Build / RE

Toolchain: AutoIt v3.3.16.1 compiled script, UPX-packed stub (upx.exe referenced in version info). ^[file.txt] ^[strings.txt:1837] The outer PE is PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections, original filename Contract_Draft.exe (social-engineering lure). ^[file.txt] ^[metadata.json]

Obfuscation: AutoIt script uses autoit-hex-split-string-obfuscation — a 298 KB .au3 source with 38 lines of &= concatenation building variable $RBJIULRAP, each fragment polluted with the fixed delimiter e6tcsd. ^[floss.txt:274-311] The TMTIYRFKM function (line 3160) strips the delimiter via StringInStr / StringLeft / StringRight walks. ^[autoit_script.au3:3160-3170]

Payload chain:

Line 1: FileInstall("benting", @TempDir & "\benting", 1) drops a 94,720-byte companion file to disk. ^[autoit_script.au3:1]
Lines 312-314: delimiter stripped from $RBJIULRAP; the result is hex-decoded to raw bytes; DllStructCreate("byte[" & BinaryLen($rbjiulrap) & "]") allocates a buffer; DllStructSetData writes the shellcode; DllStructGetPtr yields the entry address. ^[autoit_script.au3:312-315]
Line 316: CallWindowProc is invoked with the pointer ($OSRTQYDJ) as lpPrevWndFunc, jumping directly into the staged shellcode. ^[autoit_script.au3:316]

Shellcode (14,336 bytes): x86 position-independent code with standard prologue (55 8b ec ...) and multiple internal functions. No imports, no strings — API resolution inferred to be runtime via PEB walking (consistent with sibling sample 70848598 which uses CRC32 export hashing). ^[autoit_decoded_shellcode.bin:0x0] Static disassembly shows push ebp / mov ebp, esp stack frames and indirect call through resolved function pointers. ^[r2:shellcode_prologue]

Companion file (benting): 94,720 bytes, entropy 6.88 (high, consistent with encryption/compression). Not a valid PE in cleartext; XOR testing with the sibling sample's key (51AHC0R0YXO) does not yield a decryptable PE. Decryption key remains unknown. Static-only.

Anti-analysis: None observed in the AutoIt layer — no VM checks, no debug gates, no timing delays. The heavy string fragmentation and AutoIt compilation itself provide baseline evasion (capa flags AutoIt limitation). ^[capa.txt]

Deploy / ATT&CK

TTPs (static-only; CAPE skipped — no Windows guest):

Technique	Evidence	Confidence
T1055 — Process Injection	`CallWindowProc` used to jump to shellcode address in process memory	high
T1055.001 — Dynamic-link Library Injection (conceptual)	Same pattern as sibling: shellcode executes in AutoIt process context via hijacked callback	medium
T1027 — Obfuscated Files or Information	Hex-split delimiter obfuscation (`e6tcsd`), AutoIt compilation, UPX packing	high
T1204.002 — User Execution: Malicious File	Filename `Contract_Draft.exe` masquerades as a business document	high
T1105 — Ingress Tool Transfer	`FileInstall` drops `benting` to `%TEMP%` from embedded resource	high
T1620 — Reflective Code Loading	Shellcode is position-independent, resolves APIs at runtime; no PE header in shellcode layer	medium

Persistence: None observed. No registry writes, no scheduled tasks, no service creation in the AutoIt script.

C2 / Network: No C2 URLs, no IP addresses, no domain names in any decoded layer. The shellcode contains no plaintext network indicators. Attribution to a specific family is not possible from static analysis alone.

Attribution: Same autoit-hex-split-string-obfuscation + callwindowproc-shellcode-injection toolchain as sibling 70848598 (AutoIt dropper, PEB-walking shellcode, FileInstall companion file). However, the companion file benting uses a different encryption key than sibling 70848598's Sancha file (key 51AHC0R0YXO does not decrypt it). This may represent a new campaign rotation or a different actor using the same builder. Tagged unattributed pending cluster growth.

Capabilities

autoit-hex-split-string-obfuscation
callwindowproc-shellcode-injection
fileinstall-companion-drop
peb-walking-api-resolution
social-engineering-filename-lure
upx-packed-autoit-stub
static-only-analysis

> Analysis · bf109c1f2043_

Build / RE

Deploy / ATT&CK

Capabilities