Two loader variants, a shared Donut-based execution path, and a modular encrypted backdoor.
Introduction
A financial document received through WhatsApp or email can initiate a multi-stage infection without requiring a visibly malicious executable. Morphisec Threat Research identified finance-themed archives distributed through both channels, including invoice, cheque-statement and account-adjustment lures. The campaign builds on activity monitored following earlier Vulkan RAT research.
The standout development is an alternative loader that hides an encrypted next-stage payload in the Authenticode certificate-table region of a PE file. Rather than fetching shellcode from a remote endpoint, a side-loaded DLL extracts and decrypts the embedded bytes before invoking them through an in-process APC. The earlier loader instead downloads Donut shellcode and injects it into a suspended process.
Both analyzed routes ultimately reach Donut-based execution and a modular backdoor that negotiates encrypted C2, profiles hosts, monitors user activity, and accepts additional in-memory DLL modules. The paths are alternatives, not successive stages of one infection.
Attack Chain Overview
Finance-themed archive → legitimate application + malicious side-loaded DLL → either network retrieval and Early Bird APC injection, or certificate-table extraction and in-process APC → Donut → backdoor → C2-delivered modules.
Attack chain: distinct network-delivered and certificate-table loader variants converge on the implant.
1 | Legitimate Executable Abuse and DLL Side-Loading
The earlier variant uses P-202609160253-PDFF.exe, an intact 64-bit Tencent-signed executable associated with the x52_subprocess application. Static analysis did not identify malicious functionality in the signed host itself. Its dependency on dbghelp.dll creates the opening: the executable imports MiniDumpWriteDump by filename, allowing a malicious dbghelp.dll placed beside it to be loaded during normal dependency resolution.
The host also registers a crash handler, but a crash is not needed to trigger the attack. Windows loads the malicious library before the application reaches its original entry point; the trojanized DLL runs through its initialization path. This is why the valid signature on the executable does not establish trust in the library loaded from its directory.
Host Entry-Point Hijacking
The DLL dynamically resolves CreateThread, VirtualProtect and Sleep. It obtains the host image base from the Process Environment Block (PEB), parses the PE headers, and locates AddressOfEntryPoint. After changing protection on a 25-byte region to PAGE_EXECUTE_READWRITE, it overwrites the original entry point with a stub that calls Sleep(INFINITE). The legitimate main thread is diverted into an indefinite wait while the DLL starts a separate worker thread.
Worker Initialization and Environment Checks
The worker decodes a 256-byte embedded configuration using XOR key 0x5A, resolves additional Windows APIs, and prepares the PngCache / 1.png registry strings. It checks the Explorer process and token context; unexpected conditions divert execution into a sleep path. The code also attempts UAC elevation, although successful elevation was not established.
The signed executable acts as the launch vehicle, not as the source of malicious functionality. The loader’s worker thread controls the subsequent download, injection, and registry staging.
2 | Network Retrieval, Early Bird APC and Donut
After initialization, the worker decodes a hardcoded URL and uses WinHTTP to retrieve the next stage from hxxp://107[.]148[.]225[.]248/updat/dahosuday[.]eu[.]cc[.]bin. The analyzed response contained 104,241 bytes of Donut shellcode. The loader checks the download result before proceeding.
Early Bird APC Injection
The DLL creates mspaint.exe in a suspended state, allocates memory in the target, writes the downloaded shellcode, queues an asynchronous procedure call (APC) on the target primary thread, and resumes execution. The APC is intended to run early in the process lifecycle. Following successful injection, the loader caches the downloaded bytes as REG_BINARY in HKCU\Software\PngCache, value 1.png, for potential reuse. The analyzed worker subsequently follows a host-process termination routine.
Donut as the Common Execution Stage
In the recovered network-delivered chain, Donut decrypts its internal instance with Chaskey-CTR, decompresses the payload using aPLib, manually maps a 173,568-byte native x64 backdoor DLL, and invokes its exported xiugai function. DllMain is minimal and calls DisableThreadLibraryCalls. Donut configuration included AMSI/ETW bypass attempts and PE-header overwriting; success of those bypasses was not independently verified at runtime.
The certificate-table variant also reaches Donut-based execution, but its embedded encrypted payload should not be assumed to be byte-identical to the network-delivered sample without a hash comparison.
Why the distinction matters
The first chain relies on an external payload download and cross-process injection. The second moves the encrypted payload into the host file and invokes it locally. Both use legitimate software as cover, but their network exposure and memory-execution patterns differ.
