Emmenhtal Loader: the silent enabler of modern malware campaigns

Emmenhtal Loader: the silent enabler of modern malware campaigns

Speakers: Lovely Antonio (G Data AV Lab); Ricardo Pineda (G Data AV Lab); Louis Sorita (G Data AV Lab)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=h3d0Izu9aN8

Overview

In this insightful talk, "Emmenhtal Loader: the silent enabler of modern malware campaigns," security researchers Louis Sorita, Ricardo Pineda, and Lovely Antonio from G Data AV Lab's Manila office unveil the intricate mechanisms of Emmental Loader. Named after Swiss cheese due to its "holes"—deliberate obfuscation techniques, missing sections, and fragmented loading steps that make its execution appear incomplete—this loader is far more sophisticated than its initial impression suggests. First publicly reported by Orange Cyber Defense in early 2022, Emmental Loader has rapidly evolved into a pivotal component of modern cybercrime.

Emmental Loader distinguishes itself not as a standalone malware family, but as a flexible and stealthy delivery backbone for a diverse array of malicious payloads. It acts as a silent enabler, facilitating the distribution of various info stealers, remote access Trojans (RATs), and modular loaders across multiple threat actor operations. The speakers emphasize that Emmental Loader is a prime example of the growing "Malware-as-a-Service" (MaaS) ecosystem, where specialized components are leveraged by multiple operators, transforming the landscape of cyber attacks.

The significance of Emmental Loader lies in its adaptability and its role in lowering the barrier to entry for new malware campaigns. By providing a robust, multi-stage, and highly obfuscated initial access vector, it allows threat actors to scale their operations with unprecedented efficiency. This talk dissects its technical intricacies, from its abuse of legitimate Windows binaries (LolBins) and signed applications to its polyglot script chains, offering crucial insights for understanding and defending against the evolving tactics of modern cyber adversaries.

Background

▶ Watch: Introduction to Emmental Loader and its unique obfuscation (0:00)

The landscape of cyber threats has undergone a significant transformation, with loaders evolving from simple delivery mechanisms into complex, monetized, and modular ecosystems. Historically, loaders primarily served to drop and execute a final payload. However, the emergence of phenomena like Emmental Loader signifies a shift towards a Malware-as-a-Service (MaaS) model, where components are developed, maintained, and offered as a service to other threat actors. This collaborative ecosystem enables attackers to leverage shared infrastructure and outsourced capabilities, blurring attribution and accelerating the deployment of new malware.

The problem Emmental Loader addresses for threat actors is the need for a highly stealthy, resilient, and versatile initial infection vector. Traditional methods often involve easily detectable binaries or straightforward execution chains. Emmental Loader, however, employs a sophisticated blend of living-off-the-land binaries (LolBins) and obfuscation techniques to evade detection and analysis. Its design capitalizes on the trust associated with legitimate Windows processes and the difficulty of analyzing fragmented, multi-language execution flows. Prior campaigns, such as older versions of Smoke Loader, sometimes relied on exploiting known vulnerabilities, like a "700-day vulnerability" mentioned in the talk, to bypass security checks. In contrast, Emmental Loader exemplifies a more modern approach, focusing on social engineering combined with advanced obfuscation and LolBin abuse rather than zero-day exploits for its initial access.

The talk highlights that threat actors are no longer operating in isolation. The rise of MaaS has fostered a highly collaborative, service-driven economy within the cybercrime underground. This multi-actor collaboration lowers the barrier to entry for less skilled attackers and allows more sophisticated groups to specialize in particular aspects of the attack chain, such as initial access or payload development. Emmental Loader serves as a critical link in this chain, acting as a "silent enabler" that allows diverse malware families to reach their targets effectively, making it a crucial subject for detailed analysis by the security community.

