Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) - ASEC

What Happened

A North Korean hacking group called Larva-26005 has been attacking Korean computer users since at least 2020. They use a malicious program called Xctdoor, which is an updated version of an older tool called CRAT. The attackers trick people into opening fake files that look like documents or security software installers. Once installed, the malware can secretly control the victim's computer, steal files, record keystrokes, take screenshots, and download additional malicious tools. The group previously deployed ransomware called Hansom alongside their backdoor tools. Organizations and individuals in Korea, especially corporate users, are the primary targets. People should avoid opening suspicious email attachments or executable files from unknown sources and keep their security software updated.

Key Takeaways

• Larva-26005 (linked to North Korea/Lazarus) has been active since at least 2020, initially using CRAT alongside Hansom ransomware and now deploying Xctdoor backdoor with XcLoader injector.
• Xctdoor and CRAT share identical code obfuscation routines, AppX package installation paths, and XOR decryption algorithms, confirming a developmental lineage between the two malware families.
• Initial access vectors include spear phishing LNK files, disguised security software installers (Veraport, SoftCamp), compromised IIS web servers, and tampered Korean ERP/groupware update modules.
• Xctdoor supports a full backdoor command set including shell sessions, file upload/download, keylogging, screenshots, process injection, and drive monitoring, with both C++ and Go variants identified.
• Persistence is maintained via Task Scheduler, startup shortcuts, Run registry keys, and RegSvr32 loading of malicious DLLs from AppX package paths.

Affected Systems

• Windows desktop and server systems (IIS web servers, groupware systems, ERP solutions)
• Korean users and corporate users targeted via spear phishing
• Korean ERP solutions and groupware systems with exposed file upload pages

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Spear phishing emails deliver LNK files or disguised security software installers (Veraport, SoftCamp) to Korean users; alternatively, compromised IIS servers or groupware upload pages are exploited.
2. Execution: DLL side-loading loads malicious dropper DLLs (credui.Dll, RADCUI.Dll) via renamed legitimate executables (ShellRunAs, wksproker.Exe).
3. Scripting: Dropper creates VBS launcher, BAT downloader, and VBS downloader scripts in %PUBLIC%\videos\ to download payloads and register persistence via Task Scheduler.
4. Staging: PowerShell script moves encrypted Xctdoor and XcLoader to AppX package paths and applies XOR decryption.
5. Persistence and Injection: RegSvr32 loads XcLoader (settings.Lock), which reads and decrypts Xctdoor (roaming.Dat) and injects it into a legitimate process (default: explorer.exe).
6. C2 and Exfiltration: Xctdoor connects to C2 server, monitors user absence status, and executes backdoor commands including file exfiltration, keylogging, screenshots, and process injection.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article provides detailed technical analysis of malware internals, file paths, and command structures but does not include any detection rules or queries.

Detection Engineering Assessment

Required Log Sources

• Windows Sysmon Event ID 7 (Image Loaded - DLL side-loading)
• Windows Sysmon Event ID 1 (Process Creation - RegSvr32, PowerShell, cmd)
• Windows Sysmon Event ID 11 (File Creation - scripts in %PUBLIC%\videos)
• Windows Sysmon Event ID 8 (CreateRemoteThread - process injection)
• Windows Security Event ID 4688 (Process Creation)
• Windows Task Scheduler logs
• Network proxy/ firewall logs for HTTP traffic to C2 domains
• EDR process injection and memory scanning telemetry

Hunting Hypotheses

Control Gaps

• Static signature-based antivirus may miss Xctdoor due to continuous re-encryption of the PE file with changing obfuscation keys after each execution.
• Network-based detection may not flag C2 traffic if it uses standard HTTP on non-standard ports and blends with web browsing traffic.
• Application allowlisting may not catch DLL side-loading when legitimate signed executables are used as hosts.
• Web shell detection on compromised IIS servers may be insufficient if the web shell is deployed via vulnerable upload pages without file type validation.

Key Behavioral Indicators

• RegSvr32 loading a DLL from an AppX package Settings directory (settings.Lock)
• Script files created in %PUBLIC%\videos\ directory with VBS, BAT, or PS1 extensions
• Renamed Sysinternals ShellRunAs or Microsoft wksproker executable loading a DLL named credui.Dll or RADCUI.Dll from the same directory
• Process injection into explorer.exe with RegSvr32 as ancestor process
• File named roaming.Dat in AppX Settings directory being read and injected into a process
• Task Scheduler entries referencing VBS scripts in %PUBLIC%\videos\
• Named pipe ChromeUpdatePipe creation indicating CRAT injector activity

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing file upload validation on exposed groupware and web application upload pages to prevent web shell deployment.
• Evaluate whether IIS servers in your environment have unnecessary exposure and apply patching and hardening per vendor guidance.
• Consider monitoring and restricting write access to ERP solution update modules to detect tampering that injects malicious execution routines.
• If applicable, evaluate network segmentation to limit lateral movement from compromised web servers to internal systems.

User Protection

• Consider deploying endpoint detection rules for DLL side-loading patterns involving renamed legitimate executables.
• Evaluate whether your EDR can detect process injection from RegSvr32 into explorer.exe or other legitimate processes.
• Consider enabling Sysmon logging with DLL loading and file creation events on systems used by users likely to be targeted by Korean-language phishing.
• If supported by your tooling, consider blocking execution of scripts from %PUBLIC%\videos\ via application control policies.

Security Awareness

• Consider incorporating phishing awareness training that specifically addresses LNK files disguised as documents, as these are a primary initial access vector for this threat actor.
• Consider reminding users that security software installers should only be obtained from vendor-verified sources, not from email attachments or untrusted downloads.
• Consider adding awareness content about the risk of opening files with Korean-language themes related to investments, real estate, account statements, or security precautions, as these are known lure topics.

MITRE ATT&CK Mapping

Additional IOCs

• Registry Keys:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run - Run key used by CRAT to register an LNK file that executes the malware via RegSvr32 for persistence.
• File Paths:
  • %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\roaming.Dat - Path where encrypted Xctdoor backdoor PE file is staged after being moved by PowerShell launcher.
  • %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\settings.Lock - Path where XcLoader injector DLL is staged and loaded via RegSvr32.
  • %ALLUSERSPROFILE%\msci.Cng - File storing data used in Xctdoor communication packet headers; reset by backdoor command 0x10025.
  • %PUBLIC%\videos\2.Ps1 - PowerShell launcher script downloaded by VBS downloader to move and XOR-decrypt Xctdoor and XcLoader payloads.
  • %LOCALAPPDATA%\microsoft\windowsapps\microsoft.Microsoftedge_8wekyb3d8bbwe\ - AppX package path consistently used by both CRAT and Xctdoor for malware installation since 2020.
• Command Lines:
  • Purpose: Load XcLoader injector DLL via RegSvr32 to execute Xctdoor backdoor | Tools: regsvr32.exe | Stage: Execution and Persistence
  • Purpose: PowerShell script moves encrypted payloads to AppX paths and XOR-decodes XcLoader | Tools: powershell.exe | Stage: Staging and Execution | powershell.exe -file %PUBLIC%\videos\2.Ps1
• Other:
  • \\.\Pipe\ChromeUpdatePipe - Named pipe used by CRAT and co-installed injector module to transmit payloads for process injection.
  • SM3:2300:402:WilStaging_01 - Shared memory name created by Xctdoor command 0x10026 for inter-process data storage.