3 | Hiding the Next Stage in the PE Certificate Table
The newer variant uses a modified Kingsoft/WPS Office DLL, kvpvbsext64.dll, with an additional executable .ihif section. Its entry point is redirected into malicious loader code while preserving the original initialization path. The loader resolves APIs via the PEB, opens the host executable using GetModuleFileNameA(NULL, …), and parses IMAGE_DIRECTORY_ENTRY_SECURITY.
Unlike ordinary PE directories, the security directory VirtualAddress is a file offset, not an RVA. In the analyzed executable the certificate-table region begins at 0x53400 and spans 0xC7C8 bytes. The marker CA FE BA BE CA FE BA BE is visible at file offset 0x58580, inside that region.
PE evidence: the security-directory region contains the embedded marker used to locate concealed data.
The loader searches for the marker, extracts a 30,272-byte encrypted payload, allocates memory with VirtualAlloc, and decrypts the bytes in place using RC4 and the hardcoded key AtkExEmbedKey2026. It then changes memory permissions through VirtualProtect.
This finding concerns the Authenticode certificate-table region; it does not by itself prove that the X.509 certificate contents were modified or that the signature remained valid after payload placement.
4 | Certificate-Table Execution and Variant Comparison
After RC4 decryption, the newer loader queues an APC to the current thread with QueueUserAPC and enters an alertable wait using SleepEx. The APC callback reaches a trampoline that transfers control to the decrypted payload using DLL-style entry semantics. Unlike Early Bird injection, this path does not require creating a suspended mspaint.exe process or writing into another process at this stage.
Disassembly evidence: certificate-table extraction, RC4 decryption, and QueueUserAPC / SleepEx execution.
Two Paths, One Downstream Architecture
| Characteristic | Earlier loader | Newer loader |
| Malicious DLL | dbghelp.dll | kvpvbsext64.dll |
| Payload location | Remote server URL | EXE certificate-table region |
| Protection | Obfuscated URL; Donut internal crypto | RC4-encrypted embedded bytes |
| Retrieval | HTTP download | Local file extraction |
| Execution | Early Bird APC in mspaint.exe | Current-thread APC + SleepEx |
| Subsequent stage | Donut | Donut |
The change is not simply a new DLL name: it relocates the next stage from network infrastructure into a less commonly inspected PE region and replaces cross-process injection with in-process APC execution.
5 | Implant Initialization and Encrypted C2
The recovered backdoor executes primarily through its xiugai export. Its configuration is decoded using a position-dependent XOR routine, revealing the default endpoint dahosuday[.]eu[.]cc:8083. HKCU\SOFTWARE\RRCfg can supply an alternate configuration, while a host-derived mutex limits duplicate instances. The implant uses raw TCP through the HP-Socket library, rather than the downloader’s HTTP transport.
Custom Handshake and Record Protection
An encrypted bootstrap exchange precedes an ephemeral ECDH P-256 public-key exchange. The shared secret is processed through SHA-256-based derivation to produce an AES-256-GCM session key. Subsequent application records use that session key with a fresh 12-byte nonce and 16-byte authentication tag per message. The nonce changes per record; a new ECDH exchange and new session key are not required for every command.
The protocol additionally masks command identifiers and, when negotiated, lengths using XOR-derived values; randomized padding obscures message boundaries and sizes. These details distinguish the protocol from a simple encrypted TCP stream.
Host Profiling and Continuous Monitoring
Registration reports machine GUID, local IP, computer name, username, integrity level and installed antivirus products enumerated through WMI. During the session, the implant tracks foreground-window titles, user idle/active state and selected processes. The controller can update the monitored process list dynamically.
Periodic heartbeat records include a counter and local timestamp. An unusual implementation detail reserves eight bytes for the counter but explicitly initializes only its lower four bytes, potentially exposing residual data. A timing probe (0xC9) returns a smoothed estimate in response message 0xD8.
6 | C2 Command Surface and Modular Delivery
The backdoor implements six analyzed inbound commands and separate outbound telemetry. Most important is 0x06: the controller delivers a PE module, the implant manually maps it into memory, and execution transfers to the module’s base export. This separates the implant’s core communication and monitoring logic from specialized post-compromise capabilities.
| Command | Capability |
| 0x00 | Windows power operation via ExitWindowsEx |
| 0x02 | Stop client and clean up session |
| 0x06 | Map and execute additional module via base |
| 0x10 | Update C2 configuration and reconnect |
| 0x11 | Replace watched-process list |
| 0xC9 | Timing probe; response 0xD8 |
Outbound messages include 0xEE/0xEF/0xEA/0xED for registration and antivirus reporting, 0x01 heartbeat, 0xCA/0xCB user activity, 0xD5 foreground window, 0xDB watched-process bitmap, 0xD6 prior module hashes, and 0xDA module execution status. A 0xDA status indicating that base returned does not by itself prove completion of a module’s intended task.