Key Findings

▶ Watch: Multi-stage obfuscation from JavaScript to PowerShell (6:00)

The G Data AV Lab team's investigation into Emmental Loader unveiled several key findings that underscore its sophistication and its pivotal role in modern malware campaigns. Fundamentally, Emmental Loader is not a singular malware but a flexible mass delivery backbone that distributes a wide array of payloads, including info stealers, Remote Access Trojans (RATs), and other modular loaders, across multiple operators. This makes it an ecosystem enabler, rather than a standalone threat.

A central discovery is Emmental Loader's ingenious use of obfuscation and evasion techniques. Its name, derived from Swiss cheese, aptly describes its methodology: it employs "holes" in its execution, such as deliberate obfuscation, missing sections, and fragmented loading steps, to appear incomplete or innocuous at first glance. This includes leveraging LolBins (living-off-the-land binaries) like mshta.exe and trojanizing legitimate, signed Windows binaries such as dccw.exe (Display Color Calibration Wizard), notepad.exe, private character editor, VS graphics remote engine, and Windows update standalone installer. By embedding malicious scripts and payloads within these trusted executables, Emmental Loader executes its malicious code under the guise of legitimate system processes, significantly hindering detection.

The execution flow involves polyglot script chains, a sophisticated multi-stage obfuscation tactic that transitions between different scripting languages and processes. The loader typically starts with PowerShell, which then invokes mshta.exe to interpret embedded HTML Application (HTA) and JavaScript files, eventually leading back to another PowerShell execution. This complex sequence, often involving eval() functions and heavily obfuscated code, makes static analysis challenging and requires dynamic execution monitoring for full understanding.

Furthermore, Emmental Loader exhibits dynamic payload fetching capabilities. It contacts attacker-controlled infrastructure, including WebDAV servers, GitHub repositories, and Content Delivery Network (CDN) domains, to fetch subsequent stage payloads. This allows threat actors to update payloads, adapt to new defensive measures, and maintain persistence without needing to alter the initial loader itself.

The G Data team categorized observed Emmental Loader samples into three primary clusters based on their deployed payloads:

1. Cluster 1 focused on info stealers and RATs like ScriptBot and Luma Stealer, notably observed in "Chy Bunny" campaigns.
2. Cluster 2 utilized payloads such as Amadey and AsyncRAT, operating under a MaaS model by contacting public repositories for additional modules.
3. Cluster 3, the focus of the presentation, frequently deployed Smoke Loader using trojanized binaries like dccw.exe. Other payloads in this cluster included Donut Loader, Dear Stealer, Remcos RAT, XWorm, and Luma Stealer, delivered through their respective trojanized legitimate binaries.

These findings collectively paint a picture of Emmental Loader as a highly adaptable, stealthy, and integral component of the modern cybercrime ecosystem, emphasizing its role in enabling a wide range of malicious activities through a sophisticated, multi-layered approach.

Technical Deep Dive

▶ Watch: Different Emmental Loader clusters and trojanized binaries (8:30)

The technical prowess of Emmental Loader lies in its multi-stage, polyglot execution chain and its pervasive abuse of trusted Windows binaries. The infection often begins with a seemingly innocuous PowerShell command, such as powershell -c "iex (mshta.exe main.one)". This command initiates the core of Emmental's stealth mechanism by invoking mshta.exe to execute a file named main.one.

mshta.exe (Microsoft HTML Application) is a critical LolBin in Emmental's arsenal. It's a signed Windows binary that runs under the HDA trust model, granting it application-like privileges rather than the more restricted browser-like permissions. This allows mshta.exe to execute a wide array of scripting languages—JavaScript, VBScript, or PowerShell—and accept flexible inputs, including local files, URLs, or inline monikers. This capability is crucial for Emmental, as it can leverage a legitimate, trusted process to execute arbitrary, malicious scripts.

The file main.one, despite its generic name, is not a typical HTA file. Instead, it is a trojanized version of dccw.exe (Display Color Calibration Wizard), another legitimate and signed Windows binary. Emmental Loader embeds its malicious components directly within the overlay of this dccw.exe file. When mshta.exe is invoked with dccw.exe as an argument, it interprets the first embedded HTA file within dccw.exe. This embedded HTA is configured for stealth, setting application.caption="no", window.state="minimized", and ensuring no icon appears in the taskbar, making its execution virtually invisible to the user.

