7 minhigh
Technical Analysis of 2CLoader | ThreatLabz
2CLoader is a new Windows malware loader using indirect syscalls and anti-analysis techniques to deliver Vidar, Remus, and XWorm RAT via HTTP C2 infrastructure. 2CLoader decrypts its payload from an encrypted PE resource using multi-stage XOR and AES-GCM, then executes it via process hollowing, in-process PE loading, or CLR hosting. It employs Hell's Gate indirect syscalls, inline API hooks for environment spoofing, and six persistence methods including registry Run keys and scheduled tasks.
Sens:▲ 24hConf:high
IOCs29
19sha2564registry key2url1domain1file path1ip1md5
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block network traffic to aware-cr1.com and 62.60.226.185.
- Hunt for registry Run values named SecurityHealthService.exe across endpoints.
- Quarantine hosts with matching SHA256 hashes from the IOC list.
- Block the URL path /api/beacon on web proxies.
Key Takeaways
- Identified August 2026; delivers Vidar (66.7%), Remus (31.7%), and XWorm RAT (1.6%).
- Uses Hell's Gate technique for indirect syscalls on six Nt* APIs with syscall gadget scanning.
- Payload encrypted with rolling XOR, second XOR layer, then AES-GCM; decompressed via Xpress Huffman.
- Inline trampoline hooks on ~20 Windows APIs spoof system info and tamper network data.
- Persistence value name SecurityHealthService.exe used across Run, RunOnce, and scheduled task methods.
Attack Chain
- Initial Access: 2CLoader executable downloaded from ITW URL on attacker infrastructure
- Defense Evasion: Anti-VM, anti-debug, and user activity checks performed before payload decryption
- Execution: Payload decrypted via multi-stage XOR and AES-GCM, executed via RunPE, LoadPE, or CLR hosting
- Persistence: Registry Run keys, Startup folder, scheduled tasks, or Winlogon helpers configured
- C2 Communication: HTTP POST with XOR-encrypted JSON sent to C2 for registration and status reporting
- Payload Delivery: Vidar, Remus, or XWorm RAT executed on victim system
Affected Systems
- Windows 10/11 x64 systems
- Windows systems with .NET CLR runtime
- Windows endpoints targeted by info stealers
Detection Availability
- Published: Other detection logic
- Platforms: ThreatLabz GitHub, Zscaler Cloud Sandbox
Python payload decryption script and VM blocklist on ThreatLabz GitHub. Zscaler Cloud Sandbox detection available.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Indirect syscalls and inline API hooks bypass common EDR instrumentation points. |
| Network Visibility | Medium | HTTP C2 with XOR-encrypted JSON body; non-standard ports observed in sandbox. |
| Detection Difficulty | Hard | Multiple anti-analysis layers, indirect syscalls, API hooks, and configurable execution paths. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Process loading a fresh copy of ntdll.dll from disk to extract syscall numbers via Hell's Gate (T1497, T1562) | Sysmon Event ID 7 (Image Load) | Defense Evasion | Low — rare in normal operations |
| Suspended process creation followed by section mapping and thread context modification indicating process hollowing (T1055.012) | Sysmon Event ID 8, EDR process telemetry | Execution | Medium — legitimate debuggers use similar patterns |
| Registry Run or RunOnce values named SecurityHealthService.exe indicating 2CLoader persistence (T1547.001) | Sysmon Event ID 12-13, registry auditing | Persistence | Low — value name impersonates legitimate Windows service |
| HTTP POST to /api/beacon with application/octet-stream and Chrome User-Agent indicating 2CLoader C2 (T1071.001) | Proxy logs, network firewall logs | Command and Control | Low — specific endpoint and content-type combination |
Required Log Sources
- Sysmon Event ID 1 (Process Create)
- Sysmon Event ID 8 (RemoteThread)
- Sysmon Event ID 11 (FileCreate)
- Sysmon Event ID 12-13 (Registry)
- Windows Security Event ID 4688
- Network proxy/firewall logs
Key Behavioral Indicators
- Suspended dllhost.exe or svchost.exe with section mapping activity
- Registry Run/RunOnce values named SecurityHealthService.exe
- Scheduled task named SecurityHealthService.exe with LogonTrigger
- Files matching %TEMP%\aw_*.lk held open with delete-on-close
- Process loading fresh ntdll.dll copy from disk (Hell's Gate)
- HTTP POST to /api/beacon with octet-stream content type
Control Gaps
- Indirect syscalls bypass inline ntdll API hooks used by EDR
- Inline trampoline hooks modify API return data within process memory
- Anti-VM score-based checks may pass sandbox environments with sufficient indicators
- PPID spoofing to explorer.exe evades parent-child process correlation
- XOR-encrypted JSON C2 body may bypass network signature inspection
False Positive Assessment
Low — SecurityHealthService.exe is legitimate as a process but not as a Run key or scheduled task name. Behavioral indicators are rare in normal operations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block C2 domain and IP at firewall and proxy layers.
- Enable registry auditing on Run, RunOnce, and Windows Load keys.
- Restrict outbound HTTP traffic on non-standard ports.
- Deploy network signature for XOR-encrypted JSON POST to /api/beacon.
