Listen to this Post
Introduction
The Splunk Threat Research Team (STRT) recently uncovered a malicious campaign leveraging a weaponized Inno Setup installer to deliver malware via Pascal scripts. The attackers employed evasion techniques like TinyURL and Rentry to obscure their activity, ultimately deploying HijackLoader to execute Redline Stealer. This article breaks down the campaign’s TTPs and provides actionable detection strategies.
Learning Objectives
- Understand how attackers abuse Inno Setup installers for malware delivery.
- Learn detection methods for HijackLoader and Redline Stealer.
- Implement Splunk queries to identify related threats.
You Should Know
1. Detecting Malicious Inno Setup Installers
Command (Splunk Query):
index=malware source=".exe" (process_name="innounp.exe" OR cmdline="isscript") | stats count by host, user, process_name
Step-by-Step Guide:
This query identifies processes related to Inno Setup extraction (innounp.exe) or Pascal script execution (isscript). Monitor for unusual instances of these processes, particularly in temporary directories.
2. Unmasking TinyURL and Rentry Evasion
Command (PowerShell):
Invoke-WebRequest -Uri "https://tinyurl.com/api-create.php?url=<malicious_url>" | Select-Object Content
Step-by-Step Guide:
Attackers use URL shorteners to hide malicious links. This PowerShell command decodes TinyURLs to reveal the original URL. Integrate this into threat-hunting workflows to inspect suspicious shortened links.
3. Identifying HijackLoader Shellcode
Command (YARA Rule):
rule HijackLoader_Shellcode {
strings:
$opcodes = { 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 }
condition:
$opcodes
}
Step-by-Step Guide:
This YARA rule detects HijackLoader’s shellcode signatures. Deploy it in memory-scanner tools like Volatility or commercial EDR solutions to flag suspicious process injections.
4. Detecting Redline Stealer Exfiltration
Command (Splunk Query):
index=network (dest_ip="45.9.150." OR dest_port=5050) | table src_ip, dest_ip, bytes_out
Step-by-Step Guide:
Redline Stealer often exfiltrates data to specific IP ranges (e.g., 45.9.150.0/24). This query monitors outbound connections to known C2 infrastructure.
5. Hardening Against Pascal Script Abuse
Command (Windows GPO):
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics" -Name "ExecutionPolicy" -Value "Restricted"
Step-by-Step Guide:
Disable arbitrary script execution via Group Policy. This mitigates abuse of Pascal or other scripting engines in installer frameworks.
6. Analyzing Process Hollowing
Command (Volatility):
volatility -f memory.dump hollowfind --output=json
Step-by-Step Guide:
HijackLoader often uses process hollowing. This Volatility plugin identifies hollowed processes in memory dumps, critical for post-exploitation forensics.
7. Blocking Rentry-Co Hosted Payloads
Command (Firewall Rule):
iptables -A OUTPUT -p tcp -d rentry.co --dport 443 -j DROP
Step-by-Step Guide:
Block traffic to Rentry.co, a free pastebin service abused by attackers. Update firewall rulesets to include emerging threat actor infrastructure.
What Undercode Say
- Key Takeaway 1: Attackers increasingly abuse legitimate tools (e.g., Inno Setup) to bypass trust-based defenses.
- Key Takeaway 2: Detection engineering must evolve to focus on behavior (e.g., scripted installers) rather than static IOCs.
Analysis:
This campaign highlights the blurring line between legitimate and malicious software use. Defenders should prioritize:
1. Behavioral Analytics: Tools like Splunk can correlate process creation, network calls, and script execution.
2. Decoding Obfuscation: Automated URL/link expansion should be part of SOC workflows.
3. Memory Forensics: HijackLoader’s shellcode leaves minimal disk artifacts, making memory analysis essential.
Prediction
Expect attackers to expand abuse of installer frameworks (e.g., NSIS, WiX) and “living-off-the-land” tactics. Proactive hardening of scripting engines and memory-based detection will become critical in 2024–2025.
IT/Security Reporter URL:
Reported By: Teoderickc Splunk – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
