CGrabber Stealer

However, this loader uses a distinct asynchronous procedure call (APC) based process injection technique to inject additional shellcode into the legitimate Microsoft-signed executable Dllhost.exe.

However, this loader uses a distinct asynchronous procedure call (APC) based process injection technique to inject additional shellcode into the legitimate Microsoft-signed executable Dllhost.exe.

If all of these checks pass, the loader decrypts the next-stage shellcode in memory and executes it... The loader uses the ChaCha20 algorithm with a hardcoded key and nonce for decryption.

Direct-Sys Loader, which performs three separate anti-sandbox and anti-analysis checks before decrypting and executing the next-stage shellcode.

The same three anti-analysis checks are performed for a third time, along with a check for whether the machine is running in a Commonwealth of Independent States (CIS) locale and a check for a mutex indicating the stealer is already running.

The shellcode decompresses and reflectively loads a portable executable (PE) into memory that serves as an additional loader with similar function to Direct-Sys.

The second check decrypts a list of 67 process names associated with binary analysis, sandboxes and debugging tools, compares this list to all active processes and terminates if it finds a match.

Direct-Sys Loader, which performs three separate anti-sandbox and anti-analysis checks before decrypting and executing the next-stage shellcode.

The same three anti-analysis checks are performed for a third time, along with a check for whether the machine is running in a Commonwealth of Independent States (CIS) locale and a check for a mutex indicating the stealer is already running.

The second check decrypts a list of 67 process names associated with binary analysis, sandboxes and debugging tools, compares this list to all active processes and terminates if it finds a match.

The data is aggregated in a ZIP archive and sent via a POST request to the C2 endpoint /api/upload/complete or sent in 1MB chunks to the /api/upload/chunk endpoint if the archive size exceeds 1MB.

If all checks pass, the stealer establishes a connection with a remote command-and-control (C2) server... The data is aggregated in a ZIP archive and sent via a POST request to the C2 endpoint /api/upload/complete or sent in 1MB chunks to the /api/upload/chunk endpoint.

The data is aggregated in a ZIP archive and sent via a POST request to the C2 endpoint /api/upload/complete or sent in 1MB chunks to the /api/upload/chunk endpoint if the archive size exceeds 1MB.

Organizations can defend against this malware by monitoring for syscall stubs in memory, suspicious DLL sideloading activity, outbound POST requests to the attacker’s C2 endpoints and in-memory patching of Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) APIs, another evasive measure leveraged in this campaign.