User Protection
- Ensure EDR agents are updated with latest threat signatures.
- Enable behavioral detection rules for process hollowing and PPID spoofing.
- Monitor for scheduled tasks named SecurityHealthService.exe.
- Deploy application whitelisting to prevent execution from %TEMP%.
Security Awareness
- Warn users about downloading executables from untrusted URLs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping23 techniques
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
T1027Obfuscated Files or InformationT1027.013Encrypted/Encoded FileT1620Reflective Code LoadingT1497Virtualization/Sandbox EvasionT1497.001System ChecksT1497.002User Activity Based ChecksT1497.003Time Based ChecksT1622Debugger EvasionT1006Direct Volume AccessT1562.001Disable or Modify ToolsT1070.004File Deletion
Tactic
Discovery
Tactic
Command and Control
Plain-Language Summary
A newly discovered malware tool called 2CLoader acts as a delivery mechanism for information-stealing programs like Vidar and Remus. It targets Windows computers and uses sophisticated techniques to avoid detection by security software, including checking if it is running in a virtual machine and hiding its true behavior. Organizations should update their security tools and block connections to the known malicious addresses listed in the report.
Additional IOCs
- File Hashes:
0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca6(SHA256) - 2CLoader sample SHA256 hash06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e(SHA256) - 2CLoader sample SHA256 hash066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6(SHA256) - 2CLoader sample SHA256 hash0a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e(SHA256) - 2CLoader sample SHA256 hash0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e(SHA256) - 2CLoader sample SHA256 hash0e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa27(SHA256) - 2CLoader sample SHA256 hash0ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb1(SHA256) - 2CLoader sample SHA256 hash1337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb(SHA256) - 2CLoader sample SHA256 hash1447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf(SHA256) - 2CLoader sample SHA256 hash1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f(SHA256) - 2CLoader sample SHA256 hash246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095(SHA256) - 2CLoader sample SHA256 hash2ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b(SHA256) - 2CLoader sample SHA256 hash2c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b(SHA256) - 2CLoader sample SHA256 hash2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa6(SHA256) - 2CLoader sample SHA256 hash30cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca(SHA256) - 2CLoader sample SHA256 hash3286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d4(SHA256) - 2CLoader sample SHA256 hash331fd58d4899e9fb888a5e4193d0e36f6ff29063808c59a164d98e26835054972(SHA256) - 2CLoader sample SHA256 hash45d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b(SHA256) - 2CLoader sample SHA256 hash4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b(SHA256) - 2CLoader sample SHA256 hash21B44E216B3E391DEE3520C358343D58(MD5) - 2CLoader sample MD5 from sandbox analysis
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run- Persistence via value named SecurityHealthService.exeHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce- Persistence via value named SecurityHealthService.exeHKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows- Persistence via Load valueHKCU\Environment- Persistence via UserInitMprLogonScript value
- File Paths:
%TEMP%\aw_[ID-as-hex].lk- Single-instance lock file with delete-on-close
- Other:
4A 7B 3C 1D 8E 5F A0 D1 62 93 24 F5 B6 47 C8 09 E1 72 53 84 35 A6 D7 18 49 FA 0B 6C 9D 2E BF 50- XOR key for network C2 JSON encryption
Showing defanged values
- domainaware-cr1[.]com2CLoader C2 server domain
- file_path%TEMP%\aw_[ID-as-hex].lkSingle-instance lock file with delete-on-close
- ip62[.]60[.]226[.]1852CLoader in-the-wild payload download server
- md521b44e216b3e391dee3520c358343d582CLoader sample MD5 from sandbox analysis
- registry_keyHKCU\EnvironmentPersistence via UserInitMprLogonScript value
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunPersistence via value named SecurityHealthService.exe
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunOncePersistence via value named SecurityHealthService.exe
- registry_keyHKCU\Software\Microsoft\WindowsNT\CurrentVersion\WindowsPersistence via Load value
- sha2560017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca62CLoader sample SHA256 hash
- sha25606185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e2CLoader sample SHA256 hash
- sha256066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c62CLoader sample SHA256 hash
- sha2560a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e2CLoader sample SHA256 hash
- sha2560d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e2CLoader sample SHA256 hash
- sha2560e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa272CLoader sample SHA256 hash
- sha2560ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb12CLoader sample SHA256 hash
- sha2561337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb2CLoader sample SHA256 hash
- sha2561447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf2CLoader sample SHA256 hash
- sha2561b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f2CLoader sample SHA256 hash
- sha256246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce0952CLoader sample SHA256 hash
- sha2562ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b2CLoader sample SHA256 hash
- sha2562c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b2CLoader sample SHA256 hash
- sha2562d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa62CLoader sample SHA256 hash
- sha25630cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca2CLoader sample SHA256 hash
- sha2563286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d42CLoader sample SHA256 hash
- sha25645d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b2CLoader sample SHA256 hash
- sha2564c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b2CLoader sample SHA256 hash
- sha2565edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a2CLoader sample SHA256 hash
- urlhxxp://62[.]60[.]226[.]185/t0907[.]exe2CLoader in-the-wild executable download URL
- urlhxxps://aware-cr1[.]com/api/beacon2CLoader C2 beacon registration endpoint