Patchwork APT: Leveraging PowerShell to Create Scheduled Tasks and Deploy Final Payload
Patchwork, an advanced persistent threat (APT) group, also known as Dropping Elephant, Monsoon, and Hangover Group, has been observed utilizing a new PowerShell-based loader. This loader exploits Windows Scheduled Tasks to execute its final payload.
Patchwork, an advanced persistent threat (APT) group, also known as Dropping Elephant, Monsoon, and Hangover Group, has been observed utilizing a new PowerShell-based loader. This loader exploits Windows Scheduled Tasks to execute its final payload.
Active since 2015, Patchwork targets political and military intelligence in South and Southeast Asia. The group is known for its persistence and repurposing of existing tools rather than creating new exploits.
In the latest campaign, targets receive a Microsoft Office document containing a malicious macro. When enabled, this macro downloads an LNK shortcut file that executes a PowerShell script. This script:
Downloads an executable masquerading as vlc.exe into C:\Windows\Tasks\lama . Retrieves a DLL named libvlc.dll to side-load with vlc.exe. Fetches a decoy PDF from a malicious URL and places it in the Public Documents folder. Creates a scheduled task called WindowsErrorReport to trigger vlc.exe regularly. Downloads and saves the APT’s final payload, a .NET-based executable compiled with MSIL.
Once vlc.exe is launched, the loader’s fStage method initiates communication with the attacker’s C2 server. It gathers system information and performs the following:
XORs the client ID with a hardcoded key and Base64-encodes the result. Applies obfuscation via a custom Protean function. Sends data over HTTPS using TLS 1.2 as a POST form.
The server response is decoded and decrypted to produce a session key. If the fStage fails, retries occur every five seconds, up to twenty attempts.
This loader exploits Windows Scheduled Tasks to execute its final payload.
Subsequently, the SStage method inventories the host:
Public IP. OS version. MAC address and username. Working directory path. Process ID and administrative privilege status. Unique session ID.
Data is obfuscated and transmitted. Simultaneously, the bkj method launches:
dsffds() collects installed applications via WMI. ghjk() enumerates antivirus products.
The _getCommand function retrieves attacker instructions disguised as legitimate web form POSTs. Execution results are sent back to the C2 server using the _sendResult method.
Responses undergo deobfuscation and decryption to yield plaintext commands. Failures trigger retry loops to maintain stealth.
For exfiltration, command outputs are encoded and sent with a unique victim ID. Retries ensure reliable delivery.
dfile : Downloads and decodes auxiliary files. ufile : Streams large files to the C2 in segments. v_alloc : Executes in-memory code. scrt : Captures and uploads screenshots.
To counter Patchwork’s approach, robust endpoint defenses are critical. Enabling macros only from trusted sources, monitoring scheduled tasks, and enforcing application whitelisting can disrupt the loader’s execution chain.
Deploying security solutions with up-to-date signatures and behavior-based detection can identify these techniques before data exfiltration occurs. Regular updates to operating systems and security software are essential.
Based on reporting by GBHackers.