Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Title: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Status: test
Description:Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
References:
  -https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  -https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  -https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0
Author: pH-T (Nextron Systems)
Date: 2022-03-01
modified:2023-04-06
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.001'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ'
      -'oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA'
      -'6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA'
      -'OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ'
      -'oAOgAoACIATABvACIAKwAiAGEAZAAiACkA'
      -'6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA'
      -'OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ'
      -'oAOgAoACIATABvAGEAIgArACIAZAAiACkA'
      -'6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA'
      -'OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ'
      -'oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA'
      -'6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA'
      -'OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ'
      -'oAOgAoACcATABvACcAKwAnAGEAZAAnACkA'
      -'6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA'
      -'OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ'
      -'oAOgAoACcATABvAGEAJwArACcAZAAnACkA'
      -'6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA'

  condition:selection
Falsepositives:
  -Unlikely
Level: high