBatLoader payload:
Fig.8 - HTML obfuscation to drop ISO file
In a OneNote attachment campaign, threat actors utilized OneNote attachments to drop the DBatLoader in a campaign targeting various businesses. The latest technique involved hiding the embedded malicious payload behind a fake button, deceiving users into running the malware. Since November 2022, an increase in the use of OneNote files as initial vectors for malware distribution has been observed. To learn more, check out the Zscaler ThreatLabz research blog on OneNote released earlier this month for more detailed information on related campaigns and obfuscation techniques.
Two phishing attacks with the same malspam sender name were discovered in this campaign, and the attached OneNote files contained the embedded DBatLoader payload.
Fig.9 - OneNote attachment campaign
Technical Analysis of DBatLoader/ModiLoader:
DBatLoader/ModiLoader/NatsoLoader is a Delphi compiled binary that drops final payloads like Formbook, Remcos RAT, Netwire RAT, and Warzone RAT. It uses multi-layer obfuscation and image steganography techniques to hide the initial stage from detection engines and download obfuscated later stage payloads from public cloud services like OneDrive and Google Drive. The Loader doesn't use any Anti-Debug/Anti-VM/Anti-Sandbox techniques.
In the first stage, four steps are followed: Extraction, Decoding, Allocation, and Execution.
Step 1 - Extraction:
In this stage Form has been created via the ‘TFormSplash_FormCreate’ in this there is a function named ‘Oncreate()’ which contains the actual Code for the Loader.
Fig.10 -Function Oncreate() contains the Loadercode
DBatLoader's resource section contains a GIF image as the second stage encrypted payload.
Fig.11 - Encrypted GIF payload in resource section
The following function in DBatLoader is responsible for reading encoded data from the 'uski' resource name within the file and subsequently loading it into memory.
Step 2 - Decoding:
Fig.13 - Decoding function
The following is an explanation of the function's logic:
- The encrypted byte from the resource section is added to the number 79.
- If the resulting value exceeds 255, an Overflow occurs, and the excess amount is ignored and stored in a variable.
- Otherwise, the result is stored in the same variable.
- The resulting value is then converted from hexadecimal to string, and individual bytes are retrieved to decode the second stage DLL payload.
Example python script used to decode the payload:
Fig.14 - Python script to decode payload
Step 3 - Allocation:
Once the payload has been decoded, the F_Execution_main function is responsible for allocating the decoded payload into memory.
Fig.15 -Function for memory allocation
The decrypted payload will be allocated in the memory of the DBatLoader's own process through the use of the 'VirtualAlloc' API. This decrypted payload constitutes the second stage DLL, which carries out additional malicious activities of the DBatLoader. It is worth noting that the second stage payload can take the form of either a DLL or an executable (EXE) file.
Fig.16 - VirtualAlloc API used for memory allocation
Step 4 - Execution:
The main function calls another function, passing the decoded value of the second stage as an argument, in order to execute the final payload.
Fig.17 - Function for execution
Once the first-stage DBatLoader loads the decoded second-stage payload into memory, the second-stage payload drops four files on the infected system's disk path 'C:\Users\Public\Libraries'. The dropped files include two batch files named 'XdfiifagO.bat' and 'KDECO.bat', one DLL file named 'netutils.dll', and one executable file named 'easinvoker.exe'.
Fig.18 - Initial Bat script
The first 'XdfiifagO.bat' batch file then leverages a well-known technique of bypassing Windows User Account Control (UAC) called the 'Mock Trusted Directories Method' to escalate privileges without displaying a UAC prompt. This method involves creating a fake directory with extra whitespace and the same name to a legitimate trusted location, such as "C:\Windows \System32", and copying the required files to it.
Since the mock directory cannot be created through the Windows Explorer User Interface, the attacker uses a script to create it. Once the directory is created, the batch file copies the legitimate ‘easinvoker.exe’ executable, the malicious ‘netutils.dll’, and the ‘KDECO.bat’ script into it. The script then executes ‘easinvoker.exe’ from the mock directory and adds a delay using the 'ping 127.0.0.1 -n 6 > nul' command. Finally, the mock directory is deleted.