Following the initial HTA interpretation, mshta.exe proceeds to interpret subsequent embedded JavaScript files. These JavaScript files are heavily obfuscated, making static analysis difficult. One key JavaScript component invokes an eval() function, executing a variable like ERC that contains further hidden, malicious code. This chain of obfuscated JavaScript eventually leads to another PowerShell execution.

This subsequent PowerShell command is typically executed with flags designed for stealth and efficiency: powershell.exe -w hidden -ep unrestricted -nop.

• -w hidden: Executes the PowerShell window in a hidden state.
• -ep unrestricted: Sets the execution policy to unrestricted, allowing any script to run.
• -nop: Prevents loading of the user's PowerShell profile, speeding up execution.

This PowerShell script is responsible for downloading and executing the next stage payloads. The talk highlighted specific Indicators of Compromise (IOCs) observed in this stage, such as the download of invos122.pdf and putty122.exe. Notably, invos122.pdf is a misspelled lure PDF (a common tactic, as "threat actors are also normal people" and sometimes make mistakes), which opens in the Edge browser to distract the victim. Simultaneously, putty122.exe, despite its name suggesting the legitimate PuTTY SSH client, is actually the final payload: Smoke Loader malware.

The G Data team observed Emmental Loader distributing a wide variety of final payloads through different trojanized binaries:

• Smoke Loader via dccw.exe
• Donut Loader via private character editor
• Dear Stealer via VS graphics remote engine
• Remcos RAT via Windows update standalone installer
• XWorm via notepad.exe
• Luma Stealer via Bluetooth uninstall device task

These trojanized binaries, all legitimate and signed Microsoft files, lend an air of authenticity to the malicious execution, making them difficult for traditional endpoint protection solutions to flag. Emmental Loader's core functionalities include executing malware components by leveraging mshta.exe, dropping and loading secondary malicious payloads, and dynamically contacting attacker infrastructure (WebDAV, GitHub, CDNs) to fetch these next-stage components. This modular and stealthy approach ensures Emmental Loader remains a silent, yet potent, enabler of diverse cybercrime operations.

Demo / Proof of Concept

▶ Watch: Full infection chain: from phishing to final payload (13:30)

While the speakers did not present a live demonstration or proof-of-concept during the talk, they meticulously walked through the entire infection chain and the intricate technical details of Emmental Loader's execution. They used detailed slides to illustrate the PowerShell commands, the obfuscated JavaScript code, the structure of the trojanized dccw.exe with its embedded HTA and JavaScript components, and the network activities involved in downloading subsequent payloads. This step-by-step breakdown served as a conceptual demonstration, providing a clear understanding of how the loader operates from initial execution to final payload delivery. The analysis included screenshots of code snippets, IP lookups, and file structures, effectively illustrating the "holes" (obfuscation and fragmented loading) that characterize Emmental Loader's stealthy approach.

Defensive Implications

▶ Watch: Emmental Loader as an ecosystem enabler (MaaS) (18:00)

Emmental Loader presents a significant challenge for defenders due to its sophisticated obfuscation, LolBin abuse, and integration into the broader MaaS ecosystem. To effectively counter this threat, a multi-layered defensive strategy is essential, moving beyond mere payload detection to a holistic understanding of the entire cybercrime supply chain.

First and foremost, understanding the ecosystem is paramount. Defenders must recognize that they are not dealing with isolated malware families but interconnected services and actors. This necessitates focusing not just on the final payload, but also on the infrastructure and entry vectors that enable these campaigns. Disrupting Initial Access Brokers (IABs), loader services, and Command and Control (C2) servers is crucial to breaking the operational chain that empowers modern cyber threats.

