VIPKeyLogger - ENCRYPTED.ps1

Question 3: What is the content of decodedAssemblyBytes?

To get the value of the decodedAssemblyBytes, the same technique as before can be used: a breakpoint after the initialization of the variable, executing the code and saving the variable to file:

1
$decodedAssemblyBytes | Out-File .\Desktop\stage3.txt

To be safer, the Invoke-ManagedAssembly execution can be commented out to avoid unwanted execution. Taking a look at the file, the first few lines are:

1
77
2
90
3
144
4
0
5
3
6
0

When in doubt of the content of a file, CyberChef can be useful to automatically identify it. In fact, typing 77 90 in the Input area of CyberChef shows a wand-like icon on the bottom of the page, like the screenshot below:

This will autopopulate the Recipe section with “From Decimal”:

As shown from the output section, 77 90 is translated to MZ, the two bytes indicating a Windows executable. Keeping the same Recipe, the whole content of the file can be pasted into CyberChef and downloaded. This allows us to have the actual executable file. At this point stage3.txt has been renamed as stage3.exe.

Before looking at the content of this new executable, it is useful to see how it gets executed. In Invoke-ManagedAssembly the first argument, RawAssemblyBytes, is the one filled with decodedAssemblyBytes. Within the function it is used as follows:

1
$loadedAssembly = [System.Reflection.Assembly]::Load($RawAssemblyBytes)
2

3
# Get the specified type from the loaded assembly
4
$targetType = $loadedAssembly.GetType($TargetTypeName)
5

6
# Configure binding flags for static public methods
7
$bindingAttributes = [System.Reflection.BindingFlags]::Public -bor [System.Reflection.BindingFlags]::Static

This is a common .NET malware technique where a .NET code is loaded and executed directly from memory via reflection, similar to process injection in that malicious code runs inside a legitimate process without a normal executable launch. The powershell function [System.Reflection.Assembly]::Load is taken directly from .NET netstandard.dll.

Also, note that the Invoke-ManagedAssembly function has other arguments:

1
$executionResult = Invoke-ManagedAssembly -RawAssemblyBytes $decodedAssemblyBytes `
2
                                          -TargetTypeName 'MAFFIA.ProcessHollowing' `
3
                                          -TargetMethodName 'Execute' `
4
                                          -MethodArguments $invocationParameters

TargetTypeName is probably the name of an object or class defined in the code, since it is used in the GetType 5 method, which returns the type of that object, specifically from the Microsoft documentation:

TargetMethodName is then retrieved from the class object:

1
$targetMethod = $targetType.GetMethod($TargetMethodName, $bindingAttributes)

And invoked with the MethodArguments arguments:

1
return $targetMethod.Invoke($null, $MethodArguments)

The arguments are the .NET framework path, and the content of ExecutionPayload.

1
$invocationParameters = [object[]]@($frameworkToolPath, $ExecutionPayload)

We can then safely assume that decodedAssemblyBytes contains a .NET executable, which will be confirmed shortly. We have however the clear objective of having to understand what MAFFIA.ProcessHollowing is.