We are aware of a publication about one campaign delivering this threat, but our findings and conclusions based on the report below slightly differ. While we have been monitoring this threat, we spotted a few publicly shared pieces of information, mainly by independent researchers, that were related to the functionality of dotRunpeX but misattributed to a different well-known malware family. The name of this injector is based on its version information which is the same for both dotRunpeX versions, consistent across all samples we analyzed and containing ProductName –. Although this injector is new, there are some connections to its older version sharing some similarities. NET using the Process Hollowing technique and used to infect systems with a variety of known malware families. Background & Key FindingsĭotRunpeX is a new injector written in. The main subject of this research is an in-depth analysis of both versions of the dotRunpeX injector, focusing on interesting techniques, similarities between them, and an introduction to the PoC technique used to analyze a new version of dotRunpeX as it is being delivered virtualized by a customized version of KoiVM.

The first public information about this threat is dated. The oldest sample related to the new version of dotRunpeX is dated. This new threat is used to deliver numerous different malware families, primarily related to stealers, RATs, loaders, and downloaders. We uncovered several different methods of distribution where in all cases, the dotRunpeX was a part of the second-stage infection. The monitoring showed that this new dotnet injector is still evolving and in high development.

CPR introduces several PoC techniques that were approved to be effective for reverse engineering protected or virtualized dotnet codeĭuring the past few months, we have been monitoring the dotRunpeX malware, its usage in the wild, and infection vectors related to dozens of campaigns.

We confirmed and detailed the malicious use of a vulnerable process explorer driver to disable the functionality of Anti-Malware services.

Commonly distributed via phishing emails as malicious attachments and websites masquerading as regular program utilities.

Investigation shows that dotRunpeX is used in the wild to deliver numerous known malware families.

DotRunpeX is protected by virtualization (a customized version of KoiVM) and obfuscation (ConfuserEx) – both were defeated.

Check Point Research (CPR) provides an in-depth analysis of the dotRunpeX injector and its relation to the older version.

Download anti malware windows 10