Windows Malware Campaign Uses In-Memory Loaders and Live Chat to Control Victims

CyberDefender 9 mins0

Security analysts uncovered a highly evasive Windows malware operation that combines a live interactive remote access tool with a powerful .NET infostealer, delivered and executed in memory to avoid detection. The attack chain uses living-off-the-land techniques, in-memory payload execution, and multiple persistence mechanisms — all designed to make discovery and analysis difficult.

Source : Point Wild

This investigation revealed a highly sophisticated, multi-stage Windows malware campaign built to quietly slip past traditional security defenses. The attackers rely heavily on living-off-the-land techniques and in-memory execution, allowing the malware to operate with minimal footprint on disk. The infection begins with a concealed batch file that establishes persistence through a per-user Run registry key, then extracts and launches an embedded PowerShell loader while carefully limiting forensic artifacts.

Once executed, the PowerShell stage decrypts and injects Donut-generated shellcode directly into legitimate Windows processes. To stay resilient and avoid detection, the malware uses delayed execution, process migration, and a watchdog routine that reinjects the payload if the host process is interrupted. Analysis of the decrypted shellcode revealed a heavily obfuscated .NET payload that delivers both a full-featured infostealer and a remote access framework.

The malware employs advanced anti-analysis defenses, including anti-VM checks, anti-debugging logic, and safeguards against process-injection monitoring. At the same time, it carries out extensive credential harvesting, system surveillance, and remote control of the infected host. Collected data is bundled into ZIP archives and exfiltrated using Discord webhooks and Telegram bots, blending malicious traffic into common platforms.

Overall, this campaign represents a modern, high-evasion Windows malware operation designed for long-term persistence and large-scale data theft. It highlights a growing trend toward in-memory loaders and modular .NET malware, reinforcing the challenges defenders face in detecting today’s stealth-focused threats.

How the Attack Works: Step by Step

1. Initial Dropper (Obfuscated Batch File)

  • The campaign starts with a simple but obfuscated batch script that gets copied to a hidden folder under %APPDATA%\Microsoft\….
  • This script sets itself to run at user logon via a per-user Run registry key, meaning no admin privileges are needed.
  • It embeds a Base64-encoded PowerShell payload within itself and extracts it at runtime.

Persistence artifacts you might see on a compromised host:

  • File: %APPDATA%\Microsoft\<random>\<random>.bat
  • Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random> = cmd.exe /c <bat-path>

2. PowerShell Loader and Donut Shellcode

  • Once launched, PowerShell decodes the embedded Base64 blob into a temporary .ps1 script, executes it, then deletes it to reduce forensic traces.
  • This script contains a large byte array that is XOR-decoded into shellcode.
  • It uses Windows API calls such as OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to inject the shellcode into another process (often a trusted one like explorer.exe).
  • A watchdog mechanism monitors the injected process and reinjects the shellcode if the host process crashes or exits.

3. Donut Loader Executes .NET Payload

  • The decoded shellcode is generated with Donut (a known shellcode loader that can run .NET assemblies directly in memory).
  • Donut loads the next-stage .NET payload fully in memory — meaning there’s no malicious EXE left on disk for traditional scanners to find.
  • The payload is a heavily obfuscated .NET assembly with randomized class and namespace names to thwart static analysis.

Payload Functionality

The malware includes two core .NET components:

Pulsar RAT (Remote Access Trojan)

This module gives the attacker interactive control over the infected machine and includes features such as:

  • Interactive remote shell and command execution
  • Live chat interface with the victim while operations run silently in the background
  • Ability to disable Task Manager and UAC
  • Registry and task management
  • Surveillance: webcam, audio capture, screen capture
  • Network command/response over TCP with structured messages

A significant aspect is that the RAT doesn’t just run silently — it can display a chat UI to the victim, allowing the attacker to interact in real time while continuing back-end actions.

Stealerv37 (Infostealer)

The second component is a modular infostealer built around an engine called “IntelIX.” It’s designed to collect a wide range of sensitive information:

  • Credentials from browsers and apps
  • VPN profiles and credentials
  • Session tokens from communication apps
  • FTP and remote access tools data
  • Gaming platform credentials
  • Tools and terminals (e.g., PuTTY, MobaXterm)
  • Crypto-related data, including patterns recognized from the clipboard

Once stolen, data is packaged into a ZIP archive and exfiltrated via Discord webhooks and Telegram Bot API calls, complete with victim metadata like username and OS version.

Persistence and Evasion

The malware uses multiple persistence paths:

  • Run key in the registry
  • Scheduled tasks as a primary mechanism
  • In-memory execution via Donut
  • A watchdog process that ensures the payload keeps running even if a host process dies

To avoid detection by security tools, it also includes:

  • Anti-VM and anti-sandbox routines
  • Anti-debugging loops
  • Continuous self-protection checks for injection tampering

Indicators of Compromise (IOCs)

Hashes and artifacts found during analysis:

  • Bat dropper: 648c0ba2bb1cde47fa8812f254821a72
  • PowerShell script: 69392e0b2b877cb932ab709ebe758975
  • Client .NET: 666493877fb7328c3e8c313fbcfdfd1e
  • Pulsar.Common.dll: 0020b06dc2018cc2b5bf98945a39cbd3
  • Stealerv37.dll: 3abcad7678dd78832a164349aceeaa59
  • C2 Domain: 185[.]132[.]53[.]17:7800

Why This Threat Matters

This campaign illustrates how modern malware blends:

  • Living-off-the-land execution
  • In-memory loaders (like Donut)
  • Interactive remote control (live chat)
  • Deep data theft
  • Multiple evasion and persistence techniques

Such threats are extremely difficult to detect with signature-based defenses and require behavioral monitoring and advanced endpoint analysis to spot and mitigate.

CyberDefender