Malware Analysis Report: ASEAN Notes.iso from Mustang Panda Campaign

Author: Capang
Date: 24-01-2025
Analysis Environment: Windows 10 VM
Associated Campaign: Mustang Panda ASEAN Notes.iso  
Ref: https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/

Executive Summary

The ASEAN Notes.iso file is a component of a Mustang Panda campaign targeting entities in Myanmar. The attack leverages DLL sideloading via a hijacked Microsoft GetCurrentRollback.exe process (renamed office.exe) to execute the malicious GetCurrentDeploy.dll. The malware establishes persistence through registry modification and attempts C2 communication with fallback infrastructure. Primary objectives include initial access, persistence, and command execution, with suspected espionage motivations.

Case Details

File Metadata

Case Specific Requirement

Machine

• Windows Environment

Tools

• hashmyfiles
• PEStudio
• DiffView
• RegShot
• Wireshark
• DirWatch

Static Analysis

ASEAN Notes.iso

34/61 security vendors flagged this file as malicious.

Associated with Mustang Panda targeting Myanmar

When mounting the ISO file, the victim is shown a set of LNK files or Shortcut and a folder with numerous structure named _

All of the LNK files are programmed to display PDF icon. Each of the LNK / Shortcut has the same properties/command which is

C:\Windows\System32\ScriptRunner.exe -appvscript _\_\_\_\_\_\_\_\_\_\_\_\office.exe

The _ folder structure:

At the end of folder _ there are office.exe and GetCurrentDeploy.dll.

office.exe

No security vendors flagged this file as malicious. However office.exe is not the real name of this file.

GetCurrentRollback.exe is the original name and it is a legitmate file associated with Microsoft Corporation. Why does the LNK file execute a legitimate file? DLL-Side Loading is the current assumption that can be made.

GetCurrentDeploy.dll

49/72 security vendors flagged this file as malicious

11//77 Windows API being used flaged as malicious

Can be confirmed that DLL-Side Loading attack is being used. office.exe or GetCurrentRollback.exe might be using a shared library or DLL named GetCurrentDeploy.dll. The nature of importing functions from a shared library is to locate the file in a specific order. For windows this is the searching order:

1. The directory from which the application loaded
2. The system directory
3. The 16-bit system directory
4. The Windows directory
5. The current working directory (CWD)
6. The directories that are listed in the PATH environment variable

Knowing the office.exe and GetCurrentDeploy.dll is in the same folder indicates DLL-Side Loading attack is being used.

reference: https://techzone.bitdefender.com/en/tech-explainers/what-is-dll-sideloading.html

Key Findings

• Victim will be tricked into mounting the ISO file and click one of the LNK file
• The LNK file will execute C:\Windows\System32\ScriptRunner.exe -appvscript _\_\_\_\_\_\_\_\_\_\_\_\office.exe
• The file office.exe using GetCurrentDeploy.dll as shared library
• Malicious code is executed within the context of a legitimate application using DLL Side Loading method

Attack Visualization

Dynamic Analysis

Network Analysis

Clicking on one of the LNK files will execute C:\Windows\System32\ScriptRunner.exe -appvscript _\_\_\_\_\_\_\_\_\_\_\_\office.exe. Right off executing it, the malware will try to communicate with its C2, openservername.com with IP 103.159.132.80.

DNS request for openservername.com

Malware trying to communicate with the C2, but unfortunately the C2 is down.

Upon multiple failed request, the malware switch into another C2 server with IP 37.120.222.19

This C2 is also down. After failed attempts to communicate with the C2 servers, the malware killed itself However upon execution, the malware replicate itself into C:\Users\Public\ directory

Persistence

The malware established a persistence under the registry gameestrto with command line argument StarWegameToyOU at under \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Key.

The Run key makes a program run every time a user logs on.

Execution Flow

1. LNK Activation: Triggers ScriptRunner.exe to execute office.exe from the nested _ directories.

2. DLL Hijacking: office.exe loads GetCurrentDeploy.dll from its directory (DLL search order abuse).

3. Persistence: Copies itself to C:\Users\Public\office.exe and adds registry autorun entry.

4. C2 Communication:

   • Primary C2: openservername.com (103.159.132.80)

   • Fallback C2: 37.120.222.19

5. Self-Termination: Exits if C2s are unreachable.

Key Technical Findings

1. DLL Sideloading Technique:

   • Legitimate Process: GetCurrentRollback.exe (Microsoft-signed).

   • Malicious DLL: GetCurrentDeploy.dll (unsigned, high entropy sections).

2. Persistence Mechanism:

   • Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gameestrto → "C:\Users\Public\office.exe".

3. C2 Resilience: Dual C2 infrastructure with failover logic.

Full Malware Events

IOC

Reference

https://www.spyshelter.com/exe/microsoft-corporation-getcurrentrollback-exe/ https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/ https://techzone.bitdefender.com/en/tech-explainers/what-is-dll-sideloading.html https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys