New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

Mar 20, 2023Ravie LakshmananCyber Threat / Malware

A new piece of malware dubbed dotRunpeX is
being used to distribute numerous known malware families such as
Agent Tesla^[1], Ave Maria^[2], BitRAT^[3], FormBook^[4], LokiBot^[5], NetWire^[6], Raccoon Stealer^[7], RedLine Stealer^[8], Remcos^[9], Rhadamanthys^[10], and Vidar^[11].

“DotRunpeX is a new injector written in .NET using the Process
Hollowing technique and used to infect systems with a variety of
known malware families,” Check Point said^[12] in a report published
last week.

Said to be in active development, dotRunpeX arrives as a
second-stage malware in the infection chain, often deployed via a
downloader (aka loader) that’s transmitted through phishing emails
as malicious attachments.

Alternatively, it’s known to leverage malicious Google Ads on
search result pages to direct unsuspecting users searching for
popular software such as AnyDesk and LastPass to copycat sites
hosting trojanized installers.

The latest DotRunpeX artifacts, first spotted in October 2022,
add an extra obfuscation layer by using the KoiVM virtualizing
protector.

It’s worth pointing out that the findings dovetail with a
malvertising campaign documented by SentinelOne last month in which
the loader and the injector components were collectively referred
to as MalVirt^[13].

Check Point’s analysis has further revealed that “each dotRunpeX
sample has an embedded payload of a certain malware family to be
injected,” with the injector specifying a list of anti-malware
processes to be terminated.

This, in turn, is made possible by abusing a vulnerable process explorer
driver^[15] (procexp.sys) that’s
incorporated into dotRunpeX so as to obtain kernel mode
execution.

There are signs that dotRunpeX could be affiliated to
Russian-speaking actors based on the language references in the
code. The most frequently delivered malware families delivered by
the emerging threat include RedLine, Raccoon, Vidar, Agent Tesla,
and FormBook.