Endpoint Detection and Response (EDR) solutions are vital. They should be configured to monitor for suspicious process relationships and behaviors, particularly those involving LolBins. For instance, mshta.exe is a legitimate process, but mshta.exe launching dccw.exe (or other unusual signed binaries) with suspicious parameters, especially when combined with hidden windows or unrestricted execution policies, should trigger high-priority alerts. Similarly, PowerShell scripts executed with -w hidden, -ep unrestricted, or -nop flags warrant close scrutiny.

Threat hunting should actively look for the specific techniques employed by Emmental Loader. This includes searching for:

• Unusual invocations of mshta.exe or powershell.exe with base64 encoded strings or remote URLs.
• Signed Windows binaries (dccw.exe, notepad.exe, putty.exe, etc.) being executed from non-standard locations or exhibiting anomalous network connections.
• Network traffic to known attacker infrastructure (WebDAV, GitHub, CDNs) for downloading executables or scripts.
• Specific IOCs mentioned, such as the misspelled invos122.pdf, which can serve as a unique fingerprint.

Behavioral analysis is key to detecting the multi-stage, polyglot script chains. Security solutions need to track process ancestry and understand the sequence of events (e.g., PowerShell -> mshta.exe -> JavaScript -> PowerShell). Anomalous script executions, particularly those involving eval() functions or heavily obfuscated code, should be flagged.

Furthermore, email and archive security remain critical. Since the initial access often involves phishing emails with archives (like Zebzip files) containing lure PDFs and malicious URL shortcuts, robust email filtering, sandboxing, and user education against opening suspicious attachments are foundational defenses. Organizations should also enforce strict policies regarding the execution of files downloaded from the internet, especially those posing as legitimate documents or shortcuts.

In summary, defending against Emmental Loader requires a proactive, layered defense approach that combines robust EDR, active threat hunting, sophisticated behavioral analysis, and strong perimeter security. The bottom line is that the real threat extends beyond the malware payload itself; it's the sophisticated, collaborative ecosystem behind it that defenders must understand and strive to disrupt.

Key Takeaways

• Emmental Loader is an Ecosystem Enabler: It's not a single malware family but a sophisticated, flexible backbone for distributing diverse payloads (info stealers, RATs, modular loaders) across multiple threat actors, operating within a Malware-as-a-Service (MaaS) model.
• Abuse of LolBins and Signed Binaries: Emmental Loader heavily leverages legitimate Windows binaries like mshta.exe and trojanizes signed executables such as dccw.exe, notepad.exe, and others. This allows it to execute malicious code under the guise of trusted system processes, significantly aiding stealth and evasion.
• Sophisticated Multi-Stage Obfuscation: The loader employs "polyglot script chains" involving multiple stages of obfuscated JavaScript and PowerShell executions. This fragmented, multi-language approach makes static analysis challenging and requires dynamic monitoring for effective detection.
• Focus on the Entire Cybercrime Ecosystem: Defenders must shift their focus from individual malware payloads to understanding and disrupting the interconnected relationships within the cybercrime ecosystem, including initial access brokers, loader services, and C2 infrastructure.
• Layered Defenses are Crucial: Effective defense requires a combination of robust Endpoint Detection and Response (EDR), proactive threat hunting for LolBin abuse and behavioral anomalies, and strong email/archive security to prevent initial access.
• Behavioral Analysis and IOCs: Monitoring for unusual process execution patterns (e.g., mshta.exe launching dccw.exe), specific PowerShell flags (-w hidden, -ep unrestricted), and unique IOCs like misspelled filenames (invos122.pdf) is vital for detection.

About the Speaker(s)

The talk was delivered by Luis Sorita, Ricardo Pineda (Rick), and Lovely Antonio, all security researchers from the G Data AV Lab's office in Manila. G Data AV Lab is a subsidiary of G Data Cyber Defense EG. This presentation marked their first time attending the Virus Bulletin conference, where they shared their in-depth research and analysis of Emmental Loader with the cybersecurity community.