Disclaimer

this is my first time EVER trying to "reverse engineer" or analyze anything so theres probably something wrong

and anytime i talk about av detection, its when i uploaded the shellcode to vt, the malware used assembly but i cba to use ghidra

Loader.ps1 was found in task scheduler opening every 5 minutes, it would fetch a powershell script from an ip address that was in hexadecimal

The script is stored in "event malware.txt"

This is a half assed malware analysis for what I understood

Malware Analysis

this took ages to make man

What is this

A piece of malware written in PowerShell + C# that drops an x64 shellcode payload into a legitimate Windows process.

The whole thing runs in layers, each one unpacking the next until shellcode is running inside a trusted Windows process.

---

How it executes

Stage 1 - Obfuscated PowerShell

The script hides its payload by splitting a base64 string across 53+ variables with fake cmdlet names (Get-AuthenticodeSignature, Get-ADForest, etc). The "commands" in the variable names aren't actually executed, they're just used as valid variable name wrappers to hide the base64 chunks inside them.

1. First ~200 lines assign base64 fragments to variables disguised as legitimate-looking PowerShell expressions
2. Around lines 208–292 all the fragments get gathered into $rhsgte and joined into a complete base64 string
3. Line 292 is where the payload kicks off, decodes the base64 to UTF-8 and pipes it straight into Invoke-Expression, obfuscated as i*e-exp* using wildcard matching to bypass detection
4. The reduceShowData function (lines 308–320) adds another layer, takes a byte array, base64 decodes it, XOR decrypts it with $setxorKey = "u87hb5eg5g", then runs the result as a scriptblock. Multi-layer execution.

Most of the loops and random variable assignments scattered throughout don't do anything, just filler to bulk the script out and make analysis annoying.

Stage 2 - Full loader

The decoded script contains the actual loader with AMSI bypass, sandbox evasion, system recon, and the injection engine.

Stage 3 - Shellcode

x64 shellcode injected into a legitimate Windows process via Early Bird APC injection. Full HTTP C2, clipboard theft, file access.

---

AMSI Bypass

First thing it does before anything else runs. Patches out Windows' Antimalware Scan Interface so the rest of the script is invisible to AV.

• Builds P/Invoke bindings at runtime using System.Reflection, no suspicious static imports
• Constructs "AmsiScanBuffer" by concatenating four variables so it never appears as a plaintext string
• Scans memory regions of the current process for clr.dll
• Byte-by-byte search for the AmsiScanBuffer signature inside that region
• Temporarily sets page protection to PAGE_EXECUTE_READWRITE, overwrites it with null bytes, restores original protection
• Everything that runs after this point is invisible to AMSI

---

Sandbox Evasion

Fake license check (time-based)

Sets an expiry timestamp 550 seconds (~9 mins) from launch, then fetches the real current time by making HTTP HEAD requests to random legitimate domains (Google, Microsoft, Amazon, Apple, Facebook, Netflix, Adobe, Oracle, IBM, Cisco) and reading the Date header. If the network time is past the expiry it exits. Sandboxes that replay or delay execution will always hit an expired license and never see the payload.

CPU busy-wait loops

Runs tight busy-wait for-loops that burn real CPU cycles instead of just calling Sleep(). Sandboxes often skip or fast-forward sleep calls, busy-wait loops can't be fast-forwarded.

Software & VM detection

• Enumerates all installed software from the registry
• Checks for any software with "Intel" in the name or publisher, Intel drivers/tools are common on real hardware but usually not in VMs and sandboxes

---

Payload Delivery - Early Bird APC Injection

How the shellcode ends up running inside a legitimate Windows process:

1. Creates one of these in suspended state: SecurityHealthHost.exe, snmptrap.exe, or SppExtComObj.Exe
2. Allocates RWX memory inside that process with VirtualAllocEx
3. Writes the shellcode into it with WriteProcessMemory
4. Queues the shellcode address as an APC to the suspended thread via QueueUserAPC
5. Calls ResumeThread, thread wakes up, runs all queued APCs (the shellcode) before its own entry point
6. Waits up to 30 seconds, then closes handles

The shellcode runs inside a signed trusted Windows process. From the OS's perspective nothing weird is happening.

---

Shellcode Payload

x64 shellcode, hundreds of lines, embedded as a hex-encoded string in $GelioSystem. All strings inside are encrypted at runtime, static string searches in Ghidra come back empty. API resolution pattern is consistent with a Rust-compiled implant or something like Cobalt Strike / Havoc C2.

Capabilities (from speakeasy emulation):

Capability	Evidence
HTTP C2	InternetOpenA, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, InternetReadFile
Clipboard theft	OpenClipboard, GetClipboardData, SetClipboardData, passwords, crypto addresses, anything you copy
File system access	CreateFileW, FindFirstFileExW, FindNextFileW, WriteFile
AV hook bypass	NtAllocateVirtualMemory, NtFreeVirtualMemory, direct NT syscalls, bypasses userland AV hooks
COM / WMI	CoCreateInstance, CoInitializeSecurity, CoSetProxyBlanket, lateral movement potential
Single instance	CreateMutexW

---

C2 Infrastructure

Found by running the sample in an isolated QEMU/KVM VM with Wireshark capturing on the host.

• Domain: animate-pancake.cc
• IP: 172.67.174.128
• Port: 443 (HTTPS)
• Fronting: Cloudflare, the real server is hidden behind Cloudflare's infrastructure, blocking the IP is useless since the domain can resolve to any Cloudflare IP

The domain showed up as the TLS SNI in the Client Hello when SecurityHealthHost.exe (the injected process) initiated the HTTPS connection. The .cc TLD (Cocos Islands) is commonly used by threat actors because it's cheap and has minimal abuse reporting.

---

IOCs

Network

• Domain: animate-pancake.cc
• IP: 172.67.174.128 (Cloudflare, block the domain not the IP)
• Protocol: HTTPS port 443

Behavioral

• PowerShell spawning SecurityHealthHost.exe, snmptrap.exe, or SppExtComObj.Exe as a suspended child process
• RWX memory allocated inside legitimate Windows processes
• clr.dll memory pages being modified
• Rapid HTTP HEAD requests to major domains at startup
• PSReadLine history disabled (SaveNothing)
• Clipboard access from a non-UI process

Script

• Obfuscated PowerShell using fake cmdlet names as variable identifiers
• XOR key in plaintext: u87hb5eg5g
• Temp files dropped to LocalAppData\Temp, RoamingAppData\Temp, or ProgramData\Temp

Registry

• Reads from HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
• Checks for Intel software (VM detection)

---

Tools Used

Tool	What for
CyberChef	Base64 decode + XOR decryption of the second stage
speakeasy	Shellcode emulation, revealed full API call list without executing
Ghidra	Static analysis attempt (limited, all strings are runtime-encrypted)
VirusTotal	Hash lookup
Wireshark	Network capture to identify C2 domain via TLS SNI
QEMU/virt-manager	Isolated VM to run the sample safely
Claude LLM	I got stuck a little too much and needed help

---

Notes

• Don't run this outside an isolated VM with no network access
• The AMSI bypass is the first thing that fires, standard AV won't catch anything after that point
• The time-based check means you have ~9 minutes from execution before the payload self-exits, keep that in mind if you're doing dynamic analysis