This New Fileless Malware Hides Shellcode in Windows Event Logs

A new malicious campaign has been spotted taking advantage of
Windows event logs to stash chunks of shellcode for the first time
in the wild.

“It allows the ‘fileless’ last stage trojan to be hidden from
plain sight in the file system,” Kaspersky researcher Denis Legezo
said^[1]
in a technical write-up published this week.

The stealthy infection process, not attributed to a known actor,
is believed to have commenced in September 2021 when the intended
targets were lured into downloading compressed .RAR files
containing Cobalt Strike and Silent Break^[2].

The adversary simulation software modules are then used as a
launchpad to inject code into Windows system processes or trusted
applications.

Also notable is the use of anti-detection wrappers as part of
the toolset, suggesting an attempt on the part of the operators to
fly under the radar.

One of the key methods is to keep encrypted shellcode containing
the next-stage malware as 8KB pieces in event logs, a
never-before-seen technique in real-world attacks, that’s then
combined and executed.

The final payload is a set of trojans that employ two different
communication mechanisms — HTTP with RC4 encryption and unencrypted
with named pipes^[3]
— which allow it to run arbitrary commands, download files from a
URL, escalate privileges, and take screenshots.

Another indicator of the threat actor’s evasion tactics is the
use of information gleaned from initial reconnaissance to develop
succeeding stages of the attack chain, including the use of a
remote server that mimics legitimate software used by the
victim.

“The actor behind this campaign is quite capable,” Legezo said.
“The code is quite unique, with no similarities to known
malware.”

The disclosure comes as Sysdig researchers demonstrated^[4]
a way to compromise read-only containers with fileless malware
that’s executed in-memory by leveraging a critical flaw^[5]
in Redis servers.