NailaoLoader : Hiding Execution Flow via Patching

NailaoLoader employs sophisticated techniques to obscure its execution flow, leveraging Windows Management Instrumentation (WMI) for lateral movement and file transfer.

Threat actors use WMI to deploy three files—usysdiag.exe, sensapi.dll, and usysdiag.exe.dat—to targeted machines. The process begins with the execution of usysdiag.exe, a legitimate signed executable by Huorong Internet Security.

Execution Flow

1. DLL Side-Loading:
   The legitimate usysdiag.exe calls LoadLibraryA() to load sensapi.dll. However, a malicious version of sensapi.dll (NailaoLoader) is side-loaded from the same directory. Once loaded, the malicious DLL’s DllMain() function is executed.
2. Verification and Patching:
   NailaoLoader verifies specific byte sequences in the .text section of usysdiag.exe. If the bytes match expected values, it proceeds; otherwise, it exits without executing malicious code. This ensures that only the intended executable (usysdiag.exe) can trigger the loader.
3. Memory Manipulation:
   NailaoLoader uses the verified bytes to locate and patch instructions in the .text section of usysdiag.exe. It retrieves the address of VirtualProtect() from kernel32.dll and changes memory protection to PAGE_READWRITE. The patched instructions redirect execution to NailaoLoader’s decryption function.
4. Decryption and Execution:
   The patched code executes a function that decrypts the encrypted file (usysdiag.exe.dat) using a XOR key. The decrypted payload is mapped into memory, and control is transferred to its entry point.
5. Restoration:
   After execution, NailaoLoader restores memory protections to their original state (PAGE_EXECUTE_READ). This final step helps avoid detection by security tools.

Key Technique: Execution Flow Obfuscation

The critical innovation lies in NailaoLoader’s ability to hide its execution flow. By patching instructions in a legitimate process (usysdiag.exe) rather than calling malicious functions directly from its own DLL, it avoids raising suspicion.

This technique ensures that security tools monitoring DLL behavior are less likely to detect malicious activity.

NailaoLoader exemplifies advanced malware techniques like DLL side-loading, memory patching, and execution flow obfuscation. These methods make it challenging for defenders to trace or block its activities effectively.