The auto-elevated ‘easinvoker.exe’ executable is vulnerable to the 'relative path DLL Hijack' variant of DLL Hijacking. Windows automatically elevates this process without displaying a UAC prompt if it is located in a trusted directory. Therefore, the attacker copies ‘easinvoker.exe’ to the mock directory and uses it to load the malicious ‘netutils.dll’, which in turn executes the ‘KDECO.bat’ script.
Fig.19 - Second Bat script
The script 'KDECO.bat' includes PowerShell commands that exclude the 'C:\Users' directory from being scanned by Microsoft Defender.
Fig.20 - Function to create .url file
DBatLoader achieves persistence by creating a copy of itself and a file called ‘gafiifdX.url’ in the 'C:\Users\Public\Libraries' directory. The 'gafiifdX.url' file is an internet shortcut that executes the dropped malicious payload on the system. By using this file, DBatLoader creates an autorun registry key under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' to survive a reboot.
Here is the content of the 'gafiifdX.url' file:
In conclusion, DBatLoader is a sophisticated malware that is actively targeting various businesses, primarily in European countries, with the Remcos RAT. It uses multiple file formats and obfuscation methods to avoid detection from antivirus engines. DBatLoader drops several files, including DLLs, EXEs, and batch files, to perform its malicious activities. The malware is distributed through a phishing campaign that continuously adapts to new distribution mechanisms. Zscaler's Threat Labs team analyzed the behavior of various files associated with DBatLoader using the MITRE ATT&CK framework and displayed the threat scores and techniques triggered. The team is continuously monitoring the campaign and will bring to light any new findings they discover. Organizations must remain vigilant and employ best practices to protect against such threats, including security awareness training and implementing multi-layered security defenses.
Zscaler Sandbox Coverage
Zscaler Sandbox was used to analyze the behavior of different files during the investigation of this campaign, the results show the threat scores and the specific MITRE ATT&CK techniques triggered as shown in the screenshots below.
Fig.21 - DBatLoader/ModiLoader Zscaler sandbox report
Zscaler’s multilayered cloud security platform detects payloads with following threat names:
MITRE ATT&CK Techniques:
Registry Run Keys / Startup Folder
Disable or Modify Tools
Deobfuscate/Decode Files or Information
Obfuscated Files or Information
System Time Discovery
File and Directory Discovery
System Information Discovery
Security Software Discovery
Application Window Discovery
Remote System Discovery
System Network Configuration Discovery
Archive Collected Data
Command and Control
Remote Access Software
Non-Application Layer Protocol
Application Layer Protocol
Indicators of Compromise (IOCs):
Remcos RAT Campaign:
Purchase Order SZ5-9-020.msg
Revised Order Document.pdf
Downloaded CAB file
Extracted LNK file
Downloaded CAB file
Extracted LNK file download payload
Malicious LNK file download payload
Malicious LNK file download payload
Formbook Stealer Campaign:
A0034372876RFQ 02 14 23.msg
Downloaded CAB File
HTML Attached Campaign:
Attached HTML File
Dropped ISO File
DOCX Specification and Drawing Document874559_PDF.exe
Neue Anfrage 8748859GDTE.html
Attached HTML File
Dropped ISO File
Neue Anfrage 8748859GDTE.scr
OneNote Attached Campaign:
PROPERTY PURCHASE & SALE.msg
Attached OneNote File
Attached OneNote File
Initial Bat File
Second Bat File
Legitimate Windows executable
Python script to decode encrypted resource section of DBatLoader -
with open("<YourencodedFile>", "rb") as f:
bytes_read = f.read()
with open ("my_file.dll","wb"):
for b in bytes_read:
newb = b + 79
if newb > 255:
lower_bytes = (newb - 256)
lower_bytes = newb
new_format = format(lower_bytes,'x')
if len(new_format) == 1:
new_format = "0" + new_format
with open("my_file.dll", "ab") as binary_file: