Forensic Deep Dive: Shellcode Injection via Donot an Indian APT’s Malicious XLS

Donot APT: Threat Profile and Forensic Analysis of a Malicious XLS

Donot Team (also known as APTC35, Viceroy Tiger, or Mint Tempest) is a highly organized Advanced Persistent Threat group strongly suspected to operate with ties to the Indian state. Active since at least 2016, its operations are characterized by sophistication, persistence, and a clear focus on espionage aligned with regional geopolitical interests.

Targeting Scope and Motivation

Motivation: Cyber espionage and intelligence gathering for state aligned objectives.
Victimology: The group overwhelmingly targets government, military, defense, and foreign affairs ministries. They also target NGOs, diplomatic entities, and military personnel.
Geographic Focus: Historically centered on South Asia (particularly Pakistan, Bangladesh, Sri Lanka, and individuals in the Kashmir region). Recent campaigns show an expansion into South Asian embassies located in European diplomatic entities to gather broader intelligence on international policy and communications.

Signature Tactics, Techniques, and Procedures (TTPs)

The group is consistent in its methods, using multiple, interchangeable components to maintain persistent access.
Initial Access: Primarily uses highly effective spear phishing emails with compelling, context specific lures (e.g., impersonating officials or referencing real diplomatic events) to trick victims into enabling macros or clicking malicious links.
Execution & Evasion: Relies heavily on macro based shellcode injection to achieve in memory execution. This technique allows the malicious payload to run directly in the memory of a legitimate process (like Excel), bypassing disk based and signature based security products.
Toolset: Utilizes custom, proprietary backdoors and remote access trojans (RATs) such as YTY and GEdit. The malicious file analyzed here is the initial dropper designed to deliver these final stage payloads.
Platform Diversity: While focusing on Windows, the group has also been observed deploying trojanized Android applications to steal mobile data, demonstrating a commitment to comprehensive intelligence collection.

Forensic Analysis: The Malicious XLSX Dropper

The file analyzed is a classic example of a Donot APT delivery mechanism, using an old OLE format (.xls) to host an obfuscated macro designed for shellcode execution.

File Summary

VBA Code Analysis: Evasion Techniques

The macro found in the ThisWorkbook.cls stream utilizes several techniques to hide its intent and bypass detection:

Obfuscation:
Randomized Names: All functions and variables are assigned meaningless, randomized names (e.g., lijlJliiiLIijILL, llJJIlJILlllljiL) to confuse analysts and automated tools.
Hexadecimal Shellcode Array: The actual malicious code is stored as a massive byte array of hexadecimal values (jijjLLlLiLJLlJli(1 0) = &H90:). This avoids placing suspicious executable strings in the macro’s source code.
Compatibility: Inclusion of If VBA7 Then directives shows a deliberate effort to ensure the macro runs successfully across both 32bit and 64bit Office environments.

Execution Primitives: Windows API Abuse

The core malicious action is revealed by the declaration and intended use of three low level Windows Native API functions. This proves intent to execute arbitrary machine code.

Shellcode Payload Analysis

Execution Flow: The VBA subroutine first allocates the executable memory, then copies the jijjLLlLiLJLlJli array into it, and finally triggers execution via the abused Internal_EnumUILanguages function.
PostExecution Action: The shellcode (the first stage payload) is not fully deobfuscated in the static analysis, but based on the TTPs of Donot APT, its function is certain: to establish a foothold by downloading, decrypting, and executing a more permanent, custom secondary payload (like YTY or GEdit) and setting up Command and Control (C2) communication for data exfiltration and persistent surveillance.

Conclusion and Next Steps

This Excel file is a highly evasive and unequivocally malicious dropper designed to facilitate state sponsored cyber espionage.

Donot APT uses memory. Contact us to find what others miss.