Two Modules Recovered from C2
The analyzed traffic delivered Popup_command06.dll (130,048 bytes) and disp_command06.dll (649,728 bytes). Both are manually mapped into the implant process and invoked through base. The first implements persistence and further payload delivery; the second implements an independently encrypted remote desktop channel.
For one observed 0x11 watch-list update, the implant reported a zero bitmap for dcondemand.exe. Because the same result can occur if enumeration fails, this alone does not prove the process was absent.
7 | Persistence, Registry Re-execution and Remote Desktop
Popup_command06.dll and YYAudioGo.exe
Popup_command06.dll checks for NTUSER.MAN in the user profile and skips its persistence/download path if that file exists. Otherwise, it exports and modifies user registry data, reconstructs an offline hive through Offreg.dll, and attempts to save it as NTUSER.MAN with Environment\UserInitMprLogonScript pointing to C:\Users\Public\Documents\1.bat. Successful persistence was not confirmed.
The module downloads hxxp://107[.]148[.]225[.]248/qd/zip.zip and extracts it under Public Documents. The archive contains 1.bat and 1.txt; the batch script uses certutil.exe -decodehex to reconstruct YYAudioGo.exe, attempts to execute it, and then removes the reconstructed file. A Chinese-language comment describes deletion after execution. The DLL itself does not directly launch the batch script.
YYAudioGo.exe resembles the earlier loader but sources its shellcode from HKCU\Software\PngCache\1.png instead of downloading it again. It attempts Early Bird APC injection into suspended mspaint.exe. This provides a plausible reactivation path on later logons, but successful execution was not established.
disp_command06.dll: Interactive Control
The remote desktop module establishes a separate TCP connection and negotiates a fresh ECDH P-256 / AES-256-GCM session. Its Xvid-based screen-capture implementation and command dispatcher support capture start/restart, frame-rate/quality/scaling adjustments, keyboard and mouse input, clipboard read/write, monitor controls, and local input blocking. The encrypted handshake was observed, but the subsequent operator actions could not be confirmed from the available traffic.
Conclusion and Defensive Relevance
The campaign illustrates a progression from downloaded shellcode and cross-process APC injection to locally embedded, RC4-protected payloads hidden in the PE certificate-table region. The modular implant combines encrypted C2, host telemetry and on-demand functionality. Defensive review should correlate suspicious side-loaded DLLs, unexpected PE security-directory data, APC-based execution and anomalous registry/logon artifacts rather than relying on the signed host alone.
Morphisec Moving Target Defense is designed to disrupt attacks that depend on predictable in-memory execution behavior; prevention of this specific campaign was not established by the analyzed evidence.
How Morphisec Can Help
This campaign demonstrates how attackers can abuse trusted, digitally signed executables, DLL side-loading, and in-memory execution techniques to evade conventional security controls. By modifying legitimate execution flows, injecting payloads into trusted Windows processes through Early Bird APC injection, and concealing additional payloads within certificate-related data, the attackers reduce their reliance on easily identifiable malicious executables.
Morphisec’s Moving Target Defense (MTD) technology is designed to disrupt advanced attacks that rely on predictable memory structures and execution behavior. This approach provides an additional layer of protection against memory-based threats, including techniques such as code injection and in-memory payload execution.
The findings reinforce the importance of combining behavioral visibility with proactive prevention capabilities to defend against multi-stage threats that exploit legitimate applications and trusted Windows components.
Appendix | Indicators of Compromise
File indicators and related infrastructure are retained separately from the eight-page technical analysis. Repeated filenames with different SHA-256 hashes are distinct entries; their relationship is not assumed. Network addresses are defanged.
