PureLogs Variant Evades Detection via MsBuild.exe Process Hollowing

Key Takeaways

• A new, advanced variant of the PureLogs information stealer is actively circumventing detection.
• The malware leverages process hollowing on the legitimate Windows MsBuild.exe tool to execute its payload discreetly.
• Initial infection vectors involve sophisticated phishing emails distributing an obfuscated JavaScript file.
• PureLogs targets a vast array of sensitive data, including browser credentials, cryptocurrency wallets, and email client information.
• Defenders should focus on endpoint monitoring for unusual process behavior, employee training against phishing, and restricting script execution.

A sophisticated new strain of the PureLogs information-stealing malware has emerged, employing an advanced evasion technique that leverages process hollowing within the trusted Windows MsBuild.exe utility. This development signals a significant escalation in the malware’s tactics, posing a heightened threat to organizations and individual users alike.

Unlike previous iterations, this variant utilizes a multi-stage infection chain designed to bypass conventional security measures. Its distinctive approach involves weaponizing legitimate system components, making it particularly challenging to detect and mitigate.

Infection Chain and Evasion Techniques

The attack typically commences with a deceptive phishing email, crafted to mimic a purchase order or similar business communication. This social engineering tactic aims to trick recipients into opening an attached archive file.

Contained within the archive is a heavily obfuscated JavaScript file, which, upon execution, initiates the complex infection process. The obfuscation serves as a primary evasion layer, hindering immediate analysis and flagging by security tools.

According to a report by researchers at Fortinet’s FortiGuard Labs, shared with Cyber Security News, the campaign orchestrates multiple layered techniques, including obfuscated JavaScript, PowerShell execution, and the critical process hollowing technique, to ultimately deploy the PureLogs payload. Their in-depth analysis revealed a seamless progression through each stage, leaving minimal forensic traces for defenders to follow until data exfiltration has already occurred.

Following the JavaScript execution, a highly obfuscated PowerShell script is dropped and run. This script is responsible for decoding and loading an encrypted .NET module directly into memory. This module is cleverly disguised as a legitimate Windows Task Scheduler component, further enhancing its ability to blend into normal system operations and avoid suspicion.

Process Hollowing via MsBuild.exe

The most technically impactful feature of this PureLogs variant is its utilization of process hollowing through MsBuild.exe, a legitimate Microsoft build tool integral to the .NET Framework. The downloader module first identifies MsBuild.exe on the compromised system and then launches it in a suspended state. Subsequently, it “hollows out” the memory space of the suspended process and injects the PureLogs payload into this newly emptied region. The legitimate MsBuild.exe process is then resumed, now executing the malicious code.

This technique allows the malware to operate from within a signed, trusted Windows process, making it significantly more difficult for endpoint security solutions to identify and flag the malicious activity. Many security tools, by default, grant MsBuild.exe a high degree of trust, allowing it to run without extensive scrutiny. The injected code employs standard Windows API calls such as CreateProcessA, WriteProcessMemory, and ResumeThread to flawlessly execute the process hollowing operation.

Further bolstering its stealth, the PureLogs payload itself is protected with commercial obfuscation tools like .NET Reactor and IntelliLock, presenting additional hurdles for reverse-engineering efforts. Once fully embedded within MsBuild.exe, PureLogs silently operates, collecting sensitive data and exfiltrating it to a command-and-control (C2) server via encrypted HTTPS requests.

Extensive Data Theft Capabilities

PureLogs is engineered for comprehensive data exfiltration from infected machines. It scans over 80 different web browsers, including popular ones like Google Chrome and Mozilla Firefox, as well as niche options such as CocCoc and Kinza, to harvest saved credentials, cookies, and autofill information. However, browsers represent only a fraction of its targets.

The malware also aggressively targets numerous cryptocurrency wallets, including well-known applications like Exodus, Electrum, Atomic Wallet, and Binance. Beyond financial applications, PureLogs sets its sights on email clients such as Microsoft Outlook, Thunderbird, and Foxmail, alongside FTP tools like FileZilla and various VPN clients, including ProtonVPN and OpenVPN. All stolen data is encrypted using a unique key embedded within the malware’s configuration block before being transmitted to the attacker’s server.

What You Should Do

• Enhance Email Security: Implement robust email filtering to detect and block phishing attempts, especially those with invoice or purchase order themes.
• Disable JavaScript Execution: Configure email clients and operating systems to prevent the automatic execution of JavaScript files from email attachments.
• Monitor PowerShell Activity: Deploy endpoint detection and response (EDR) solutions to monitor for unusual or obfuscated PowerShell script execution.
• Restrict Process Behavior: Implement policies to restrict the ability of less common processes to spawn child processes or initiate outbound network connections.
• Employee Security Awareness Training: Conduct regular training sessions for employees to educate them on recognizing and reporting phishing lures and suspicious attachments.
• Indicators of Compromise (IoCs):
  • File Name: pankocrs.js (Malicious obfuscated JavaScript file)
  • File Name: ps_qnSEGUkU0LIY_1777592585573.ps1 (Dropped PowerShell script)
  • File Name: zgSGkYYzqVe.dll (Encrypted plugin/payload DLL)
  • File Name: miySTll (C# downloader module)
  • Process: MsBuild.exe (Legitimate Windows process hollowed by PureLogs)
  • Method Name: tiyvIXAqfXvogv46vck.opr2xfZUr15bo4oEyY.zYwtW19n4() (Entry point in downloader module)
  • Technique: Invoke-AssemblyMethod / Invoke-Expression (PowerShell commands for in-memory execution)
  • Data Path: %LocalAppData%MicrosoftEdgeUser DataDefaultLogin Data (Example path for browser credential theft)
  • C2 Protocol: HTTPS (HttpClient.GetAsync())

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.