Smoked out - Emmenhtal spreads SmokeLoader malware

Analysis by Lovely Antonio, Ricardo Pineda, and Louis Sorita

We observed a malicious campaign targeting First Ukrainian International Bank (pumb[.]ua) and noticed the usage of a stealthy malware loader known as Emmenhtal (sic! - this spelling refers to the HTA component of this loader, hence slightly unorthodox spelling "EmmenHTAl) also referred to by Google as Peaklight. This loader has been active since early 2024 and is primarily used by financially motivated threat actors to distribute commodity infostealers such as CryptBot and Lumma. In this campaign, we have observed that Emmenhtal Loader has been chained together with SmokeLoader malware, allowing threat actors to leverage its modular capabilities for deploying additional malware dynamically.

The infection chain starts with an email claiming to confirm that a payment has been made. Attached to the email is a 7z archive file, named deceptively as ‘Платiжна_iнструкция.7z’ (translated as “Payment_instruction”) to trick victims into extracting and opening its contents.

In previous SmokeLoader campaigns, the threat actors exploited a 7-Zip zero-day vulnerability to bypass security checks using double-archived files, allowing malware execution. Although this campaign does not use the same exploit, it shows the attackers’ continued use of archive-based evasion techniques to deliver malicious payloads.

Once extracted, the 7z archive contains two files:

1. A bait PDF file designed to appear as legitimate banking documents as seen in Figure 3.1.
2. A PDF shortcut that will download a file from a remote server as seen in Figure 3.2.

When opened, the internet shortcut file attempts to retrieve an additional file from 194[.]87[.]31[.]68[.]@80\Downloads\Document_main1.pdf.lnk

Upon execution of the downloaded .lnk file, the attack chain exploits the Target field to execute Mshta via PowerShell. Mshta (Microsoft HTML Application) is a built-in Windows tool used to execute HTML Applications and scripts (.HTA files). In this case, the legitimate Mshta file was used by the malware to download and execute another binary sample with malicious HTA script from a remote file server. This is a common LOLBAS (Living Off the Land Binaries and Scripts) technique, using legitimate applications such as utility tools present in the target computer that allows less to no footprint allowing fileless execution and minimal visibility.

Notably, the attack uses a modified version of DCCW.exe, which is a built-in Windows utility that stand for Display Color Calibration Wizard. The attackers modified DCCW.exe to act as a loader for the malicious script, making the attack look more legitimate.

Upon execution from Mshta, it will interpret the first malicious JavaScript embedded just below the third DCCW code.

Decoded script leads to a PowerShell execution of another encoded PowerShell script with the following visible PowerShell command.

• -w 1: Starts PowerShell in a hidden window (1 minimizes the window).
• -ep Unrestricted: Sets the execution policy to Unrestricted, allowing all scripts to run.
• -nop: No profile loading, reducing execution time and avoiding detection.

Analysis of the downloaded binary (Figures 11, 12 and 13) indicates that the file is a SmokeLoader malware. Aside from being a well-known loader, SmokeLoader is also a modular malware that has various capabilities such as:

• Download and execute additional malware
• Steal credentials from browsers and system memory
• Execute remote commands from its command and control (C2) server
• Evade detection by injecting itself into legitimate processes
• Anti-analysis and anti-debugging techniques