File Hashes and Artifacts
| Artifact | SHA-256 | Role / context |
| 0916Invoice sheet_4248.zip | bcfee6a87237934e5b5a456acad805fefd9b08a9266da9097cfd04cba603ab84 | Finance-themed ZIP archive associated with the campaign |
| Cheques_Statement_20261008_7395.zip | 3fd0aecbb0e8266be514fe5c68f0163e09a9b1a679bb2f2c0b88aa80935f2f63 | Finance-themed archive associated with the certificate-table loader variant |
| 0924Account Adjustment_8725.zip | 78dfad1a682df9837a4af46888f40e228f2e069c57823aceb876b645e6534b89 | Finance-themed ZIP archive |
| 20260925_1PDF.zip | 1be5e652840a644503723a4eb22a534dacb8e24b002d6818d314582ef575c519 | Distribution archive; one of two distinct hashes reported under this filename |
| 1005Account Adjustment_4738.zip | f0712676a5a42fa6c88c55a439fe8ff65ca2d4e24d29213feacac0bba0c0391f | Finance-themed ZIP archive |
| Reports_India.zip | 553c79542794820c82c20f1794c4a6f30c68bd4a3b5abc702b11c28a20b5db63 | Additional business-themed distribution archive |
| Invoice_10_Payment for Goods.zip | c41c8c28f270ba14d2bee6305d8d52c525883c648db6bfe566e47ce2e7262200 | Invoice-themed distribution archive |
| Invoice20261022-5689832566.zip | 6860ef580d4b1db34b4e4184cce9bca714bce53083c4290dc1c6017ef7fbbdf5 | Invoice-themed distribution archive |
| 20261007153000-99CF664E0D6EDF.exe | 47f0e971a9affae06adfa75b6c87ccddaa1351cd821819a93c3d0360e641e95d | Additional executable; role not confirmed |
| kvpvbsext64.dll | 759239cde5a033ff7fa330e3a9122392ab8fde7fdec72b0ec72033920c5227d3 | Modified certificate-table loader DLL |
| Dbghelp.dll | adda6e9ba56c909638b6e4f547e0de9168afae92d7723a600b04d9cd74609b44 | Malicious side-loaded DLL in network variant |
| P-202609160253-PDFF.exe | a77351d3435a7cac5880247533a25f213bcc3e4ff469f0a68d1b984dad311891 | Legitimate Tencent-signed carrier executable |
| disp_command06.dll | ae583046cef84789f57e4db2f06ba41ba537e035ecb959f74264ed5d36dc8ba8 | Remote desktop module; first reported hash |
| disp_command06.dll | f89fe259e8ec0022063e9be77062cb33ab79b2642516ca2b61f65684b0de874d | Additional hash associated with the same module name; relationship to the first sample not confirmed |
| dahosuday_embedded_module | 2eab6deca19ce3919526ec63eba9a601157aa1ff5168a03032701dd60056dd60 | Embedded module associated with the analyzed payload chain |
| dahosuday.eu.cc.bin | 3cc04e79ab6a222d048953a40f468f4fec60e1870093362bada4de9138233740 | Network-delivered payload artifact |
| Unidentified ZIP archive | 9cea88212d13f143ca5f06bfb2eea2606f819731c4bb4475b0dd1ee8137fa6dd | Additional archive; original filename and specific role not established |
| 1.bat | f23187312b1d0ad1136450028365549fa4e1522d77c1d986c7bd0ae87653d295 | Batch script associated with the additional payload-delivery chain |
| 1.txt | 6c28462ee3c5c64671b348351e65573108a62ea2e7728a6e5a38221461d6c87c | Hex-encoded payload artifact used by the batch script |
| 1.bin | ba22557213899a76af9cd3851e486d55e772cdc2f091f2c1485cffcc76e750c3 | Additional binary artifact; precise execution role not independently established |
Network Infrastructure
| Indicator (defanged) | Context |
| hxxps://qdzip-1476850762[.]cos[.]ap-singapore[.]myqcloud[.]com/zip.zip | ZIP archive hosted on cloud object storage |
| hxxp://107[.]148[.]225[.]248/updat/dahosuday[.]eu[.]cc[.]bin | Next-stage payload download endpoint used by the network-delivered loader |
| hxxp://107[.]148[.]225[.]248/qd/zip.zip | Additional ZIP payload downloaded by the C2-delivered persistence module |
| hxxps://gdnkdl[.]eu[.]cc/files/ahfayui[.]eu[.]cc[.]bin | Additional binary payload distribution endpoint |
| hxxps://gdnkdl[.]eu[.]cc/files/lahfadau[.]eu[.]cc[.]bin | Additional binary payload distribution endpoint |
| hxxps://gdnkdl[.]eu[.]cc | Related distribution infrastructure |
| hxxps://gdnkdl[.]eu[.]cc/files/awhfos[.]eu[.]cc[.]bin | Additional binary payload distribution endpoint |
| gdnkdl[.]eu[.]cc/files/mashda[.]eu[.]cc[.]bin | Additional binary distribution path; URL scheme not specified in the source list |
| gdnkdl[.]eu[.]cc/files/yqoweu[.]eu[.]cc[.]bin | Additional binary distribution path; URL scheme not specified in the source list |
| gdnkdl[.]eu[.]cc/files/ahfayui[.]eu[.]cc[.]bin | Additional occurrence of the ahfayui payload path, reported without a URL scheme |
| hxxps://lequn01[.]cdn[.]bcebos[.]com/leceshi.bin | Additional binary distribution endpoint |
| dahosuday[.]eu[.]cc:8083 | Default backdoor command-and-control endpoint using TCP port 8083 |
Stay up-to-date
Get the latest resources, news, and threat research delivered to your inbox.
